Last updated:
1. Purpose and responsibility
This policy sets out the technical and organisational details of the processing summarised in the Privacy Policy. Colitu is operated by COLITU LIMITED, a company registered in England and Wales (registered office: 128 City Road, London, United Kingdom, EC1V 2NX; company number 17520342), which decides how data is processed and can be reached at privacy@colitu.com. The account database runs on a server in Turkey. Technical detail: Security Whitepaper.
2. Processing activities
| Activity | Data | System | Legal basis |
|---|---|---|---|
| Account management | E-mail, password hash, language, IP and country at registration and at the last sign-in | Control plane database | Contract |
| E-mail verification | E-mail, code hash | Control plane, e-mail provider | Contract, legitimate interest |
| VPN access | Connection credentials per device (and per subscription link) and per server, device records | Control plane, VPN servers | Contract |
| Traffic accounting | Bytes per user per server, in windows of about 15 seconds | VPN server agent, control plane | Contract, legitimate interest |
| Transport selection | Which transports worked on which server and how fast, per device (no IP address) | Apps, control plane | Legitimate interest |
| Security and abuse prevention | Sign-in events, IP, country, device hash, HMAC-SHA256 abuse-check hashes keyed with a server secret, refused attempts | Control plane | Legitimate interest |
| Operating the website and API | Access logs (IP, address requested, browser) | Control plane | Legitimate interest |
| Payment | Order, amount, transaction status, provider notification | Control plane, payment provider | Contract, legal obligation |
| Support | Messages, attachments, masked app logs | Control plane, e-mail relay | Contract |
| Colitu Bot | Questions, answers, IP address, feedback | Control plane, AI provider | Legitimate interest |
| Service health | Server CPU, memory, disk, core state | Control plane | Legitimate interest |
3. Data processed on VPN servers
Each VPN server holds its own protocol keys and the connection credentials of users who use it, identified by an internal user ID; it holds no e-mail addresses or payment data. Connection credentials are per device (and per subscription link) and per server; the credentials of a removed device or a rotated subscription link are deleted from the servers. The servers count the bytes transferred per user (device credentials are mapped back to the user; no traffic is stored per device) and report them to the control plane. They do not record traffic content, destinations, DNS queries, connection logs or user IP addresses.
Two servers send a small, fixed set of domains through Cloudflare WARP; for those domains Cloudflare is the exit.
4. Processors (sub-processors)
| Provider | Service | Data shared |
|---|---|---|
| A payment provider (only for customers who buy a paid plan) | Payment processing | Order number, amount, currency, plan description, payment method; for Rialit, a fixed payer number tied to the account (no e-mail or IP address) |
| Resend | Account e-mails | E-mail address, message content |
| Brevo | Relay for replies from our support mailbox | Recipient address, reply content |
| Backblaze | Off-site backup storage (EU Central, Amsterdam) | Encrypted backup files only; Backblaze cannot read them |
| DeepSeek | Colitu Bot answers | The question and the last few messages of the conversation; no account details |
| Cloudflare | DNS hosting; proxy for docs.colitu.com; default DNS resolvers in the apps; WARP egress for a few domains on two servers | IP address and request data of docs.colitu.com visitors; DNS queries from the VPN servers' IP addresses; traffic metadata for those domains |
| Hosting providers | Server infrastructure | Data stored on the servers (they have technical access; disks are not encrypted) |
5. Retention and deletion
Retention periods are listed in section 3 of the Privacy Policy. An automatic job runs every hour and, using those periods, deletes expired records or clears their IP fields: sign-in events, traffic records, refused attempts, abuse-check hashes, e-mail delivery records, verification codes, bot conversations, closed support conversations, ended web and app sessions, TV sign-in and migration requests, the details of removed and long-unseen devices and the IP fields on the account record. Every failed rule is logged and shows up in a monitoring metric. Deleting an account erases the data listed in section 4 of the Privacy Policy at once. Plan, payment and order records and the audit log are not covered by this job. Deleted data remains in encrypted backups made before the deletion for at most 36 days, and in unencrypted snapshots taken before a deployment for at most 7 days.
6. Technical and organisational measures
- Connections to the website and API are encrypted with TLS. The control plane and the VPN servers use mutual TLS 1.3 (gRPC); server certificates last 30 days and renew automatically.
- Passwords are hashed with Argon2id.
- Payment, e-mail and AI provider credentials are encrypted in the database with AES-256-GCM. Users' VPN connection credentials and the Reality private keys are currently stored unencrypted in the database; encrypting them is on the roadmap.
- The admin panel is on a separate address with role-based permissions; admin endpoints are closed on the public API, admin accounts lock for 15 minutes after 5 failed attempts, and every administrative action is written to an audit log. Two-step verification (TOTP) is mandatory for admin accounts: an admin without it can only set it up after signing in.
- Administrative access to servers is by SSH with keys only; password sign-in is disabled.
- The control plane database is not reachable from the internet; the VPN servers have no access to it.
- Database backups are encrypted with age to a public key; making a backup needs only that key. The decryption key is kept offline, not on any server. Daily backups stay on the control plane server for 3 days; an encrypted copy is kept at Backblaze B2 (EU Central, Amsterdam), locked against deletion for 30 days and deleted after at most 36 days. A restore from that copy was tested on 16 October 2026.
- Server disks are not encrypted; hosting providers have technical access to their machines.
- Country lookup from IP uses a local database on our server; the IP address is not sent to a third party for this.
- There has been no independent security audit yet.
7. Data breaches
If we detect a security breach affecting personal data, we act immediately to contain it, e-mail affected users without undue delay, notify the competent authorities where the law requires, and publish what happened in the incident log.
8. Requests
For requests about data processing: privacy@colitu.com. Security reports: security@colitu.com
Questions? Write to support@colitu.com.