Analytics cookies

May we use Google Analytics to see which pages are read, how visitors find this site and whether visits lead to an account or a purchase? It sets cookies and sends Google details of your visit, including your IP address. Google Analytics loads only if you accept, and you can change your choice at any time under Cookie settings at the bottom of the page. Privacy notice

Portproof
CartSign in
Menu

Privacy notice and logging policy · v2 · 2026-10

Privacy and logging

Portproof is the controller for account, billing and verification data and a processor for traffic metadata processed on customers' instructions under the DPA. This notice describes what is collected, why, and for how long.

1. What we log about proxy traffic

  • subscriber to port to egress IP to time (egress_ip_assignments)
  • per-minute usage aggregates per port
  • rotation log entries and probe results
  • a per-destination-ASN five-minute aggregate kept 30 days for abuse triage

Not logged

  • payload
  • URLs
  • per-flow records

There is no "zero logs" claim. The subscriber-to-egress-IP-to-time record exists so that a lawful request can be answered and so that uptime credits and Port details can be computed.

2. Retention

90 days by default; the statutory period where the service is classified as an electronic communications service in the country of the egress SIM; 12 months for Attested customers who opt in. Retention is configured per jurisdiction of the egress SIM.

3. Account data and historical verification records

We process your email, profile and billing details, orders, payment records, account-security records and support correspondence to operate and support your account. Portproof does not require KYC or KYB documents to buy listed products. Historical business-verification submissions and decisions, where previously provided, remain part of the account history; this policy change does not erase them or mark an account as verified. You can request access or erasure using the contact below, subject to applicable retention obligations.

The payment provider handles its own payment checks under its terms and privacy notice and may request identity information separately. We do not promise that a payment or refund will proceed without those checks.

eSIM and SMS services

We store the purchased plan or number, order and operation history, installation details, reported usage, received SMS messages and communication timestamps to deliver the service and support your account. Installation details and SMS content are encrypted at rest and are available through your authenticated account. The digital network partner processes the plan, number and messages needed to provide the service. This is separate from proxy traffic: the statement that we do not log proxy payloads does not mean that SMS messages are not stored.

Digital-service history currently has no automatic expiry in your account. You may request access or erasure through the contact below; billing records and other records that must be retained by law may be kept separately. Ending access to a refunded service does not automatically delete its purchase history.

Optional personalised setup help

You can tell us your intended use, the product that interests you and whether you need help choosing, paying or setting it up. These optional choices are saved with your account. They do not change your ability to browse or buy, and you can edit them in Account settings.

If you separately choose to save browsing choices, we record selected shop, guide and checkout actions while you are signed in, only when you have also accepted analytics cookies and your browser has not enabled Global Privacy Control or Do Not Track. These records contain a fixed action and page category, the time, selected product or payment-method categories and, where relevant, a reference to your own order. They contain no free-form input, credentials, payment details or SMS content. We set no additional tracking cookie or local-storage identifier for this. Earlier aggregate visit counts are not joined to your account or reconstructed as a personal browsing history.

Separately from optional browsing, account operations such as a signup, cart update, checkout, payment state or consent change are recorded to operate and troubleshoot your account. Our customer record also holds dated support notes and distinguishes your statements, recorded events and assumptions that need checking. The shop operator and authorised support or automation agents use this record to keep their replies consistent with your account.

Personalised email requires a separate opt-in and your general marketing preference to be on. An automated system can then select relevant setup help, an existing payment reminder or an eligible limited offer from your stated needs and recorded account activity. A recorded action is not treated as proof of why you did not buy. The system limits contact frequency and the total number of follow-ups, and stops sales follow-ups when you buy, withdraw consent or your record is marked for human assistance. Buying remains your choice.

Weekly product news is a separate optional email subscription. We save your weekly-news preference and send published updates only to the email address you have confirmed. You can change this preference in Account settings or use the weekly-news unsubscribe link. This choice is separate from occasional updates and personalised follow-ups, and is not required to create an account or buy a product. Account and order messages continue when you stop optional news.

Optional browsing and personalised email rely on your consent. Turn either off in Account settings at any time; each follow-up email also includes a link to stop those personalised follow-ups and their associated marketing permission. Weekly product news has its own preference and unsubscribe link. Withdrawing permission stops future optional recording or messages. Account-linked browsing and journey events are deleted after 90 days. Underlying order, payment and service audit records, CRM notes and follow-up history are kept separately as part of your account history; the 90-day journey deletion does not erase them. You can request access, correction or erasure through the contact below, subject to applicable retention obligations.

4. Third-party data in Port details

Geolocation uses MaxMind GeoLite2 and IP2Location LITE with attribution and IPinfo. Reputation flags are derived by us from vendor lookups; raw vendor scores are not redistributed and stay internal until redistribution terms are signed.

5. Sub-processors

Our hosting provider, our transactional email provider, the network partners that supply proxy traffic and digital connectivity or SMS services, the payment processor that handles your payment and, only if you accept analytics cookies, Google (section 7). The current list with the transfer mechanism of each is sent on request. Hosting is in the EU.

