Privacy Policy

1. Who we are

ShieldWeb provides a team VPN and secure network service. The data controller for this service is:

ShieldWeb
Server location: Zürich, Switzerland
Contact: privacy@shieldweb.online

2. What data we collect

Account data

• Username and email address — required to create an account and communicate with you
• Password hash — stored as bcrypt hash, never in plaintext
• Organization membership — which team you belong to and your role

VPN connection data

• WireGuard public keys — per-device keys used to authenticate connections
• Assigned VPN IP address — internal address within your team network
• Connection timestamps — when a device last connected (for dashboard display)

What we do NOT collect

• VPN traffic content — we do not inspect, log, or store your internet traffic
• Browsing history or DNS queries (unless you enable DNS filtering; see below)
• Payment card details — processed directly by Paddle (our payment processor)

DNS filtering (optional)

If you enable DNS filtering (Kids Guard, Safe Surfing, Anti-Malware), DNS queries are processed by AdGuard running on the same server. Query logs are not retained beyond 24 hours and are used only for blocking statistics.

Support tickets

When you submit a support ticket, we store the message content and your email in order to respond.

3. Why we collect it

We process your data on the following legal bases:

• Contract performance — to provide the VPN service you signed up for (Art. 6(1)(b) GDPR)
• Legitimate interests — security monitoring, abuse prevention, service improvement (Art. 6(1)(f) GDPR)
• Legal obligation — to comply with applicable Swiss law if required
• Consent — for optional features like DNS filtering

4. Data storage and security

• All data is stored on servers physically located in Zürich, Switzerland
• Data is encrypted in transit using TLS 1.3
• VPN traffic is encrypted using WireGuard (ChaCha20-Poly1305)
• Database is stored in SQLite with file-system permissions restricted to the application user
• Passwords are hashed with bcrypt (cost factor 12)
• Two-factor authentication (TOTP) is available and recommended

5. Data sharing

We do not sell your data. We share data only with:

• Paddle (payment processor) — billing information only, under their privacy policy
• Email provider — your email address to send transactional emails (verification, password reset)
• Law enforcement — only if required by a valid Swiss court order. We will notify you unless legally prohibited from doing so.

We do not transfer data outside Switzerland except as necessary for payment processing (Paddle is GDPR-compliant).

6. Data retention

• Account data — retained while your account is active and for 30 days after deletion
• VPN device keys — deleted immediately when you remove a device
• Support tickets — retained for 12 months
• Billing records — retained for 7 years as required by Swiss accounting law
• DNS query logs — max 24 hours, automatically purged
• Audit events — retained for 90 days

7. Your rights

Under GDPR (and Swiss nFADP) you have the following rights. To exercise any of them, email privacy@shieldweb.online:

We will respond to all requests within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Swiss Federal Data Protection Commissioner (FDPIC) or your local EU supervisory authority.

8. Cookies

We use only essential cookies:

• nmtrial — session cookie. Stores your login session. Expires when you close the browser or log out. Required for the service to function.

We do not use analytics cookies, advertising cookies, or any third-party tracking scripts.

9. Contact & DPO