Privacy Policy

01About this policy

This policy describes data processing when you visit curales.com, register, pay, use your dashboard, VPN or proxies, and contact support. “Curales”, “the service”, “we” and “us” refer to the administration of the Curales project.

Privacy contact: Telegram @curales_support. This policy does not replace the policies of third-party websites, payment services or applications you use independently.

02Data we process

• Account: email address, name or nickname, internal identifier, registration date and notification preferences. Your password is stored as a salted hash, not in plain text.
• Sessions and security: login and activity timestamps, session identifiers, your IP address when accessing the website, CAPTCHA verification data and technical information needed to limit suspicious requests.
• Orders and payments: order and invoice numbers, selected service, amount, currency, payment status and timestamps, service provisioning details and payment provider responses needed to verify a payment.
• VPN and proxies: account identifiers with technical providers, connection settings, validity periods, traffic limits and usage, location and session preferences, issued credentials and subscription links.
• Support: your request, correspondence history and information you voluntarily provide to resolve an issue.
• Technical logs: request time, requested resource address, response code, error and security information. Website infrastructure may record IP addresses and browser parameters.

Do not send support passwords, wallet private keys, seed phrases, full VPN subscription links or other secrets. If troubleshooting requires part of your settings, hide sensitive values.

03Why we need this data

Data is used to create and protect accounts, verify payments, provision and renew services, account for traffic, display order history, handle support requests, investigate abuse and recover from failures.

Depending on applicable law, processing may be based on providing the service you request and performing a contract, meeting legal obligations, legitimate interests in maintaining security, or your consent where required. This policy is not itself consent to processing for which the law requires separate consent.

04Cookies and browser storage

• Necessary session cookies keep you signed in. A user session has a maximum lifetime of 7 days and may end earlier, including after 24 hours of inactivity, sign-out or session revocation.
• Local storage saves proxy generator preferences, such as protocol, location and output format, so you do not have to enter them again. These preferences may remain until you clear the website’s data in your browser.
• Tab storage saves form drafts and dashboard selections. Drafts may contain a name and the text of a support request that has not yet been sent. Your browser may restore this data when restoring a tab.
• Third-party security tools may use their own cookies and technical identifiers under their respective policies.

You can clear website data and manage cookies in your browser settings. Blocking necessary cookies may prevent sign-in and dashboard use. A support draft stored in your browser does not mean that the request has been sent to support.

05Who may receive data

Data is shared to the extent necessary for the relevant function:

• Hosting providers and Cloudflare maintain website availability and security and process visitors’ network requests and technical data. See the Cloudflare Privacy Policy.
• hCaptcha checks that forms are not being used by bots. Verification sends a CAPTCHA token and IP address; the widget may also analyse device parameters and interactions. See the hCaptcha Privacy Policy.
• Trybit processes payments. When creating an invoice, we send an order identifier, amount and currency and receive payment verification results. Information entered on the payment page is processed under Trybit’s policies. Transactions on public blockchains may remain publicly accessible regardless of whether your Curales account is deleted.
• Technical VPN and proxy suppliers, including the Evomi and Proxyware infrastructure used for proxies, receive a service account identifier and provisioning parameters. They provide connections and traffic accounting and may process network and technical data within their infrastructure.
• Umami Cloud is used for statistics on visits to public pages: the page address without query parameters or the fragment after #, title, referrer, browser language and device parameters. The service receives technical network request data. The tracker is not loaded on sign-in, registration, account recovery, dashboard or staff pages.
• Telegram processes correspondence if you choose it as your support channel. We can see the messages you send and the profile information available to the person you are communicating with.

Data may also be disclosed where necessary to comply with a binding lawful request or protect rights under applicable law. We do not use account data to sell advertising lists.

Suppliers may process data in other countries. Applicable transfer requirements depend on the law and the role of the particular supplier. Using the service does not waive data protection safeguards provided by law.

06Connection privacy

Providing the services requires accounting for connection validity, volume and status. This policy is not a promise that every participant in a connection keeps no logs, or a guarantee of absolute anonymity.

VPN and proxies do not replace device security or control data collection by the websites you visit. Third-party VPN clients and applications have their own data processing policies. Sharing a subscription link, QR code or proxy password may give another person access to your service.

07Retention and security

Account and active service data is retained for as long as needed to maintain them. Order, payment and support history may be retained after a service ends to resolve disputes, prevent duplicate provisioning and meet legal obligations. Retention depends on the processing purpose and applicable law; expiry of a package does not automatically delete your account or history.

We use secure website connections, password hashing, access controls and backups. These measures reduce risk but cannot eliminate it completely.

Deletion from the active system does not always mean immediate removal from backups. Residual copies are restricted to recovery purposes and deleted as they are replaced or necessary retention periods end. Contact support to ask about data retained on mandatory grounds.

08Your requests and rights

You may request information about your account data, ask for corrections, request account deletion or ask us to stop certain processing. Depending on applicable law, you may also have rights to restriction, objection, data portability, withdrawal of consent and complaints to a competent authority. Withdrawing consent does not affect the lawfulness of earlier processing.

Contact @curales_support, stating your account email and your request. To protect your data, we may ask for proportionate evidence that the account belongs to you. Do not send documents or secrets unless necessary and agreed in advance.

Deleting an account may make services inaccessible and does not itself constitute a refund request. If data must be retained by law or to resolve a dispute, we will explain the grounds and limitations. Requests are handled within the time required by applicable law.

09Changes and contact

The revision date appears at the top of this page. We will communicate material changes to processing through an available channel; where new consent is required, it must be obtained separately.

For questions about this policy or data processing, contact @curales_support.