Introduction
Norex VPN ("Norex," "we," "our," or "us") is a virtual private network service operated by Akaco Technical Solutions LLC, a limited liability company organized under the laws of the United States. This Privacy Policy describes how we collect, use, store, and protect information relating to users ("you") of our website at norexvpn.com and our VPN service (collectively, the "Service").
By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with its terms, please discontinue use of the Service.
We are committed to data minimization. We collect only what is necessary to operate the Service, and we do not log, monitor, or store your online activity.
Information We Collect
2.1 Account Information
When you create an account, we collect:
- Full name
- Email address
- Password (stored as a salted hash, never in plaintext)
ZeroID accounts, which sign in with an access key instead, provide none of these. We store only a one-way hash of your access key.
2.2 Billing Information
Payments are processed by Stripe, Inc. We do not receive or store your full payment card number, CVV, or bank account details. We retain only non-sensitive billing metadata such as the last four digits of your card, card brand, and transaction identifiers necessary to manage your subscription.
Payment Method Verification. When you activate a free trial, we perform a temporary $1.00 authorization hold on your payment method to verify that it is valid and active. This is not a charge; no funds are collected. The hold is released immediately upon verification and will disappear from your statement within 2–7 business days depending on your bank or card issuer.
Payment Method Fingerprinting. To enforce our one-trial-per-person policy and prevent fraudulent use of the Service, we store a tokenized fingerprint of your payment method provided by Stripe. This fingerprint cannot be used to reconstruct your card number and is used solely to detect and prevent duplicate trial registrations. We do not store full card numbers or CVCs.
2.3 Service and Technical Data
To provision and maintain your dedicated VPN server, we store your subscription tier and status, server assignment and configuration data, and account creation and renewal timestamps.
We do not collect or retain:
- VPN connection logs
- Browsing history or DNS query logs
- Source or destination IP addresses during VPN use
- Traffic content, volume, or metadata
- Session duration or timestamps of individual VPN connections
Your server keeps a running daily total of DNS queries and blocked domains, shown on your dashboard. It is a count only: no list of domains, times or devices.
2.4 Communications
If you contact our support team, we retain the contents of that correspondence to resolve your inquiry and improve our service. This includes emails and messages sent through the live chat on our website.
2.5 Website Data
Our website uses a session cookie to keep you signed in, plus short-lived security cookies that protect the sign-in forms. The analytics and advertising-measurement tools below may set their own cookies.
We use third-party analytics and advertising-measurement scripts on our website: Google Analytics, the Reddit Pixel and the Meta Pixel. They measure visits to our website and the results of our ads. We also advertise on Google, and Google Analytics may share this measurement data with Google Ads so we can see how our ads perform. They do not run on your VPN server and cannot see your VPN traffic.
Our pages also load fonts from Google Fonts, an optional translation tool from Google Translate, Cloudflare Turnstile to stop automated sign-ups, and on some pages a Trustpilot reviews widget. As with any website, these services receive your IP address and browser details when the page loads.
When you sign in, sign up or reset a password, your IP address is used to limit repeated attempts. These rate-limit records are deleted within about two hours and are not stored with your account. We do not record your IP address when you create an account.
No-Logging Policy
Norex VPN operates under a strict no-logging policy with respect to VPN activity. We do not log, monitor, record, or retain:
- The websites, services, or IP addresses you access while connected to Norex VPN
- DNS queries made through your VPN connection
- The contents of your internet traffic
- Connection timestamps or session durations tied to your account
- Your originating IP address during VPN use
The only data we retain is what is described in Section 2: account, billing, and configuration data necessary to provide the Service. Your internet activity while connected to Norex VPN remains private.
How We Use Your Information
We use the information we collect solely to:
- Create and manage your account
- Provision and operate your dedicated VPN server
- Process subscription payments and handle billing inquiries
- Send transactional emails (e.g., account confirmation, payment receipts, renewal notices)
- Detect and prevent fraudulent activity, abuse of trial offers, and violations of our Terms of Service
- Respond to customer support inquiries
- Comply with applicable legal obligations
We never sell your data, and we never use your account or VPN data for advertising or profiling. Website visit data collected by the tools in Section 2.5 is used only to measure our website and our ads.
