Privacy Policy

The controller of your personal data is EVRIUS s.r.o., Kaprova 42/14, 110 00 Praha 1 – Staré Město, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague.

• Email: contact@evrius.com
• Phone: +420 608 871 136
• Post: EVRIUS s.r.o., Kaprova 42/14, 110 00 Praha 1 – Staré Město, Czech Republic

We are not required to appoint a data protection officer under Article 37 GDPR and have not appointed one. Please send any question or request about your personal data to contact@evrius.com, with "Privacy" in the subject line. Requests are handled by the person in charge of data protection at EVRIUS s.r.o.

A VPN carries all of your internet traffic, so we want to be clear about what we never record. When you are connected to the Service, we do not collect, log or store:

• the websites, services or IP addresses you visit or connect to;
• your DNS requests;
• the content of your traffic, including messages, files, searches and downloads;
• the IP address you connect from, together with your VPN activity. Our VPN servers have to use that IP address to send traffic back to you, but they hold it only in memory, only while your connection is active, and do not write it to any log;
• hardware identifiers such as serial numbers, MAC addresses or IMEI, or advertising identifiers.

As a result, we cannot connect a particular online activity to you or your account, and we cannot hand such information to anyone, because we do not hold it.

The table below lists every category of personal data we process, what it consists of, and where it comes from. Section 4 explains why we process it.

We do not ask for, and ask you not to send us, special categories of personal data, such as data concerning health, religious beliefs or political opinions.

Where we rely on legitimate interests, we have weighed them against your rights and kept the data to what those interests need. You may object at any time (section 14).

You do not have to give us any personal data. Without an email address, however, you cannot create an account or buy a subscription. Without the device and VPN access data described above, the App cannot connect you to the VPN.

You can use the App without registering. On the first launch, the App creates an anonymous session. If you later create an account, that session becomes your account and keeps its user ID, so a subscription bought on this device stays with you.

Your account uses your email address and a password. Passwords are stored only as salted hashes by our authentication provider, and our staff cannot see them. When you ask to reset your password, we email you a single-use link to a page on the Website. To prevent anyone from finding out who has an account, the Website and App show the same answer whether or not the email address is registered.

The App can open your account page at https://lock-wheel-vpn.com/account already signed in. After a purchase on the Website, it can also sign you in on a newly installed App using a one-time sign-in link. These links are for your use only, so please do not share them.

If you sign out, the App deletes your session from the device and starts a new anonymous session.

Subscriptions are sold through a web checkout on the Website. EVRIUS s.r.o. is the seller and merchant of record. Payments are processed by our payment service provider, which acts on our behalf and keeps your payment details under its own security standards (such as PCI DSS). Your subscription status is kept up to date by our subscription management provider, which tells our servers when a subscription starts, renews, enters a grace period, is cancelled or expires.

During checkout, you choose the email address and password for your account. Our servers use them to create your account automatically and then delete them. If checkout is not completed, they are deleted within 24 hours at the latest. After your account has been created, your password exists only in hashed form.

We send only the following emails. All of them relate to your account or subscription:

• Password reset: only when you ask for it.
• Registration reminder: if your account was created through a Website purchase and nobody has tried to sign in to it 15 minutes later, we send one email explaining how to sign in to the App.
• Sign-in help: if a sign-in attempt to an account that has never been used fails, we send one email about 15 minutes later explaining how to sign in or reset the password. This happens at most once per account.
• Billing issue: if a renewal payment fails and your subscription enters a grace period, we tell you so you can update your payment method. We send this at most once every three days while the problem lasts.

We do not send marketing emails. If we ever want to, we will ask for your consent first where the law requires it, and every such email will contain an unsubscribe link. To stop the registration and sign-in help emails, write to contact@evrius.com.

A subscription can be used on up to 5 devices at the same time. To enforce this, the App sends the device data described in section 3 when you sign in and when it starts. If signing in on a new device takes your account over the limit, our servers automatically sign out the device that has been used least recently. That device is then shown a "Device Limit Reached" message, which may be delivered as a push notification. You can sign in again on that device at any time, and another device will be signed out instead.

This is an automated step, but it has no legal or similarly significant effect on you within the meaning of Article 22 GDPR. It changes only which of your devices are currently signed in.

With your consent, we measure how the App and Website are used, so that we can see which features work, where people get stuck and what fails. We use the analytics service listed in section 11, and we have configured it as follows:

• Advertising storage, advertising user data and ad personalisation are denied, and we do not link analytics to any advertising product.
• Events never contain your email address, passwords, free text you type, or the addresses you visit through the VPN.
• On Windows and Linux, the App generates a random analytics identifier of its own. It is not the same as the device ID used for the device limit.
• Analytics data is kept for 14 months and then deleted automatically.

In the App, you give consent on the first-launch screen. On the Website, you give it through the cookie banner. You can withdraw consent at any time with effect for the future: on the Website through "Cookie settings" at the bottom of every page, and for the App by writing to contact@evrius.com. Withdrawing consent does not affect processing that took place before.

