Privacy Policy

Effective Date: 19 August 2026
Last Updated: 19 August 2026

FortisVPN ("FortisVPN", "we", "us", or "our") is a virtual private network service operated by EACT Technologies OÜ, a private limited company incorporated in Estonia under registry code 17570948, with its registered address at Tornimäe tn 5, Kesklinna linnaosa, Tallinn, Harju maakond, 10145, Estonia.

EACT Technologies OÜ is the data controller responsible for the personal data processed in connection with FortisVPN, except where another party acts as an independent controller, such as an application store or payment provider.

This Privacy Policy explains what information we collect, what information we do not collect, how information is used and protected, when it may be disclosed, and the privacy rights available to users of the FortisVPN applications, website, and related services (collectively, the "Services").

1. Our Privacy Commitment

FortisVPN is designed to provide a private and secure internet connection.

We do not monitor, record, store, or create logs of the content of your internet activity while you use the FortisVPN service.

In particular, FortisVPN does not keep logs identifying:

• websites you visit;
• your browsing history;
• DNS queries made through the VPN;
• the content of your internet traffic;
• communications transmitted through the VPN;
• applications, websites, or online services you access through the VPN; or
• the content or destinations of data transmitted through your VPN connection.

We do not sell VPN browsing activity or VPN traffic information.

We do not use your VPN activity to build advertising profiles or determine which advertisements you see.

The technical processing of network traffic that is inherently necessary to establish and operate a VPN connection does not mean that FortisVPN records or retains your browsing activity.

2. Information We Collect

Although FortisVPN does not maintain logs of your browsing activity through the VPN, we may process limited information necessary to provide and operate the Services.

2.1 Account Information

When you create or maintain a FortisVPN account, we may process information such as:

• email address;
• account identifier;
• account creation information;
• subscription status;
• subscription plan;
• renewal or expiration information; and
• information necessary to authenticate and administer your account.

We use this information to provide the Services, authenticate users, administer subscriptions, provide customer support, prevent abuse, and communicate important account or service information.

2.2 Payment and Subscription Information

When you purchase a FortisVPN subscription, payment may be processed by a payment provider, application store, or other authorized payment platform.

Depending on the payment method, FortisVPN may receive limited transaction information such as:

• transaction or order identifier;
• payment status;
• subscription purchased;
• amount and currency;
• purchase date;
• renewal or expiration date; and
• limited billing information provided by the payment processor.

Where payment information is processed directly by a third-party payment provider, FortisVPN does not intentionally receive or store complete payment-card numbers.

Payment providers and application stores may independently process information according to their own privacy policies and legal obligations.

2.3 Customer Support and Communications

If you contact us, we may process:

• your email address or other contact information;
• the contents of your communication;
• correspondence with our support team;
• account information relevant to your request; and
• technical information you voluntarily provide for troubleshooting.

This information is used to respond to requests, resolve problems, prevent abuse, and improve customer support.

Please do not provide passwords or unnecessary sensitive information when contacting us.

If you begin a checkout and provide your email address without completing your purchase, we may send you a limited number of reminder emails with a link to resume your checkout. You can opt out of these at any time via the unsubscribe link they contain.

2.4 Technical and Diagnostic Information

FortisVPN may process limited technical or diagnostic information where reasonably necessary to operate, secure, troubleshoot, and improve the Services.

Depending on the platform and circumstances, this may include:

• application version;
• operating system;
• device or platform type;
• error information;
• crash information;
• connection errors;
• diagnostic information; and
• information reasonably necessary to prevent fraud, abuse, or unauthorized use.

Technical and diagnostic information is not used to create a record of the websites you visit, your DNS queries, or the content of your VPN traffic.

Where reasonably possible, diagnostic information is processed in aggregated or non-identifying form.

3. VPN Traffic and Connection Processing

A VPN service must technically receive and route network packets in order to transmit them between your device and the internet.

Accordingly, when you connect to FortisVPN, our VPN infrastructure necessarily processes network traffic in real time to establish and operate your VPN connection.

This transient technical processing is necessary for the service to function.

