Privacy Policy

InnovX Privacy Policy

Effective date: [16.02.2024]
Version: [v1.0]

This Privacy Policy explains how [Innovx Dijital Hizmetler A.Ş.] (“we”, “us”, “our”) collects and processes your information when you use GuardX and related websites, apps, and services (collectively, the “Services”). We design InnovX around three principles:
   1.    No-logs VPN. We do not log your browsing content, DNS queries, destination IPs, or the VPN IP address assigned to you.
   2.    Data minimization. We collect only what is necessary to operate and improve the Services.
   3.    Transparency & control. You can access, correct, export, or delete your data, and you can opt out of optional analytics at any time.

If you do not agree with this Policy, please do not use the Services.

1. Who we are (Controller)
   •    Controller: (InnovX  Dijital Hizmetler A.Ş.)
   •    Registered address: [LAKA KOYU NO:2 BORNOVA, IZMIR, TUKIYE]
   •    Contact email: info@innovxapps.com
   •    Data Protection Officer (if appointed): 

For users in the EEA/UK, InnovX  Dijital Hizmetler A.Ş. is the controller of your personal data for the purposes of the GDPR/UK GDPR.
For California residents, we act as a “business” under the CCPA/CPRA.

2. Scope

This Policy covers our mobile/desktop apps (including VPN, Ad-Block, Family Mode), browser extensions (if any), APIs, and websites under www.innovxapps.com. It does not cover third-party sites or services you visit using the VPN.

3. What we do not collect (No-Logs Commitment)

When connected to GuardX VPN, we do not:
   •    log or store your browsing activity (websites visited, content viewed, data you download or upload);
   •    log your DNS queries;
   •    log the VPN IP assigned to you or the original source IP from which you connect;
   •    perform deep-packet inspection of your traffic (beyond what is technically necessary to route traffic or apply your chosen filters);
   •    sell your data to anyone, ever.

Network traffic is processed in RAM and discarded when your session ends.

4. Information we may collect

We collect only the minimum necessary categories described below.

4.1. Information you provide to us
   •    Account data: email address, password hash, subscription tier, locale, referral code.
   •    Purchase records: subscription status, product, duration, price tier, and non-identifying transaction/receipt IDs. If you buy via Apple’s App Store, Apple is the merchant of record; we do not receive your full payment card details.
   •    Support communications: messages you send us, your contact details, optional attachments (e.g., logs or screenshots you choose to share).
   •    Marketing preferences: your opt-in/opt-out choices for emails or push notifications.

4.2. Automatically collected (app/website)
   •    Basic device/app data: app version, OS version, device model, preferred language, country (derived from device locale, not precise GPS).
   •    Diagnostics & crash data (optional): app crashes, performance metrics, error codes. This is opt-in where platform permits; if enabled, it helps us fix bugs.
   •    Website analytics & cookies: on our websites we may use strictly necessary cookies; with your consent we may use analytics cookies (see §10).

4.3. VPN service metadata (minimal, aggregated)

To operate the network (e.g., load balancing, abuse prevention), we may process real-time operational metrics such as server utilization and anonymous counts of successful connection attempts. These metrics are not tied to specific users or IP addresses and are kept only in aggregate or for short retention windows (see §9).

4.4. Ad-Block & Family Mode specifics
   •    Ad-Block: filter lists (e.g., domain/URL patterns) are downloaded to the device; matching occurs on-device where technically feasible. We do not receive your per-site browsing history.
   •    Family Mode (Adult Filter): by default implemented via DNS/category blocking rules. If you opt to use GuardX DNS resolvers, your DNS requests are handled solely for the purpose of resolution and filtering; we do not log identifying DNS query histories. We may store aggregated, non-identifying counters to improve block lists (e.g., number of blocked requests per rule), not linked to a user or device.

If your technical setup differs (e.g., server-side HTTP filtering, Safe Browsing lookups, third-party threat-intel), tell us and we will update this section.

5. Legal bases (EEA/UK)

We process personal data under these legal bases:
   •    Contract (Art. 6(1)(b) GDPR): to provide the Services, authenticate you, deliver the VPN connection, and handle support.
   •    Legitimate interests (Art. 6(1)(f)): to secure our Services (fraud/abuse prevention), measure aggregated performance, and improve features—balanced against your rights and expectations.
   •    Consent (Art. 6(1)(a)): for optional analytics/diagnostics, marketing communications, and cookies where required.
   •    Legal obligation (Art. 6(1)(c)): to comply with tax/accounting and regulatory requirements.

