Privacy Policy

ProxyLink is operated by ProxyLink, Thessaloniki, Greece.

Contact for privacy matters: [email protected]

This policy applies to all users of proxylink.dev and is written in compliance with the EU General Data Protection Regulation (GDPR).

Account data: Your name and email address, collected when you register. Used to identify your account and communicate with you.

Request logs: When HTTP/HTTPS traffic passes through your proxy links, we log: IP address, HTTP method, path, headers (excluding Authorization and Cookie), request body (up to 64KB), response status, and response time. Visible only to you and your team. Auto-deleted after 30 days.

Audit log: Every remote access session (SSH, RDP, VNC) is logged with: actor email, source IP address, target device label, protocol, session start time, and duration. This log is immutable - it cannot be modified or deleted. It exists for NIS2 and GDPR compliance purposes. Retained indefinitely, including after you close your account - see Data Retention below for what that means and why.

Session recordings: If you enable session recording on a proxy link, the content of RDP, VNC, and SSH sessions is captured and stored on our servers (Hetzner, Germany). During early access, recordings are auto-deleted after 3 days and storage is limited to 200 MB per account. On paid plans, recordings are retained for 14 days. Recordings can be manually deleted at any time.

Billing data: Payment processing is handled by Stripe. We do not store your card details. Stripe's privacy policy applies to payment data. No billing data is collected during the current early access period.

WireGuard VPN tunnel metadata: We store the WireGuard public key and assigned VPN IP for each tunnel you create. No traffic content passing through VPN tunnels is logged or inspected.

Windows endpoint deploy script: When you use the one-click Windows deployment feature, a script is executed on the target PC. That script sends the PC's hostname to our server (once, at installation) so the device can be labelled in your dashboard. No other data from the Windows machine is collected.

LAN scan data: When you trigger a LAN scan through a VPN tunnel, ProxyLink sends TCP/ICMP probes to IP addresses on your client's network and stores the results (IP address, open ports, detected service type) in your account. This data belongs to you and is deleted when you delete the corresponding proxy links or tunnel.

Network automation outputs: When you run automated SSH commands on remote devices (via the Automations feature), the command output is stored in your account so you can review results and compare runs. This output may contain information from the remote device such as usernames, IP addresses, or configuration data. Automation logs are visible only to you and your team. You can delete them at any time from the Automations dashboard.

MAC addresses: If you enable Wake-on-LAN on a proxy link, you may store the MAC address of the target device. This is stored in your account, visible only to you and your team, and deleted when you delete the proxy link.

Usage data: Standard web server logs (IP, timestamp, user agent) for security and abuse prevention.

We process your data under the following legal bases:

• Contract performance - account data and request logs are necessary to provide the Service you signed up for
• Legitimate interest - usage logs for security monitoring and abuse prevention
• Legal obligation - retaining billing records as required by law

Request logs: Automatically deleted after 30 days.

Session recordings: During early access, automatically deleted after 3 days (200 MB cap per account). On paid plans, deleted after 14 days. Can be deleted manually at any time.

Audit log: Retained indefinitely for compliance. Exportable as CSV at any time. Entries remain after you close your account, including the name or email address recorded at the time and the IP address the action came from, so the record of what was done to a device is not lost. This is deliberate: an access log that can be erased by deleting the account is not an access log.

Account data: Retained until you delete your account. After deletion, data is removed within 30 days, apart from the specific records named in this section that outlive the account - the audit log, device agent credentials, device setup records, removed engineer VPN profiles, unremoved VPN keys, and billing records. Each one says below what is kept and why.

Network automation logs: Retained until you delete them manually, or until you delete your account.

MAC addresses: Retained until you delete the proxy link or your account.

Device agent credentials: When a device is removed, we keep the credential that identifies the ProxyLink Agent still installed on that machine, along with the device label, its owner, and the address it last contacted us from. Without the credential we cannot reach that software again to remove it, and it would keep contacting us indefinitely. It is deleted once the agent's removal has been confirmed - a capability we are still building, so today these records are kept until then.

Device setup records: When you generate a setup script for a Windows device, we keep a record of it. The script itself contains that device's credentials and is deleted within an hour of expiring - it is only usable for 30 minutes. What we keep afterwards is a one-way fingerprint of the agent credential, the device it was generated for, and the VPN address assigned to it. That fingerprint cannot be turned back into a credential; it exists so that if an agent we can no longer identify starts contacting us, we can tell which machine it is and remove it. These records outlive the account, because that is exactly when agents become unidentifiable. The device name you typed is deleted 30 days after the account closes.

Removed engineer VPN profiles: When a VPN profile is destroyed, its assigned address is recorded permanently so it is never reissued to anyone else - a reused address would inherit the previous holder's access rules. Names, email addresses and labels attached to it are removed after 90 days; the address, its public key, the account and team it belonged to, and the dates are kept.

Unremoved VPN keys: If removing a device's VPN key from our server does not succeed, we record that key and the device label so the removal can be retried until it does. Deleted 30 days after the removal completes; kept while it has not, because it is the only record that the key is still there.

Billing records: Retained for 7 years as required by Greek tax law.

We use the following third-party processors:

• Stripe (payment processing) - subscription billing and invoicing. Data processed in the US under Standard Contractual Clauses. Stripe Privacy Policy
• Cloudflare (CDN, DDoS protection, DNS) - HTTP/HTTPS proxy link traffic passes through Cloudflare's network. TCP proxy links bypass Cloudflare and connect directly to our server. Cloudflare Privacy Policy
• Hetzner Online GmbH (server hosting, Germany) - all data is stored on servers physically located in the EU. Hetzner Privacy Policy
• Resend (transactional email) - used to send account registration, alert, and notification emails. Resend Privacy Policy
• Cloudflare R2 (backup storage) - encrypted daily backups of our database and configuration files are stored in Cloudflare R2 (EU region). Backups are retained for 30 days. Cloudflare Privacy Policy
• WireGuard (VPN protocol, open source) - self-hosted on our server. No third-party involvement in VPN traffic.
• Apache Guacamole / guacd (browser RDP/VNC protocol gateway, open source) - self-hosted on our server. RDP and VNC session streams are processed locally. No third party receives this data.

We do not sell your data to third parties.

When you use ProxyLink to proxy traffic to your server, the requests from your end-users pass through our infrastructure. We log these requests as described in Section 2.

If your end-users are EU residents, you (as the operator of the proxy link) may be a data controller for their data. You are responsible for ensuring your use of ProxyLink complies with GDPR and any other applicable laws regarding your users' data.

We act as a data processor for request log data on your behalf. You can delete request logs at any time from the ProxyLink dashboard.

As an EU resident, you have the following rights:

• Access - request a copy of personal data we hold about you
• Rectification - correct inaccurate personal data
• Erasure - request deletion of your personal data
• Portability - receive your data in a machine-readable format
• Objection - object to processing based on legitimate interest
• Restriction - request restriction of processing in certain circumstances

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr.

ProxyLink uses a single session cookie to keep you logged in. No third-party tracking cookies are used. No advertising.

We use industry-standard security measures including HTTPS (TLS 1.2+), encrypted connections to the database, and rate limiting on all endpoints. We do not store passwords in plaintext.

Despite these measures, no system is 100% secure. If you discover a security vulnerability, please report it responsibly to [email protected].

We may update this policy from time to time. We will notify registered users of significant changes by email. Continued use of the Service after changes constitutes acceptance of the updated policy.

Privacy questions or requests: [email protected]

ProxyLink, Thessaloniki, Greece