FortisVPN does not use this technical access to create a history of your internet activity.

We do not intentionally retain logs identifying:

• websites visited;
• browsing history;
• DNS requests;
• content transmitted through the VPN;
• communications transmitted through the VPN; or
• internet destinations accessed through the VPN.

Information that FortisVPN does not collect or retain cannot subsequently be sold, analyzed, or provided by us.

4. How We Use Information

Information legitimately collected by FortisVPN may be used to:

• provide and maintain the Services;
• create and administer accounts;
• authenticate users;
• verify subscription status;
• process and verify purchases;
• provide customer support;
• diagnose technical problems;
• improve application and service reliability;
• maintain network and application security;
• detect and prevent fraud, abuse, and unauthorized use;
• enforce our Terms and Conditions;
• communicate important account, security, legal, or service information;
• comply with applicable legal obligations; and
• establish, exercise, or defend legal claims.

We do not use the content or destinations of your VPN traffic for marketing or advertising.

5. Advertising and Promotional Content

FortisVPN may display advertisements, sponsored content, offers, or promotional messages within its applications.

These advertisements are selected and controlled by EACT Technologies OÜ and may promote products or services offered by us or by third parties selected by us.

Advertisements displayed within FortisVPN are not personalized based on your VPN activity.

FortisVPN does not use:

• websites you visit;
• browsing history;
• DNS requests;
• VPN traffic content;
• internet destinations;
• communications transmitted through the VPN; or
• applications or online services accessed through the VPN

to determine which advertisements are displayed to you.

FortisVPN does not currently use third-party advertising trackers, tracking pixels, or third-party behavioral advertising SDKs within the FortisVPN application to monitor users across applications or websites for personalized advertising.

Displaying an advertisement within the FortisVPN application does not provide the advertiser with access to your VPN traffic.

If you choose to interact with an advertisement or follow a link to a third-party website or service, that third party may independently collect information according to its own privacy policy.

If our advertising practices materially change in the future, including through the introduction of personalized advertising or third-party advertising technologies that collect personal information, we will update this Privacy Policy and implement any notice, consent, or opt-out mechanisms required by applicable law.

6. Cookies and Similar Technologies

The FortisVPN website may use cookies and similar technologies for purposes such as:

• essential website functionality;
• security;
• remembering user preferences;
• account or session management; and
• other purposes described in our Cookie Policy.

Where required by applicable law, non-essential cookies will not be activated until the appropriate consent has been obtained.

Users may manage applicable cookie choices through the cookie preference controls available on our website.

For additional information, please see the FortisVPN Cookie Policy.

7. Disclosure of Personal Information

We may use trusted service providers where reasonably necessary to operate the Services.

Depending on how you interact with FortisVPN, these providers may include companies involved in:

• hosting and infrastructure;
• payment processing;
• application distribution;
• email delivery;
• customer support;
• security;
• fraud prevention; and
• technical operations.

Service providers may process information only as necessary to perform the applicable services or as otherwise permitted by applicable law and their contractual obligations.

We may also disclose information where reasonably necessary to:

• comply with applicable law;
• respond to valid and lawful requests from competent authorities;
• comply with court orders or other binding legal processes;
• investigate fraud, abuse, or security incidents;
• protect the rights, property, or safety of EACT Technologies OÜ, FortisVPN, our users, or others; or
• establish, exercise, or defend legal claims.

FortisVPN cannot provide VPN browsing histories, DNS-query histories, traffic content, or website-visit logs that we do not possess.

8. Sale and Sharing of Personal Information

FortisVPN does not sell personal information for monetary consideration.

FortisVPN does not sell VPN activity or browsing information.

FortisVPN does not share personal information for cross-context behavioral advertising as that concept is defined under applicable California privacy law.

FortisVPN does not use VPN browsing activity to create advertising profiles.

If these practices materially change, we will update this Privacy Policy and provide applicable rights, notices, and opt-out mechanisms before engaging in such practices where required by law.

