This Privacy Policy explains how bigwigVPN handles personal data when you use our website, VPN service, bot, or mobile application. Firebase diagnostics described below apply only to app versions that include those SDKs.
Controller and contact
The controller of personal data is LMA Solutions LTD (UIC/Registration No.: 208783874). For privacy questions or to exercise your data-protection rights, contact us at [email protected].
Company address: Odrin, 15 str. Burgas, 8000 Bulgaria
Zero-Logs VPN Service and App Data
We strictly adhere to a zero-logs policy for our VPN service. When you connect to our VPN servers, we do not collect, store, or retain your browsing activity, traffic content, DNS queries, connection logs, or source IP addresses. Technical connection data is processed transiently by network equipment solely to deliver the requested connection and is never retained.
However, to provide the application functionality and manage premium subscriptions, the bigwigVPN application processes strictly necessary technical and pseudonymous data. This includes an Apphud-generated pseudonymous user UUID, an appAccountToken, and purchase receipt tokens (purchase_token). The UUID can be linked to your subscription and is therefore personal data, but it is not linked to your VPN traffic. We do not use your payment-card details.
Payments and Sub-processors
Payments are processed securely by Apple App Store or Google Play, depending on your platform. We do not receive or store payment-card details. Their processing of payment information is governed by the Apple Privacy Policy and the Google Privacy Policy.
To validate these purchases, manage subscription statuses, and grant access to premium features, we use a third-party service provider, Apphud. We share subscription identifiers and purchase information with Apphud for purchase validation, subscription management, and billing analytics. Apphud may also process technical information needed to operate its SDK, such as device and app details and IP address. See Apphud's Privacy Policy for its current practices.
Firebase app diagnostics and analytics
In app versions that include Firebase, we use only Google Analytics for Firebase and Firebase Crashlytics. Collection is disabled by default. Accepting the Terms of Use and acknowledging this Privacy Policy does not enable either service. On a new installation, after the onboarding paywall, one optional dialog asks whether to allow both usage analytics and crash reports. Allow enables both services; Decline leaves both disabled. The app remains usable either way. You can later change each service independently in Settings; existing choices are retained when updating the app. When a service is enabled, it uses the pseudonymous Apphud UUID as its user identifier. The SDK may be initialized to apply a previous opt-out; initialization alone does not mean that Analytics or Crashlytics collection has been enabled.
Crashlytics processes crash reports and stack traces, timestamps, app and OS versions, device characteristics, and Firebase installation and crash identifiers to diagnose app failures. Analytics processes its standard automatically collected app events and only two custom events: onboarding_completed and paywall_opened. The custom events have no parameters. We do not deliberately send VPN browsing activity, traffic content, DNS queries, connection logs, VPN server addresses, purchase tokens, payment-card details, or support messages to Firebase. We disable advertising-ID collection and ad-personalization signals in our app configuration. Google may process other technical data inherent to these SDKs; see Firebase Privacy and Security.
The website page itself does not load third-party analytics or advertising scripts. Firebase Analytics applies to the mobile application, not this page.
How we use information you send to us
If you contact us by email, we process the email address and the information in your message only to respond to your request or provide support. We keep correspondence only for as long as necessary to resolve the request, unless a longer period is required by law.
Legal bases
Where the GDPR applies, subscription and service processing is necessary to perform the contract (Article 6(1)(b)); legally required records are processed to comply with legal obligations (Article 6(1)(c)); support operations, prevention of abuse, and maintenance of network security rely on our legitimate interests (Article 6(1)(f)), namely ensuring the ongoing stability, integrity, and security of our VPN infrastructure and providing responsive user support, balanced against your rights. Firebase usage analytics and Firebase crash reporting rely on your optional consent (Article 6(1)(a)): the first prompt covers both, and Settings lets you control them independently afterward. You can withdraw either consent in the app Settings without losing access to the service. Withdrawal does not retroactively remove data already received by Google; contact us to request access to or deletion of provider-held data.
Sharing and international transfers
We do not sell personal data or disclose it for advertising. Payment information is independently processed by Apple or Google, depending on your device platform, as described in their respective privacy documentation.
For subscriptions, data is shared with Apphud as described above. For app diagnostics and analytics, the pseudonymous Apphud UUID and SDK-generated diagnostic and usage data are processed by Google Firebase. Some of our service providers (including Google LLC and Apphud Inc.) are located outside the European Economic Area (EEA), primarily in the United States. Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place in accordance with Chapter V of the GDPR:
- For transfers to Google LLC, we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (DPF), under which Google is certified, and/or European Commission-approved Standard Contractual Clauses (SCCs).
- For transfers to Apphud Inc., data processing is governed by a Data Processing Agreement incorporating the European Commission's Standard Contractual Clauses (SCCs).
Retention and deletion
We retain subscription and purchase records for the duration needed to provide the service and meet applicable accounting, tax, dispute, and fraud-prevention obligations; support correspondence is retained for the time needed to resolve your request and any applicable legal obligation. Firebase states that Crashlytics retains crash traces and associated identifiers for 90 days before starting removal from live and backup systems. User-level and event-level data in Google Analytics for Firebase is retained for 2 months from collection, after which it is automatically deleted in accordance with our Google Analytics retention settings. We periodically review retention when processing purposes conclude.
"Delete My Data" in the app clears local app data and both Firebase choices, ends the local Apphud session, turns off Analytics collection, and requests Crashlytics reporting to stop by the next app launch. The app requests deletion of unsent local Crashlytics reports; a report already sent cannot be recalled by the switch. The action opens a prefilled email request; you must send that email for us to process deletion of records held by us or our providers. The in-app action alone does not delete Apphud or Firebase server records. We may need to verify your request and retain records where law requires. Please include your Apphud UUID if available, but do not send purchase tokens or VPN configuration.
Your GDPR rights
"Request My Data" in the app displays a locally assembled report with your Apphud UUID and available subscription information that you can copy. It does not retrieve data already held by Firebase. To request access to provider-held data, contact us using the address below and include your Apphud UUID.
Subject to the GDPR, you may request access, correction, erasure, restriction, portability, or object to processing. You may withdraw consent at any time where processing is based on consent, without affecting processing already carried out. To make a request, email [email protected]. We normally respond within one month, with extensions where permitted by law. You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Commission for Personal Data Protection (CPDP) in Bulgaria (web: www.cpdp.bg), or you may lodge a complaint with the data-protection authority in the EU Member State of your habitual residence or place of work.
Changes to this policy
We may update this policy when our services or legal obligations change. The current version and its effective date will always be published on this page.