IVPN

IVPN is a virtual private network service offered by the Gibraltar-based company Privatus Limited.

7.5/10

How we calculate ratings →

Handling

Does the policy allow personally-targeted or behavioral marketing? No

10/10

Does the service allow you to permanently delete your personal data? Yes, by contacting someone

3/5

Does the service allow third-party access to private personal data? Yes, all parties specified (only to critical service providers)

8/10

This may come in the form of outright data sharing or by using local third-party analytics software (such as Google Analytics, which collects a plethora of user information).

Note that whether the policy allows sharing aggregated user data does not affect this question.

If the personal data is encrypted when it passes through the third-party, it does not count as third-party access (as the data is inaccessible to that party).

If personal data has been made public by, for example, posting it to a blog, it does not count as private personal information (and is therefore not considered by this question).

Score

Yes

The policy allows sharing personal data with third parties (not just critical service providers), and does not explicitly list the third parties.

Yes, all parties specified (including non-critical service providers such as advertisers)

30%

Yes, not all parties specified (but only to critical service providers)

70%

Yes, all parties specified (only to critical service providers)

80%

100%

Citation

Some payment information may be related to your account, for example, if PayPal is used a PayPal transaction ID with be associated with your account, as well as a subscription ID should you set up a PayPal subscription.
[...]
For credit card payments, we use Braintree as our payment processor, and store a Braintree transaction ID against your account. If you elect to enable auto-renew for card payments, a subscription ID will also be stored.
[...]
IVPN have selected Piwik as their web analytics platform.
[...]
Piwik is open source software that is hosted on our own server infrastructure to ensure your privacy[...].

Notes

Piwik is, presumably, hosted under https://stats.ivpn.net (according to NoScript logging)

When does the policy allow law enforcement access to personal data? Only when required by a court order or subpoena

4/5

Score

Always

This includes cases in which law enforcement either runs the service or has a known backdoor into (or relationship with) the service.

Not specified

When reasonably requested

60%

Only when required by a court order or subpoena

80%

N/A (no personal data to share)

The service would have no personal data to share with law enforcement.

100%

Never (special legal jurisdiction)

The service operates in a jurisdiction in which sharing data with law enforcement is never required.

100%

Citation

The company is incorporated in Gibraltar. If a court order is received from a recognised legal authority with jurisdiction over IVPN then the company will comply with that order. However, the company cannot be compelled to hand over information which it does not have. When a customer signs up we request the minimum information possible, a valid email address. If it ever becomes required by law for us to keep a persistent log of our customers connections or any personal data relating to their network activity, we will immediately notify our customers and do everything in our power to move jurisdictions or close the service to protect those who entrust their privacy to us.

Transparency

Does the policy outline the service's general security practices? Yes

2/3

Score

Somewhat

The policy provides only a very vague overview of its security practices.

30%

Yes

60%

Yes, including audits

"Reviews," "monitoring," etc. also count as audits.

80%

Yes, including independent audits

Independent "reviews," "monitoring," etc. also count as independent audits.

100%

N/A

The service doesn't collect any personal information.

100%

Citation

IVPN is subject to EU law and is in compliance with the EU Data Protection Directive (Directive 95/46/EC), which prohibits companies transferring data to overseas jurisdictions with weaker privacy laws. IVPN will not locate servers in countries where it's forced to break this compliance. Due to the nature of our logging practices VPN servers do not contain any personally identifiable information and thus, if seized, could not be used to identify users.

No 3rd parties have access to any of your data. We always use 1st or 3rd party tools we can host on our own servers in a protected and secure environment.

Notes

An audit by Cure53 happened 2020-01-23 (https://www.ivpn.net/blog/independent-security-audit-concluded/)

Is the policy's history made available? No

0/5

Does the policy require users to be notified in case of a data breach? Not necessarily

0/7

Will affected users be notified when the policy is meaningfully changed? Yes

5/5

Collection

Does the service collect personal data from third parties? No

10/10

Is it clear why the service collects the personal data that it does? Yes

10/10

Score

Somewhat

30%

Mostly

70%

Yes

100%

N/A

The service doesn't collect any personal information.

100%

Citation

To create an IVPN account you need only provide an email address. That address is used to facilitate password resets and to send important security updates relating to our service. Should you wish to opt out of email communication please contact out support team to be removed from our mailing list. You're free to use any email address, disposable or permanent. Your email address will be associated with an IVPN ID, an internal ID used to manage your account.

We don't require any other personally identifiable information should you use more anonymous payment methods such as cash or cryptocurrency.

Each account also carries a subscription expiry date so we can manage both trial period expiry and re-subscription.

[...]

For credit card payments, we use Braintree as our payment processor, and store a Braintree transaction ID against your account. If you elect to enable auto-renew for card payments, a subscription ID will also be stored.

In order to process your payment Braintree and PayPal will request additional information. Braintree requires collection of your card details to process your payment, and PayPal will require name, email and address information to create a new PayPal account as well as agreement to their terms of service. These additional datapoints are not stored by IVPN, though Braintree and PayPal are required to retain them for many years. In addition, no 3rd party payment provider has access to your IVPN ID.

In short, where we can offer anonymous payment methods we will, and we collect as little information as possible to process them. However centralised or 3rd party payment systems and their data processing and storage are out of our control.

Please select cash or cryptocurrency payments should this be of concern.

Does the service allow the user to control whether personal data is collected or used for non-critical purposes? On an opt-out basis, for all non-critical data/uses

6/10

Does the policy list the personal data it collects? Yes, exhaustively

10/10

Score

The policy does not claim to not collect personal data, but it also doesn't provide any meaningful insight into the types of personal data it collects.

Only summarily

The policy uses overly vague language to provide a summary of the types of collected personal data.

30%

Yes, generally

All general categories of collected personal data are listed, though not all types of personal data are explicitly mentioned (for example, the list might use a phrase like 'such as' when listing types of personal data).

70%

Yes, exhaustively

All types of collected personal data are listed specifically

100%

N/A (no personal data is collected)

100%

Citation

o create an IVPN account you need only provide an email address. That address is used to facilitate password resets and to send important security updates relating to our service. Should you wish to opt out of email communication please contact out support team to be removed from our mailing list. You're free to use any email address, disposable or permanent. Your email address will be associated with an IVPN ID, an internal ID used to manage your account.

We don't require any other personally identifiable information should you use more anonymous payment methods such as cash or cryptocurrency.

Each account also carries a subscription expiry date so we can manage both trial period expiry and re-subscription.

Last Updated

June 24, 2020

Sources

Source #1 ↗

Contributors

doamatto