Privacy Policy

Short version

• We can't read your traffic — it's encrypted end-to-end between your own devices, and we never hold the keys.
• We store account metadata (email, device names, IP coordination events) to run the network. We don't sell it, and we don't run ads.
• You can export or delete everything from the admin console at any time.

1. Who we are

OpenVLAN ("we", "us") operates a Zero Trust networking platform at openvlan.com. This policy explains how we handle personal data when you use our website, control plane, and clients.

2. Data we process

• Account data: name, email, tailnet name, role, and authentication events from your identity provider.
• Device metadata: device name, OS, tailnet IP, public key material, and last-seen timestamps.
• Coordination events: when devices connect, disconnect, or change routes — needed to keep your network consistent.
• Network traffic: encrypted end-to-end with AmneziaWG and never accessible to us. We store no packet content, ever.
• Billing data: handled by our payment processor; we retain invoices only.

3. Why we process it

To provide the service you asked for: authenticating devices, applying your access policies, routing coordination, and keeping the network operational. Legal bases are contract performance and, where applicable, consent or legitimate interest (security logging, abuse prevention).

4. Retention

Coordination logs are kept for 30 days on free plans and per your plan's retention setting on paid plans. Deleting a tailnet removes device metadata within 30 days; device-held keys are destroyed immediately.

5. Sharing

We share data only with subprocessors needed to run the service (hosting, email, payment processing), under data-processing agreements. We disclose data to authorities only when legally compelled, and publish transparency reports.

6. Your rights

Access, export, correction, deletion, and objection — exercise any of them from the admin console or by emailing privacy@openvlan.com. If you're in the EEA/UK, you also have the right to lodge a complaint with your supervisory authority.

7. International transfers

Servers run in the region you choose; cross-border transfers rely on Standard Contractual Clauses where required.

8. Contact

Data Protection inquiries: privacy@openvlan.com.

This document is an illustrative template for a demo site and is not legal advice.