6. How we use your information
   •    Provide and maintain the Services (account management, connectivity, server selection, filter updates).
   •    Process purchases, manage subscriptions, and handle refunds.
   •    Detect, prevent, and respond to abuse, security incidents, or violations of our Terms.
   •    Improve performance, reliability, and user experience (in aggregate or with your opt-in diagnostics).
   •    Communicate with you about updates, security notices, and—if you consent—marketing.
   •    Comply with legal obligations.

We do not build marketing profiles based on your VPN usage and we do not show third-party ads inside GuardX.

7. Sharing & disclosures

We do not sell personal data. We may share limited data with:
   •    Service providers / processors: cloud hosting, email delivery, customer support tools, crash analytics, payment processors (e.g., Apple). They process data strictly under our instructions and applicable data-processing agreements.
   •    Affiliates & corporate transactions: if we restructure, merge, or sell assets, data may transfer subject to this Policy’s protections.
   •    Legal: if required by applicable law or valid legal process. Because we keep no traffic logs, we cannot provide what we do not have.

Upon request, we can provide a current list of key subprocessors.

8. International transfers

Where data is transferred outside your jurisdiction, we use lawful transfer mechanisms such as EU Standard Contractual Clauses (SCCs), UK IDTA/Addendum, and implement technical and organizational measures (encryption in transit and at rest, access controls, least privilege).

9. Retention

We retain data only as long as needed for the purposes described:
   •    Account & subscription data: for the life of your account and up to [X years] after closure (to resolve disputes, comply with tax/accounting).
   •    Support tickets: [12–24 months] from resolution unless law requires longer.
   •    Crash/diagnostics (opt-in): [90–180 days].
   •    Aggregated operational metrics: may be kept without time limit, but cannot identify you.
   •    Backups: stored securely with rolling deletion cycles [e.g., 30–90 days].

10. Cookies & similar technologies

Our apps do not use third-party advertising cookies. Our websites may use:
   •    Strictly necessary cookies (security, session, payment).
   •    Analytics cookies (only with your consent) to understand website usage in aggregate.
You can manage cookie preferences via our cookie banner or your browser settings.

11. Third-party SDKs

We strive to minimize third-party SDKs. If used (e.g., for crash reporting, purchase validation, push notifications), they are configured for privacy-preserving operation.

12. Security

We implement administrative, technical, and physical safeguards, including encryption in transit and at rest, hardened infrastructure, access control, security monitoring, and regular audits. No method of transmission is 100% secure; we continuously improve our safeguards.

13. Your rights

EEA/UK (GDPR/UK GDPR)

You may have the right to access, rectify, erase, restrict, object, port your data, and withdraw consent at any time (without affecting prior processing). You also have the right to lodge a complaint with your local supervisory authority.

California (CCPA/CPRA)

You may have the right to know (access), delete, correct, and opt out of sale/share of personal information (we do not sell data). We honor signals to Limit Use of Sensitive PI where applicable.

Türkiye (KVKK)

You may request information, correction, deletion/destruction, and object to processing results, pursuant to Law No. 6698.

To exercise rights, contact us at [PRIVACY@YOURDOMAIN]. We may verify your identity before responding.

14. Children’s privacy

The Services are not directed to children under 13 (or the age defined by local law). Family Mode helps filter adult content but does not replace parental supervision. If we learn we have collected personal data from a child, we will delete it.

15. Do Not Track / Global Privacy Control

Our websites honor legally recognized signals where applicable (e.g., GPC under CPRA). App behavior may differ due to platform limitations.

16. Automated decision-making

GuardX does not make decisions producing legal or similarly significant effects solely by automated processing. Filtering features operate based on rules you enable (e.g., Ad-Block/Family Mode).

17. Changes to this Policy

We may update this Policy from time to time. We will post the updated version and revise the “Effective date” above. If changes are material, we will provide additional notice (in-app message, email, or website banner). Your continued use after the effective date constitutes acceptance.

18. Contact

Questions or requests about this Policy?
Email: info@innovsapps.com
Postal: InnovX  Dijital Hizmetler A.Ş., Laka Koyu No: 2 , Bornova, Izmir, Türkiye
EU/UK Representative (if applicable): [NAME, ADDRESS, EMAIL]
Data Protection Officer (if applicable): [DPO NAME, EMAIL]

19. Summary of key commitments (plain English)
   •    No activity logs. No DNS logs tied to you. No VPN IP logs.
   •    No third-party ads, no data sales.
   •    Apple handles your payment; we receive only receipt metadata.
   •    Optional diagnostics only with consent; can be turned off anytime.
   •    Filtering is on-device or DNS-based without creating identifiable histories.