6. Visits to this website

We count visits to the public pages of this website ourselves, to see which pages are read and how people find them. No third party receives this data, and the site sets no cookie and stores nothing on your device for it.

  • For each page you open we record the address of the page without its query string (links that carry a token or an order reference are recorded with a placeholder instead), the host name of the website that linked to you (for example a search engine; never the full address of that page), the three campaign tags utm_source, utm_medium and utm_campaign if the link carried them, a device class (mobile, tablet or desktop) and the hour of the visit. Campaign tags are whatever the link you followed contained: whoever made the link chose them, and we store them as sent, in lower case and cut to 80 characters.
  • Your IP address and your browser’s user-agent string are not stored in these records. To count how many different people visited on a given day, our server combines them with a random key that is created for that day (UTC) and keeps only a short code derived from them. The key is deleted after two days and is never copied into a backup; from then on the code cannot be traced back to an address or a browser, and codes from different days cannot be linked to each other. This protects the code only: the page, the referring host name and the campaign tags are kept as described above, and a link made for one person could carry a tag or host name that points to them.
  • Separately, like every request to this website, opening a page passes through our web server, whose access log records the requesting IP address, the browser’s user-agent string, the page and the time. That log is used for security and troubleshooting, is not combined with the records described here, and is overwritten as it rotates. The measurement request itself is not written to it.
  • Nothing is recorded in these aggregate visit counts when your browser sends a Global Privacy Control or Do Not Track signal, and automated clients such as search-engine crawlers are left out. These counts exclude the signed-in dashboard and the admin console. Optional account-linked setup choices are described separately in section 3.
  • These records are kept for 400 days and then deleted. Only the operator of the shop can see them, and only as totals per day, page, referring site, search engine, campaign and device class. They are not joined to your account, your orders or your proxy traffic.
  • The legal basis is our legitimate interest in understanding how the website is used and improving it.

7. Google Analytics, only with your consent

If you choose “Accept analytics” in the cookie banner, the public pages of this website also use Google Analytics, a service of Google Ireland Limited, to show us which pages are read, how visitors find them and whether visits lead to a new account or a purchase. Until you accept, nothing from Google is loaded and nothing is sent to Google. If you reject, or do not answer, the site works exactly the same.

  • Page views: for each public page you open, its address without the query string, with references to an order, a port or a token replaced by a placeholder; its title; and the website that sent you (its domain only, not the page) or, for a page of this website, that page’s cleaned address, never a page of the dashboard or the admin console.
  • With each page view Google’s tag also sends when and for how long you visit, your device type, operating system, browser, screen size and language, and a rough location (country, region, city) that Google derives from your IP address. Your browser sends Google your IP address with each request, as it does to any site it contacts; Google states that Google Analytics does not log or store it. Google’s automatic measurement of scrolling, clicks, links you follow, downloads, forms and searches is switched off.
  • Events: that an account was created (not the address or the name); that checkout was started, with the products, their quantities and prices and the total of the cart, in its currency; that the final payment step was submitted, with a general payment-method category; whether that submission returned an error, with a general error category and no error text; and that an order was paid, with its products, their quantities and prices, the order total and its currency, and a code computed from the order so that Google can recognise the same purchase if it is reported twice. The code is not the order number and Google cannot work out the order from it; we could match it to our record of the order, and we use it only to count each purchase once. No email address, name, wallet, payment detail, order number or proxy credential is ever sent to Google. The signed-in dashboard and the admin console do not load Google Analytics.
  • Cookies: Google Analytics keeps a random identifier in the cookies _ga and _ga_<id> on this website, to recognise a returning browser. They expire 13 months after they are first set; once your answer is no longer “accept” (you rejected, or it lapsed after 12 months), the next public page of this website you open deletes them. Google signals, advertising features and ad personalisation are switched off, and no advertising cookie is set. After a paid order, this browser’s local storage also keeps a code for each order already reported (pp_ga_purchases, at most 50 codes, not the order reference), so a purchase is not reported twice; it has no expiry and is deleted when you choose Reject.
  • Google Ireland Limited acts as our processor under Google’s data processing terms, with Google LLC as its sub-processor. The data may therefore be transferred to and processed in the United States by Google LLC, which is certified under the EU–US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023.
  • Google keeps the event data for 14 months, the retention period set in our Google Analytics account, and then deletes it; totals in reports, such as page views per day, carry no identifier. We see reports, never your IP address.
  • Your answer is kept in our own cookie __Host-pp_consent, which records only whether you accepted or rejected and expires after 12 months, when we ask again. It is needed to remember your answer and is set whichever you choose.
  • The legal basis is your consent. You can withdraw it at any time, as easily as you gave it: open Cookie settings (also at the foot of every public page) and choose Reject. From then on nothing more is sent to Google and the _ga cookies are deleted; what was collected before stays lawful.
  • The count of visits in section 6 is separate from this: it sets no cookie and works the same whatever you choose here.

8. Your rights and contact

Access, rectification, erasure, restriction, portability and objection under the GDPR; complaints to the data protection authority of your country or to the Lithuanian State Data Protection Inspectorate. Contact support@portproof.org. The contact point for authorities and the law-enforcement guidelines are published separately.