NADI VPN

NADI VPN

Strict No-Traffic-Logs Architecture

Privacy Policy

Last updated: 30 October 2026Data Controller: Nadicorp Ltd (England & Wales, UK · nadicorp.net)

01.Who Controls Your Data

The data controller for NADI VPN (the “Service”) is Nadicorp Ltd (England & Wales, UK, nadicorp.net, contact: [email protected]).

“Personal data” in this policy means information that identifies you, or that can reasonably be used to identify you, either on its own or together with other information we hold. This policy explains what we retain, what we do not log, why we process it, how long we keep it, and what rights you have under applicable data protection laws including the General Data Protection Regulation (GDPR).

02.What We Retain — and Only This

We retain strictly the following minimal operational data:

  • Your email address: Used exclusively for passwordless one-time-password (OTP) login to authenticate your session.
  • Your WireGuard public key: Submitted client-side via your browser to authorize your tunnel interface. Your private key is generated locally on your device and is never sent to us.
  • Pass expiry timestamp: Used to enforce your 1, 7, 15, or 30-day access duration.
  • Cryptocurrency transaction records: Limited strictly to the blockchain transaction hash, the coin type, and the internal order ID for billing reconciliation.

We do not retain any other personal data about your use of the Service in the course of operating the relays.

03.What We Do Not Log

We do not log, monitor, or retain any of the following:

  • Browsing activity: Destination IP addresses, visited domain names, or web traffic content.
  • DNS queries: Lookups processed through our local volatile RAM Unbound resolvers.
  • Origin IP addresses: Your real home, office, or mobile ISP IP address or geolocation connected to VPN use.
  • Connection timestamps: Connection start times, disconnect times, or session durations.
  • Bandwidth tied to identity: Data volume transmitted through the tunnel.
  • P2P metadata: BitTorrent info-hashes or peer transfer logs.

Routing state exists only in volatile Linux kernel memory while a peer interface is active. The peer entry is wiped completely upon pass expiry or key regeneration. That routing state is never written to disk, swap, or external log stores. Because these items are never recorded, they cannot be retrieved, searched, or disclosed later, even in response to a court order or subpoena.

04.Purpose and Legal Basis for Processing

  • Email for OTP login: To provide account access and authenticate your session without passwords. Legal basis: Performance of contract (Art. 6(1)(b) GDPR).
  • WireGuard public key and pass expiry: To provision the cryptographic peer on our relays and terminate access when your pass expires. Legal basis: Performance of contract (Art. 6(1)(b) GDPR).
  • Transaction hash and order ID: To verify on-chain crypto settlement and maintain statutory commercial accounting records. Legal basis: Performance of contract and legal accounting obligation (Art. 6(1)(c) GDPR).

We never process retained data for advertising, profiling, behavioral tracking, or data brokering. We do not sell personal data under any circumstances.

05.Data Retention Schedule

Retained operational data is kept strictly for the minimum necessary duration:

  • Active session credentials: Email and active public keys are kept only while your account and passes are active. You can terminate your account and erase these records permanently at any time from your dashboard profile.
  • Relay peer routing entries: Removed automatically from kernel memory upon pass expiration or client key rotation.
  • Cryptocurrency payment records: Retained for statutory corporate tax and financial accounting compliance periods required by law, after which they are purged.

06.Third-Party Sub-Processors

We work with carefully selected infrastructure providers to deliver the Service:

  • Cloudflare, Inc. (USA / Global): Edge CDN caching, reverse proxy routing, DDoS mitigation, and optional secondary DNS resolver (1.1.1.1). Default relay DNS remains local Unbound in RAM.
  • NOWPayments: Non-custodial cryptocurrency payment gateway for generating payment deposit addresses and broadcasting on-chain confirmation webhooks.
  • Resend, Inc.: Transactional email infrastructure for delivering one-time OTP login codes.

07.Cookies and Local Storage

Zero Tracking Cookies: NADI VPN does not use any advertising cookies, marketing cookies, third-party analytics pixels, or fingerprinting scripts.

Our web dashboard uses strictly essential browser localStorage solely to hold your cryptographic session token, user ID, and selected relay preference across browser tabs. No persistent tracking beacons are ever set.

08.Your GDPR & Privacy Rights

Under the General Data Protection Regulation (GDPR) and equivalent privacy legislation, you have the right to access, rectify, restrict, or erase your retained personal data, as well as the right to data portability and the right to lodge a complaint with an EU/UK supervisory authority.

To exercise any of these rights, contact [email protected] or delete your account credentials instantly within your dashboard profile. Requests for data we do not collect (such as browsing logs, traffic histories, or IP timestamps) cannot be fulfilled because that data does not exist.

09.Security Standards

We implement robust technical and cryptographic controls to protect retained operational data: WireGuard private keys remain exclusively on your device, relay nodes run volatile Linux kernel WireGuard interfaces with hardened sysctl configurations, and administrative databases enforce strict access authentication and token hashing.

10.Changes to This Policy

Material changes will be published on this page with an updated timestamp. If any proposed change would introduce logging of traffic, origin IPs, or destination data, users will be notified in advance before such changes could take effect.