Consent to personal data processing

Edition of 13 October 2026, version 2026-10-13. Covers the pingnitro.com website, the @pingnitrobot bot, the account page and the PingNitro apps for Windows and macOS (the "Service"). This consent is a separate document: it is not part of the terms of use or the privacy policy and is given by a separate action. Questions — support@pingnitro.com or @pingnitrosupport.

1. Who the consent is given to

I, a user of the Service, freely, of my own will and in my own interest, give the Operator named below my consent to the processing of my personal data ("data") on the terms of this document.

Operator: the PingNitro service administration. Data requests and withdrawal of consent — by email to support@pingnitro.com or on Telegram at @pingnitrosupport.

The consent is needed for the Service to work: without it a key cannot be issued, a payment accepted or an app connected.

2. Purposes of processing

• to grant access to the Service and a personal key, connect my devices and apps, and run my account;
• to keep the route working and safe: limit abuse and sharing of a key with other people, account for node load, check line quality;
• support: answer requests, find and fix failures;
• to accept payments, make refunds, keep payment records and protect against fraud;
• to send me service messages about my access: confirmation codes, "Did you connect?", a reminder before access ends and similar (no ads);
• to run surveys and collect feedback in order to improve the Service; during the test, answering a survey extends access;
• to run the partner program if I take part in it or came through a partner link: records of referred users, earnings and payouts;
• to meet legal requirements and requests of authorised bodies.

3. What data is processed

• Account: Telegram id, Telegram name and username, interface language; email address (main and backup), a password hash (the password itself is never stored), Google account identifier (when signing in with Google); linked sign-in methods, email two-factor check, time the account was created and last signed in.
• Access: personal route key, access period, assigned entry nodes, the terminal and exchange chosen in the bot, the code of the partner link I came through.
• Devices: device (computer) name, operating system, app version, time the device was added and last seen; the device token is stored only as a hash.
• Connections to nodes: the IP address the app connects from, time, key name, exchange addresses (domain names and ports), traffic volume, line quality figures (latency, loss). The content of traffic is not read or stored.
• Location by IP address: country, region and city derived from the IP address of a connection or sign-in (the "IP Geolocation by DB-IP" database) — to protect a key from being shared with other people, to check compliance with the terms of use, and to show me where a sign-in started (IP address, browser, device, approximate city). Precise location is not determined.
• Surveys, feedback and requests: my survey answers, the texts of feedback and support requests, a contact for the reply if I give one.
• Payments: amount, date and time, payment number, subscription flag, operation identifier and payer details needed to verify receipt and make refunds, the result of the operation check. The Operator does not receive bank card details.
• Partner program (if I take part): the partner's code and links, who came through the link (the partner sees numbers only), earnings, payout requests and the payout details I enter.
• Website and emails: web server log (IP address, time, page address, browser); the sign-in cookie of the account; the email address and text of the emails the Service sends me.

The Operator does not request or process special categories of data (health, beliefs and so on) or biometric data.

4. Actions with data

Collection, recording, organising, accumulation, storage, updating (changing), retrieval, use, transfer (provision, access) to the persons listed in section 5, anonymisation, blocking, deletion and destruction. Processing is automated and uses information and telecommunication networks.

5. Who processes the data for the Operator and who receives it

I agree to processing being entrusted to, and data being passed to, these persons to the extent needed for the purposes in section 2:

• Hosting providers whose servers run the Service and the website: EdgeCenter (Russian Federation), Amazon Web Services (Japan), Gcore (Japan). They provide servers and do not receive the data for their own purposes.
• Telegram (Telegram Messenger Inc. and group companies): the bot, account sign-in and payment with Stars work through it.
• Resend, the email-sending service: sees the email address and the text of the email (confirmation codes and notices).
• Payment-check services that the Operator uses to protect against fraud: receive only the data of the operation itself.
• Google, if I sign in with Google: the Operator receives my email address and account identifier, and Google sees that I am signing in to PingNitro. Google acts under its own rules, not on the Operator's instructions.

The Operator is responsible to me for the actions of the persons it has entrusted processing to. The Operator does not sell data and does not pass it on for advertising. If this list changes (for example, another hosting provider or service appears), the Operator will publish a new edition of this consent on this page; for significant changes the bot and the account page will ask me to confirm it again.

6. Transfer of data abroad

I agree to my data being transferred to Japan (Amazon Web Services and Gcore servers; the account database is stored there too), to the United States of America (the Resend email-sending service) and to the countries where Telegram's servers and group companies are located (according to Telegram's policy, including the British Virgin Islands, the United Arab Emirates and the Netherlands). I have been told that Japan is on the list of foreign states that provide adequate protection of the rights of personal data subjects (Roskomnadzor Order No. 128 of 5 August 2022), and that other countries, for example the USA, the United Arab Emirates and the British Virgin Islands, may not provide adequate protection.

7. Term of the consent and of storage

The consent is valid from the moment I give it, for as long as I use the Service, and until I withdraw it. Data is kept no longer than needed for the purposes in section 2, within the terms from the privacy policy:

• account, access, devices, surveys and feedback, payments, partner details — while the account exists;
• connection log and line quality — up to 7 days, daily traffic volume — 60 days;
• web server log — up to 7 days;
• confirmation codes from emails — 15 minutes (stored only as a hash);
• database backups — up to 30 days, the bot's service logs — up to 8 weeks.

The Operator keeps a record that the consent was given (time, document version, language) in order to be able to confirm it. Data that the law requires to be kept longer (for example, payment records) is kept only to that extent and until the end of the period set by law.

8. How to withdraw the consent

You can withdraw the consent at any time:

• by an email to support@pingnitro.com — from the email address on your account;
• by a message to support, @pingnitrosupport — from the Telegram account you use the Service with;
• with the "Delete my data" button — in the bot ("FAQ" → "How to delete my data") or in your account ("Sign-in and security"): a request to delete the account also withdraws the consent.

After withdrawal the Operator stops processing and deletes the account with all its data within 7 days (data leaves backups when they expire, within 30 days). Payment and partner earnings records that the law requires to be kept for accounting remain without any link to me — no name, username, email or Telegram id. The consent is needed for the Service to work, so access ends after withdrawal. Deleting the chat with the bot, signing out of the account page or disconnecting an app does not withdraw the consent.

9. How the consent is given and what I confirm

• In the bot — with the "I accept" button on the consent screen (it appears before a key is issued, before signing in to an app or to the website through the bot, before a survey and before payment). On the account page and the payment page — with a tick before paying or getting access days. The time, version and language of the consent are saved.
• I have read the privacy policy; I give this consent separately from the terms of use.
• My rights have been explained to me: to find out what data is processed, to ask for it to be corrected, blocked or deleted, to withdraw the consent, and to complain to Roskomnadzor or a court; the procedure is in sections 7–8 and in the privacy policy.
• There are no advertising or news mailings; if any appear, they will need a separate consent.
• The Service is intended for adults.