Privacy Policy

1. Service operator and contact points

Lisar Connect is a product operated by MONTAZERI COMPUTERS & REQUISITES TRADING CO. L.L.C. Privacy requests must be sent to privacy@lisar.io. Legal notices must be sent to legal@lisar.io. Security reports must be sent to security@lisar.io.

2. Data Lisar stores

Lisar uses data minimization and purpose limitation. The current service may store the following categories when they are needed for the applicable product or service flow:

• Account and authentication: UserId, name when provided by you or your sign-in provider, email address, authentication provider, provider subject identifier, account status, and session or token state.
• Installation and application context: InstallationId, ApplicationType, DistributionChannel, ApplicationVersion, ApplicationBuild, and operating-system family.
• Service and profile: ProfileId, PlanId and entitlement status, profile status, expiration date, selected entry and exit routers, DNS feature configuration, and quota or entitlement counters.
• Connection operations: ConnectionSessionId, connection start and end times, connection status, entry and exit router IDs, protocol, uploaded and downloaded byte counts, disconnect reason, and sanitized technical error codes.
• Security and abuse prevention: login-session IP addresses retained in account security history, approximate country and city derived and displayed from those addresses, and authentication and security events needed to protect accounts and the service.
• Commerce, support and legal records: where a Website commerce, support, refund, dispute or legal flow is used, Lisar may retain the transaction, correspondence and accounting records required for that flow.

3. Data processed transiently and data Lisar does not retain

Lisar retains login-session IP addresses in account security history and uses them to derive and display approximate country and city for those sessions. Public source IP is also processed when needed for active requests, VPN connections, routing and security checks.

To deliver network traffic, Lisar infrastructure may transiently process destination IP addresses, destination domains or URLs where visible to protocol infrastructure, DNS queries when Lisar DNS processing is used, network traffic content and packet payloads, and transferred files, messages or page contents. These are not retained as browsing or traffic history.

Lisar does not retain visited domains, visited URLs, web browsing history, DNS query history, traffic content, packet payloads, Advertising ID, cross-app tracking identifiers, GPS or precise location, contacts, photos, personal files, or message contents as service history.

4. Location

Lisar does not collect GPS or precise location for the current release. Lisar uses the login-session IP addresses retained in account security history to derive and display approximate country and city for those sessions and help identify account access. This history does not record browsing destinations or traffic contents.

5. Why Lisar processes data

• Authentication and account management.
• VPN, profile, routing and DNS functionality.
• Quota and entitlement enforcement.
• Security and abuse prevention.
• Support and sanitized troubleshooting.
• Payment, refund, dispute and accounting administration where a commerce flow is used.
• Legal retention or disclosure only where required.

Lisar does not sell personal data and does not use service data for advertising, profiling or cross-app tracking.

6. Website cookies and analytics

Microsoft Clarity and Google Analytics 4 are used on the public Lisar Website for traffic measurement, campaign attribution, page interaction analysis, heatmaps, session behavior and Website usability improvement. Analytics storage is optional. Users can accept or reject analytics and reopen Cookie settings in the footer to change the decision. Advertising storage is not approved and advertising personalization is disabled.

Website analytics is excluded from the User Panel, Admin Panel, API, file service, authentication and payment flows, authenticated product flows, VPN configuration pages, and .ovpn contents. Sensitive product, account, payment, authentication, credential and VPN configuration data must not be intentionally captured. The current native Lisar Connect release has no approved analytics SDK, advertising SDK, third-party crash-reporting SDK or diagnostic upload. Provider behavior and Website analytics retention remain subject to the configured provider services and settings.

7. Service providers, sharing and storage

Lisar uses service providers only where necessary to operate the applicable service. Lisar remains responsible for the handling of personal data by service providers acting on our behalf. We require every third party with which we share user data to provide protection at least equivalent to the protections described in this Privacy Policy and required by the applicable App Store Review Guidelines. Lisar does not sell personal or service data and does not use or disclose it for advertising, profiling or cross-app tracking.

Lisar-controlled account and service records and retained application logs are stored on our single managed server in the Netherlands. Cloudflare does not host our operational application database. Our website, account portal and HTTPS API use Cloudflare for edge delivery and security; this involves processing proxied requests, client IP addresses and related request and security information. Cloudflare's published privacy policy describes primary storage in the United States and European Economic Area and possible international processing. The Netherlands location of our operational database does not mean that all Cloudflare processing occurs there.

GeoDNS uses a licensed IP2Location database for local IP-to-country and city lookups. Optional Apple, Google or Microsoft sign-in involves the provider selected by the user. User-initiated email or WhatsApp support involves the information the user chooses to send through that channel. These roles are separate from the storage of Lisar's operational database.

The current native Lisar Connect release has no approved analytics SDK, advertising SDK, third-party crash-reporting SDK or diagnostic upload. Lisar discloses information to authorities only where legally required.

8. Retention schedule

• Connection-session metadata: 30 days.
• Usage and quota counters: the current Plan cycle plus 30 days.
• Sanitized technical errors: 30 days.
• Authentication and security events, including login-session IP addresses used to show approximate country and city: 90 days.
• Aggregated non-identifiable operational metrics: up to 12 months.
• Active account, profile and entitlement data: until account/profile deletion or earlier operational expiry.
• Legally required financial records: only for the minimum period required by applicable law, kept separately with restricted access and deleted after the required period expires.

9. Account deletion and privacy requests

Users may request access, correction, deletion or review of their account data by contacting privacy@lisar.io. Information about permanent account deletion is available at lisar.io/account-deletion, which links to the authenticated deletion flow. Permanent deletion revokes sessions and tokens, removes account profiles and operational account data, ends active Plan access and forfeits remaining Plan time or unused service credit. Only legally required financial records may remain for the restricted period described above.

10. Security

Lisar uses access controls, role separation, TLS-protected service endpoints and operational security measures intended to protect account and service data. No internet service can be guaranteed completely secure. Report security concerns to security@lisar.io.

11. Changes to this policy

If Lisar changes the data inventory, retention schedule, approved SDKs, processors or service behavior in a way that affects this policy, the policy and applicable Store privacy declarations must be reviewed and updated before the affected release is submitted or published.

12. Contact

Privacy: privacy@lisar.io. Support: support@lisar.io. Billing: billing@lisar.io. Legal: legal@lisar.io.