Nautilus Privacy Policy
This Privacy Policy explains how NAUTILUS INTELLIGENCE LTD (“we”, “us” or “Company”) processes personal data when you use the Nautilus App (a secure network connection service built on VPN technology), our website (nautilusai.co.uk), your account, subscriptions or support.
Data controller: NAUTILUS INTELLIGENCE LTD; Company number: 17131036; Registered office: 128 City Road, London, United Kingdom, EC1V 2NX.
We process data under UK data-protection law, including the UK GDPR, the Data Protection Act 2018 and PECR. Mandatory data-protection laws where you live may also apply, and this Policy does not exclude rights those laws give you.
1. What we collect
- Account data: email address, account ID, password hash, account and Plan status, Plan expiry and data usage.
- Signed-in devices: when you sign in, the App sends the device model and a random installation identifier so that you can see and remove your signed-in devices.
- Payment data: for subscriptions bought in the iOS App, Apple processes the payment and we receive transaction details such as the product, transaction ID, purchase and renewal dates, status and refunds. For website purchases, we keep the order ID, Plan, amount, currency, date and payment status. We never receive your full card details.
- Connection data: see section 2.
- Support data: emails, refund requests, attachments and diagnostic information that you choose to send us.
- Website data: the name, email address, organisation and message you submit through our contact form. Our website does not use analytics or advertising cookies.
The App does not include third-party analytics or advertising SDKs. Error details are kept on your device unless you choose to send them to support.
2. VPN activity data
We do not record or retain VPN activity logs attributable to a particular user, including browsing history, traffic destinations, traffic content or DNS queries.
To establish and maintain a VPN connection, our servers temporarily process your source IP address, tunnel state and protocol data. This information is not used to build browsing history and is not stored as persistent logs of your VPN activity.
To show Plan usage and enforce device limits, we process aggregate data: total data used per billing period, data used per day and per VPN location, and the number of devices currently connected. This data does not contain websites visited, traffic content or DNS queries.
If limited technical records must be kept to handle a specific security incident, abuse or legal obligation, we keep only what is necessary, for no longer than necessary, under this Policy.
3. Why we use data and our lawful bases
- To provide your account, the Service, Plans and devices — performance of a contract.
- To process payments, refunds and tax — performance of a contract and legal obligation.
- To provide support — performance of a contract and our legitimate interest in helping users.
- To keep the Service secure and prevent fraud, abuse and breaches of our Terms — legitimate interests.
- To maintain and improve the App, VPN locations and infrastructure — legitimate interests.
- To respond to website enquiries — legitimate interests.
- To comply with laws, court orders and valid legal requests — legal obligation.
- To send marketing — only with your consent where PECR requires it. You may withdraw consent at any time.
4. Who we share with
We do not sell personal data or provide VPN traffic content to advertisers. We share data only where necessary with:
- Apple, which processes App Store purchases as an independent controller under its own privacy policy;
- hosting and infrastructure providers that run our servers and VPN locations;
- email providers, for account and support emails;
- Formspree, which receives messages sent through our website contact form;
- Google Fonts, which receives your IP address when our website loads its fonts; and
- professional advisers, where needed.
We disclose data to courts, regulators or law-enforcement bodies only where a valid legal process or other legal obligation requires it, and only data we actually hold. Where legally permitted, we will review and narrow overbroad requests. We cannot provide VPN activity logs that were never recorded.
International transfers. VPN locations are in several countries outside the UK, and some providers (for example Formspree) process data in the United States. Restricted transfers use UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses or another lawful safeguard.
5. Retention and security
We retain data only as long as needed to provide the Service, meet legal obligations, handle disputes or protect security. Account data is deleted within 30 days after your account is deleted. Payment, tax and invoice records may be kept for up to 6 years where required by law. Support and website enquiries are kept for up to 2 years after the last contact.
We use measures appropriate to the risk, such as encryption in transit, access controls, least privilege and incident response. Your sign-in credentials are stored in your device’s secure keychain. No internet service can guarantee absolute security.
If a personal-data breach meets the legal threshold, we will notify the ICO and affected individuals as required by UK law.
6. Your rights
Subject to legal exceptions, you may request access, correction, deletion or restriction of your personal data; object to processing based on legitimate interests; object to direct marketing; request data portability; and withdraw consent. To delete your account, use Account → Delete account in the App or email us. To exercise any of these rights, email privacy@nautilusai.co.uk. We may reasonably verify your identity and will respond within one month.
You may also complain to the UK Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/. If you are outside the UK, you may also complain to your local data-protection authority.
7. Children, changes and contact
The Service is for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. Contact us at the privacy email if you believe a minor has provided personal data.
We may update this Policy because of legal, technical or Service changes and will update the date at the top. We will notify you of material changes through the App, website or email.
Privacy: privacy@nautilusai.co.uk
Support: support@nautilusai.co.uk
Legal name: NAUTILUS INTELLIGENCE LTD
Company number: 17131036
Registered office: 128 City Road, London, United Kingdom, EC1V 2NX
This Policy is provided in Chinese and English. If there is an inconsistency, the English version prevails to the extent permitted by law, without affecting mandatory data-protection rights.