BlancVPN Privacy Policy

1. Who we are

This Privacy Policy explains how YADDA OÜ, a company registered in Estonia with registry code 16469911 and registered address Pärnu maakond, Häädemeeste vald, Võiste alevik, Ranna tn 6, 86501 (“BlancVPN”, “we”, “us”), processes personal data when you visit our websites, use our applications, or otherwise interact with our VPN service (the “Services”, as defined in our Terms of Use).

BlancVPN is the controller of the personal data described in this Privacy Policy within the meaning of Article 4(7) of Regulation (EU) 2016/679 (the “GDPR”). Currently, YADDA OÜ is the only group entity that processes personal data in connection with the Services; no other BlancVPN group company receives or processes personal data as controller or processor.

We have not appointed a Data Protection Officer (DPO), as our processing activities do not require one under Article 37 GDPR. 

If you have any questions about this Privacy Policy or how we handle your personal data, you can contact us at support@blancvpn.com.

2. Our no-logs commitment

BlancVPN is built around a no-logs architecture. We do not collect, store, or share information about your online activity while connected to our VPN, including your browsing history, traffic content, or connection destinations. We never store the content of, or metadata about, the websites or services you access through the VPN tunnel.

Our VPN servers never receive your email address, name, payment details, or other account information. They process and temporarily hold only the technical information strictly necessary to authenticate you and route your connection (such as a pseudonymous user/device identifier and connection metadata required for the VPN protocol to function). Your IP address is used only in the server’s memory as part of the network connection itself; it is not logged, written to disk, or recorded together with your identifier. This information is not linked to your browsing activity and is not retained on the server after your session ends.

All personal data described in Section 3 below (account, billing, support, and analytics data) is collected and processed separately from the VPN tunnel itself, and is hosted and processed either within the European Union or as described in Section 5 below.

3. Personal data we collect and why

We collect the minimum personal data necessary to provide, secure, and improve the Services. The table below summarises what we collect, why, and the legal basis under Article 6 GDPR.

4. Recipients of your data — sub-processors

We share personal data only with carefully selected service providers who process it on our behalf (processors), strictly for the purposes described in this Policy, and under data processing agreements that comply with Article 28 GDPR. We do not sell your personal data. Our main sub-processors are listed below; a full, up-to-date list is available on request.

5. International data transfers

BlancVPN's VPN service is delivered through a network of servers operated by third-party hosting providers located in numerous countries worldwide. Where those providers are located outside the European Economic Area, the transfer of personal data to them constitutes an international transfer within the meaning of Article 44 GDPR and requires an appropriate safeguard under Chapter V.

For hosting providers located in countries that benefit from a European Commission adequacy decision — currently including the United Kingdom, Switzerland, Israel, Japan, South Korea, Canada (commercial organisations), Argentina, and Brazil — we rely on that adequacy decision as the transfer mechanism.

For hosting providers located in countries without an adequacy decision, we rely on appropriate safeguards recognised under Chapter V GDPR, which currently consist of the provider's participation in the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses (SCCs), together with a transfer impact assessment where required and, where necessary, additional technical measures. We have executed, or are in the process of executing, data processing agreements incorporating the applicable SCCs with each relevant hosting provider.

6. VPN server network

To provide the Service, BlancVPN uses third-party hosting providers to operate VPN servers in numerous countries. The current list of server locations — including which of them are virtual locations — is maintained on our website rather than in this Policy, so that changes to the network do not require a Policy update.

The personal data processed on VPN servers operated by our hosting providers is limited to the session data strictly necessary to authenticate you and route your encrypted connection: a pseudonymous user identifier and the connection metadata required by the VPN protocol to function. This data is not linked to your browsing history or to the content of your traffic, and it is retained on the server only for the duration of your session.

The content of your VPN traffic is encrypted between your device and the VPN server. The hosting provider (and, in some countries, local authorities) can see the IP address you connect from, but not the content or destinations of your traffic. Traffic leaving the server is mixed with that of other users and cannot by itself be linked to you.

Where servers are located in jurisdictions that we assess as presenting elevated risks, we may apply one or more of the following measures:

• multi-hop routing — your connection is routed through more than one server, so that no single hosting provider holds both the source of a connection and its destination;

• in-app warnings — before you connect to such a location, we inform you that the connection may be subject to that country's interception or deep packet inspection systems, so that you can decide whether to proceed.

These measures, and their limits, form part of our transfer impact assessment for those jurisdictions. 

7. How long we keep your data

These periods are based on our assessment of (i) the time needed to resolve billing, support, or legal disputes after a subscription ends, (ii) statutory limitation periods under Estonian law, and (iii) the principle of storage limitation under Article 5(1)(e) GDPR. We will delete or anonymise personal data once it is no longer necessary for these purposes.

8. Children and age requirement

BlancVPN is intended for use by individuals who are at least 18 years old, as set out in our Terms of Use. We do not knowingly collect personal data from individuals under 18, and the Service is not directed at minors.

9. Automated decision-making

We do not currently use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR.

We use an automated system to help detect fair use policy violations (as described in our Terms of Use).

We monitor external sources for signs that the login credentials of your account have been exposed, for example, in a data breach affecting another company, a published credential dump, or a marketplace where such data is traded.

We do this to protect your account from being taken over by someone else, to protect other users from the effects of a compromised account, and to protect the security and capacity of our network. 

We do not use either system to look at, analyse, or record the websites or services you access through BlancVPN or the content of your traffic.

If either system flags your account, we may restrict access to it and will tell you why. You can ask for the restriction to be reviewed by a member of our team by contacting support@blancvpn.com, and you can explain your point of view as part of that review.

If the review finds that the restriction decision should not have been made, we will restore your access immediately and extend your subscription by the period lost due to the restriction. 

10. Your rights

Subject to the conditions and exceptions set out in the GDPR, you have the right to:

• Access the personal data we hold about you 

• Request rectification of inaccurate or incomplete data 

• Request erasure of your data 

• Request restriction of processing 

• Receive your data in a portable format, where processing is based on consent or contract and carried out by automated means 

• Object to processing based on our legitimate interests 

• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal 

• Lodge a complaint with a supervisory authority — in Estonia, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), or the supervisory authority in your country of residence.

To exercise these rights, contact us at support@blancvpn.com. To protect your account, we verify your identity by sending a verification code to the email address associated with your account before acting on a request. We will respond within one month of receiving a verifiable request, extendable by two further months for complex requests, as permitted under Article 12(3) GDPR.

11. Data security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including encryption of data in transit, access controls, and minimisation of the data we collect in the first place through our no-logs architecture. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We maintain internal procedures to detect, assess, and, where required, report personal data breaches to the Estonian Data Protection Inspectorate within 72 hours and to affected users without undue delay, in accordance with Articles 33 and 34 GDPR.

12. Language

This Policy was originally drafted in English. We may provide translations into other languages for your convenience. However, in the event of any conflict or discrepancy between the English version and a translated version, the English version shall prevail and be considered the authoritative and binding agreement between you and BlancVPN.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the revised Policy on our website and update the “Last Updated” date. Where changes are material, we will notify you by email, consistent with Section 1 of our Terms of Use.

13. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

YADDA OÜ

Pärnu maakond, Häädemeeste vald, Võiste alevik, Ranna tn 6, 86501

Email: support@blancvpn.com

Last Updated: 23 September, 2026