9. Legal Bases for Processing — EEA, United Kingdom and Similar Jurisdictions

Where the General Data Protection Regulation ("GDPR"), UK GDPR, or another law requiring a legal basis applies, EACT Technologies OÜ processes personal data only where an appropriate legal basis exists.

Performance of a Contract

Processing may be necessary to create your account, authenticate you, administer your subscription, process service requests, and provide FortisVPN.

Legitimate Interests

We may process limited information where necessary for legitimate interests such as securing the Services, preventing fraud and abuse, troubleshooting technical problems, maintaining service reliability, providing customer support, and operating and improving our business.

Legal Obligation

We may process or retain information where necessary to comply with applicable legal, tax, accounting, regulatory, or other obligations.

Consent

Where required, we may process information based on your consent, including for certain optional cookies or other processing for which applicable law requires consent.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing performed before withdrawal.

10. International Data Transfers

FortisVPN is an international service.

Our infrastructure and service providers may operate in countries other than the country where you reside.

Accordingly, personal information may be processed or transferred internationally.

Where GDPR, UK GDPR, Swiss law, or another applicable law requires safeguards for international transfers of personal information, EACT Technologies OÜ will use legally recognized transfer mechanisms or other appropriate safeguards where required.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or where retention is required by law.

Retention periods may depend on account activity, subscription administration, transaction records, accounting and tax requirements, customer-support requirements, fraud and security considerations, disputes, limitation periods, and other legal obligations.

When information is no longer reasonably required, we may delete or anonymize it in accordance with applicable legal and operational requirements.

VPN browsing activity that FortisVPN does not collect is not subject to retention because it is not maintained by FortisVPN.

12. Information Security

We use reasonable technical and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, misuse, destruction, or loss.

FortisVPN connections are designed to encrypt network traffic between your device and the applicable VPN endpoint.

However, no internet service, transmission technology, or information-security system can guarantee absolute security.

13. Your Privacy Rights

Depending on your jurisdiction and applicable law, you may have rights concerning your personal information, including rights to:

• obtain information about how your personal data is processed;
• request access to personal information concerning you;
• request correction of inaccurate or incomplete information;
• request deletion of personal information;
• request restriction of certain processing;
• object to certain processing;
• obtain certain personal information in a portable format;
• withdraw consent where processing is based on consent;
• opt out of certain sales, sharing, or targeted advertising where applicable; and
• lodge a complaint with an applicable privacy or data-protection authority.

To exercise an applicable privacy right, contact us at support@fortisvpn.com.

We may request reasonable information necessary to verify your identity and protect your account before processing certain requests.

We will not unlawfully discriminate against you for exercising applicable privacy rights.

14. European Economic Area

If you are located in the European Economic Area ("EEA"), your personal data is protected by the GDPR and applicable national data-protection laws.

Subject to applicable conditions and exceptions, you may have rights including access, rectification, erasure, restriction, objection, portability, and withdrawal of consent.

You also have the right to lodge a complaint with the data-protection supervisory authority in your country of residence, place of work, or place of an alleged infringement.

Because EACT Technologies OÜ is established in Estonia, the competent Estonian supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

15. United Kingdom

Users in the United Kingdom may have rights under the UK GDPR and Data Protection Act 2018, including applicable rights of access, rectification, erasure, restriction, objection, portability, and withdrawal of consent.

UK users may also have the right to complain to the Information Commissioner's Office (ICO).

16. California Privacy Rights

California residents may have additional rights under the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), and other applicable California privacy laws.

Where applicable, these rights may include the right to know, access, correct, delete, opt out of sale or sharing, limit certain uses or disclosures of sensitive personal information, and exercise applicable rights without unlawful discrimination.

During the preceding 12 months, the categories of personal information we may have collected, depending on a user's interaction with FortisVPN, include identifiers, customer/account information, commercial or transaction information, internet or electronic technical information associated with operation of the Services, and communications submitted to us.

The sources of this information may include users directly, users' devices when interacting with the Services, payment providers, application stores, and service providers involved in operating FortisVPN.

FortisVPN does not sell personal information.

FortisVPN does not share personal information for cross-context behavioral advertising.