Data Sharing and Third Parties
We do not sell, rent, or trade your personal data. We share limited data only with the following third-party service providers, solely to the extent necessary to operate the Service:
- Stripe, Inc.: Payment processing. Stripe processes your payment information under their own privacy policy, available at stripe.com/privacy. Stripe is certified as a PCI DSS Level 1 Service Provider.
- Solana blockchain (cryptocurrency payments): If you choose to pay with SOL via Solana Pay, your payment is settled on the public Solana blockchain. Blockchain transactions are public and permanent by nature. We do not collect your name or card details for cryptocurrency payments. We keep the payment's on-chain transaction record, which identifies the sending wallet, with your order so we can confirm the payment and match it to your server. To verify and price these payments we use Helius (a Solana RPC provider) to read on-chain transaction data and CoinGecko to obtain SOL/USD exchange rates. We do not share your account details with these providers.
- Akamai Technologies (Linode): Cloud infrastructure. Your dedicated VPN server is hosted on Akamai Cloud infrastructure.
- ZeptoMail by Zoho: Transactional email delivery. Only your email address and the content of the transactional message are transmitted to this service.
- Google Analytics: We do use Google Analytics to monitor traffic to the site.
- Reddit Pixel: We do use Reddit Pixel to monitor traffic to the site.
- Meta Pixel: We use the Meta (Facebook) Pixel to measure visits to the site and the results of our ads.
- Google Ads: Measures how our Google ads perform, using data from Google Analytics.
- Trustpilot: Hosts our customer reviews and shows a reviews widget on some pages. Some of our service emails are copied to Trustpilot so it can invite you to leave a review, which shares your name and email address with Trustpilot under its own privacy policy.
- Google: Optional "Sign in with Google", fonts, and the website translation tool.
- Cloudflare Turnstile: Protects our sign-up and password reset forms from automated abuse.
No other third parties have access to your personal data. We never sell or share your data with data brokers.
Legal Requests and Law Enforcement
Norex VPN is operated in the United States and is subject to United States law, including lawful legal process such as court orders, subpoenas, and national security requests.
In the event we receive a legally binding request for user data, we will produce only the account and billing information described in Section 2. We will not produce VPN activity data, because we do not possess it. We will notify affected users of such requests where we are legally permitted to do so, and we will evaluate all requests for legal validity before complying.
Because we do not log VPN traffic, DNS queries, or connection activity, we are technically unable to produce such records even if compelled to do so.
Data Retention
We retain your personal data for the following periods:
- Account data (name, email, configuration): retained for the duration of your active account, and deleted within 30 days of account closure upon request
- Billing records: retained for up to 7 years as required by applicable tax and financial regulations
- Support correspondence: retained for up to 2 years after the resolution of your inquiry
- Trial and fraud-prevention data (your payment method fingerprint and the email address used for a free trial): retained after account closure for as long as needed to enforce the one-free-trial-per-person rule
You may request deletion of your account at any time. Upon verified request, we will delete all personal data not subject to legal retention requirements within 30 days.
Security
We take reasonable and appropriate technical and organizational measures to protect your personal data, including:
- Passwords hashed using PBKDF2-SHA256 with 600,000 iterations
- All data transmitted over HTTPS using TLS 1.2 or higher
- Session tokens cryptographically signed and validated server-side
- Access to production systems restricted to authorized personnel only
- Regular review of security practices and third-party integrations
In the event of a data breach that affects your personal data, we will notify you and applicable regulatory authorities as required by law.
Your Rights
You may have the following rights with respect to your personal data:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate or incomplete data
- Deletion: Request deletion of your account and associated personal data
- Portability: Request an export of your personal data in a machine-readable format
- Objection: Object to certain processing activities
- Withdrawal of consent: Where processing is based on consent, withdraw that consent at any time
To exercise any of these rights, log in and visit Account Settings, or contact us at the email address in Section 12. We will respond to verified requests within 30 days.
Children's Privacy
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and notify you by email where appropriate. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.
Contact
For privacy-related inquiries, data requests, or concerns, contact us at support@norexvpn.com. We aim to respond to all privacy inquiries within 5 business days.
Akaco Technical Solutions LLC
norexvpn.com