Legal

Privacy policy

We count bytes and do not record the pages you request. The full policy follows.

Last updated: 8 October 2026

This policy explains what Avocado Proxies collects when you visit this site, create an account or route traffic through our gateway, why we collect it, and what you can ask us to do with it.

1. Who is responsible

Avocado Proxies is the controller for the personal data described here. For any privacy question or request, write to support@avocadoproxies.com.

2. What we collect

Account data. Your email address and a hash of your password. We never store your password itself.
Session data. A session record so you stay signed in, with the time it was created, its expiry, and the address and browser that created it, for security purposes.
Top-up and payment metadata. Which product you topped up, when, for how much, a payment reference, and, if you used one, the discount code and what it took off. That is what your billing history and any receipt or invoice we issue are built from. Card details are handled by our payment processor and never reach our servers.
Auto top-up settings and card references. If you switch auto top-up on: the product, the balance level that triggers it, how much to buy, and when it last ran. Once you tick “save this card for auto top-up” at checkout, also two references our payment processor gives us: one for you as a customer of theirs and one for the card. Those are opaque identifiers, not card data: they carry no card number, expiry date or cardholder name, and not even the last four digits. They let us charge that card for the amount you chose and nothing else. Remove the card on your billing page and we delete both and tell the processor to forget it.
Usage counters. Bytes in and out and a request count per proxy user, aggregated per hour, plus the country you asked for. That is what your dashboard and the draw-down of your balance are built from.
Destination counters. Per proxy user: the destination host, the UTC minute, bytes in and out, a request count, and two timing counters, transfer time and time to first byte. That is what powers the live, per-destination view in your dashboard, so you can see where your gigabytes go and how quickly each destination answered. We never record a path, query string, header or body alongside it. No other customer can see them, and we read them ourselves only in aggregate, grouped by destination, with no account attached.
Support correspondence. What you send us when you contact support, so we can answer and keep context for later.

3. What we deliberately do not collect

We do not store the path or query string of the pages you request, the contents of your requests or responses, your request headers, or anything derived from them. Those bytes pass through and are not written to our database.

This site runs no analytics, advertising pixels, session recording or third-party scripts. Fonts are served from our own domain. Nothing on these pages reports your visit to anyone else.

4. Why we process it, and on what basis

To provide the service: performance of our contract with you, which covers authentication, routing, metering and billing.
To keep the service safe: our legitimate interest in preventing abuse, fraud and attacks on our network.
To meet legal obligations: accounting and tax records, and responses to lawful requests.
To communicate: service notices you cannot opt out of while you hold an account, and anything else only if you asked for it.

5. Cookies

We set one cookie, and only after you sign in: a session cookie that keeps you authenticated. It is restricted to our own domain, marked so that scripts cannot read it, and sent only over a secure connection in production. There are no advertising or analytics cookies on this site, which is why you are not being asked to dismiss a consent banner.

6. Who else sees your data

We do not sell personal data and we do not share it for anyone else's marketing. We use a small number of infrastructure partners under data-processing agreements, for hosting, payment processing and email delivery. They may process data strictly on our instructions and only as far as their function requires. We may also disclose data where the law compels us to, and we will tell you when we are permitted to do so.

7. International transfers

Where data is processed outside your region, we rely on appropriate safeguards such as standard contractual clauses, together with technical measures including encryption in transit and at rest.

8. How long we keep it

Account data: while your account exists, then deleted or anonymised.
Sessions: deleted when you sign out, and once they have expired.
Usage counters: we delete usage counters older than 24 months. Until then they stay available so you can review historical consumption. Closing your account deletes them straight away.
Destination counters: we delete these after 30 days. They exist for the live view, so they are not kept as a historical record. Closing your account deletes them straight away.
Invoices and payment records: as long as accounting and tax law requires. These are the one thing that outlives a closed account: we keep the amount, the date and the payment reference, and remove the link to you.
Auto top-up settings and card references: until you remove the card or close your account, whichever comes first. Removing the card deletes both references straight away and tells our payment processor to forget the card; closing your account deletes the settings with it. Unlike the payment records above, none of this survives a closed account. It exists to make a future charge possible, and there will not be one.
Support messages: we delete correspondence more than 24 months after the conversation ends.

9. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and complain to a supervisory authority. Write to us and we will respond within the statutory period, and usually sooner.

10. Security

Passwords are stored using a modern, deliberately slow hashing algorithm. Sensitive values are encrypted at rest. Access to production systems is limited to the people who need it and is logged. No system is perfect, so if you believe you have found a vulnerability, please tell us at the address below before telling anyone else.

11. Changes

If this policy changes materially we will update the date at the top and, where the change affects you, tell you by email or in your dashboard.

Contact: support@avocadoproxies.com