California residents may submit applicable privacy requests through support@fortisvpn.com.

17. Do Not Track and Global Privacy Control

Some browsers provide "Do Not Track" ("DNT") signals.

Because there is currently no universally accepted technical standard governing responses to all DNT signals, our website may not respond to traditional browser DNT signals in a uniform manner.

FortisVPN does not, however, use VPN activity for cross-site behavioral advertising.

Some browsers and extensions also support Global Privacy Control ("GPC") signals intended to communicate privacy preferences.

FortisVPN does not currently sell personal information or share personal information for cross-context behavioral advertising. Where applicable law requires recognition of a legally valid browser-based opt-out preference signal for processing in which we engage, we will honor such signals as required by law.

18. Other United States Privacy Rights

Residents of certain U.S. states may have additional privacy rights under applicable state privacy legislation.

Depending on the jurisdiction and whether the relevant law applies to EACT Technologies OÜ, these rights may include access, correction, deletion, portability, opting out of sale, opting out of targeted advertising, opting out of certain profiling, and appealing certain privacy-request decisions.

Requests may be submitted to support@fortisvpn.com.

19. Canada

Users in Canada may have rights under the Personal Information Protection and Electronic Documents Act ("PIPEDA") and/or applicable provincial privacy legislation.

Privacy requests may be submitted to support@fortisvpn.com.

20. Brazil

Users in Brazil may have rights under the Lei Geral de Proteção de Dados Pessoais ("LGPD"), including applicable rights of confirmation, access, correction, anonymization, blocking, deletion, portability, information concerning sharing, and withdrawal of consent.

Requests may be submitted to support@fortisvpn.com.

21. Australia

Where the Australian Privacy Act 1988 and Australian Privacy Principles apply, Australian users may have rights to request access to and correction of personal information held about them.

Privacy inquiries or complaints may be submitted to support@fortisvpn.com.

Where applicable, individuals may also have the right to raise privacy complaints with the Office of the Australian Information Commissioner (OAIC).

22. Switzerland

Where the Swiss Federal Act on Data Protection ("FADP") applies, users in Switzerland may exercise the privacy rights available to them under applicable Swiss data-protection law.

Requests concerning personal information may be submitted to support@fortisvpn.com.

23. Account and Personal Data Deletion

You may request deletion of your FortisVPN account and qualifying personal information.

Certain information may be retained where reasonably necessary to comply with legal obligations, prevent fraud or abuse, resolve disputes, enforce agreements, or establish, exercise, or defend legal claims.

Where FortisVPN provides account-deletion functionality within an application or website, users may also submit a deletion request through that functionality.

Deletion of a FortisVPN account does not necessarily cause information independently controlled by third parties, such as application stores or payment processors, to be deleted.

24. Children's Privacy

FortisVPN is not directed to children who are not legally permitted to enter into an agreement for the Services.

We do not knowingly collect personal information from children in violation of applicable law.

If we learn that personal information relating to a child has been collected in circumstances requiring parental or guardian authorization and the necessary authorization was not obtained, we will take reasonable steps to delete the information.

25. Third-Party Services and Links

FortisVPN applications and websites may contain links to independent third-party websites, services, stores, advertisements, or offers.

If you choose to interact with a third-party service, the third party may collect information independently.

EACT Technologies OÜ does not control the privacy practices of independent third parties, and this Privacy Policy does not govern information collected independently by them.

26. Business Transfers

If EACT Technologies OÜ is involved in a merger, acquisition, restructuring, financing, sale of assets, insolvency proceeding, or similar corporate transaction, information associated with FortisVPN may be transferred as part of that transaction where permitted by applicable law.

Any successor receiving personal information will remain subject to applicable privacy and data-protection obligations.

27. Changes to This Privacy Policy

We may update this Privacy Policy when our Services, technology, legal obligations, or business practices change.

When this Policy is updated, we will revise the "Last Updated" date shown above.

Where changes materially affect your privacy rights or the way we process personal information, we will provide additional notice or obtain consent where required by applicable law.

28. Contact Us