To help with troubleshooting, the App keeps a diagnostic log on your device. It is limited to a few megabytes, and the oldest entries are overwritten. Before anything is written to the log, the App masks email addresses, tokens, passwords, cryptographic keys, IP addresses and your user name in file paths. The log never contains the websites you visit or your traffic.

The log never leaves your device automatically. It reaches us only if you choose Settings > About > Share logs and send the files through a channel of your choice, such as email. On Linux, the files are copied to your Downloads folder for you to send. We use logs you share only to investigate the issue you reported.

The Website stores small pieces of information in your browser, as cookies or in the browser's local storage. Some of them are strictly necessary for the Website to work and do not need your consent. Analytics storage is used only if you accept it.

You can change your choice at any time through "Cookie settings" at the bottom of every page, or delete stored data in your browser settings. Declining analytics does not affect how the Website works.

The App does not use cookies. It keeps your session, device ID, settings and VPN keys in your device's secure storage, or in a protected file on Linux systems without a running keyring service.

We do not sell or rent personal data, and we do not share it for advertising. We share it only with the following service providers, which process it on our behalf as processors under data processing agreements, and only as far as each one needs it to provide its service to us:

On request, we will give you the names and contact details of the providers described above by category. Write to contact@evrius.com.

We may also disclose personal data:

• to courts, police or other public authorities, where Czech or EU law requires it and the request is lawful. Because we do not keep activity logs, we have no data about what you did online to disclose;
• to our professional advisers, such as lawyers, auditors and tax advisers, who are bound by confidentiality;
• to a buyer or successor if all or part of our business is sold or reorganised. They will remain bound by this Privacy Policy, and we will inform you in advance.

Some of our providers process data outside the European Economic Area, in particular in the United States. Where the European Commission has not decided that a country provides adequate protection, we transfer data only with appropriate safeguards under Chapter V GDPR:

• for recipients certified under the EU-U.S. Data Privacy Framework, the Commission's adequacy decision of 10 July 2023;
• otherwise, the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), together with additional measures where needed, such as encryption in transit and at rest.

You can ask us for a copy of the relevant safeguards at contact@evrius.com.

When you connect to a VPN server in a country outside the EEA, your traffic is routed through that country at your request. We do not log it there either.

We keep personal data only as long as we need it for the purposes in section 4, and then delete or anonymise it:

We may keep specific data for longer where it is needed to establish, exercise or defend a legal claim, and only for that time.

Under the GDPR, you have the right to:

• access your personal data and receive a copy (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased, including deleting your account (Article 17);
• restrict processing (Article 18);
• receive data you gave us in a structured, machine-readable format, or have it transmitted to another controller (Article 20);
• object to processing based on our legitimate interests (Article 21). We will then stop, unless we have compelling legitimate grounds or need the data for legal claims;
• withdraw your consent at any time, without affecting processing before the withdrawal (Article 7(3)).

You can delete your account yourself at any time on the Website, under My account → Delete account. To use any of the other rights, or if you prefer, write to contact@evrius.com from the email address registered to your account. We may ask for further information only where we need it to confirm your identity. We answer within one month. In complex cases this may be extended by up to two further months, and if so we will tell you why. Exercising your rights is free of charge.

Because we do not keep activity logs, and because some data, such as the device ID or analytics identifier, cannot be linked to you without an account, we may be unable to find data that relates to you. In that case, we will explain why.

When we delete your account, we also stop any future renewals of a subscription bought on the Website. A subscription bought through an app store has to be cancelled in that store, as described in our Terms of Use.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work or where an alleged infringement took place. Our lead supervisory authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.gov.cz. We would appreciate the chance to deal with your concern first.

We use technical and organisational measures appropriate to the risk, including:

• encryption of all traffic between the App, the Website and our servers (TLS), and of VPN traffic with the WireGuard protocol;
• cryptographic keys generated on your device and kept in the operating system's protected storage, with private keys never sent to us;
• database rules that let you read only your own account and devices, while all other records can be accessed only by our servers;
• signed and verified requests to our VPN access service, and integrity checks of the App and Website to block automated abuse;
• automatic deletion of temporary data, such as checkout credentials, after short, fixed periods;
• access to personal data limited to staff and processors who need it, all bound by confidentiality.

No system is completely secure. If a personal data breach is likely to put your rights and freedoms at high risk, we will tell you without undue delay, as Article 34 GDPR requires. Please use a strong, unique password for your account.

The Service is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child under 16 has given us personal data, contact us at contact@evrius.com and we will delete it.

We will update this Privacy Policy when the Service or the law changes. The date at the top shows when it last changed. We will tell you about material changes in advance, by email if you have an account or by a notice in the App or on the Website. Where a change requires your consent, we will ask for it.

EVRIUS s.r.o., Kaprova 42/14, 110 00 Praha 1 – Staré Město, Czech Republic. Email: contact@evrius.com. Phone: +420 608 871 136.