Privacy Policy

01 · Who's responsible

Data controller & contact

The data controller is the operator of VpnSherpa, part of the Zpella ApS family of sites (zpella.com). The controller is Zpella ApS, CVR 45113507. You can reach us about privacy at [email protected] or via our contact page.

VpnSherpa is one of several sister sites operated by Zpella ApS. Google Analytics runs on every visit to this domain; optional marketing tags follow the cookie choice made on this domain. Limited first-party referral context may be added to an outbound link so the destination can attribute the visit; the destination and affiliate network then apply their own privacy terms.

02 · What we collect

Data we collect

We aim to collect as little as possible. The categories below are what we may process — including if you contact us:

• Analytics & usage data. On every visit, Google Analytics records the pages you view, the guides you read, approximate session flow, your device and browser details and your approximate location, derived from your IP address, so we can understand and improve the site. It does not wait for a cookie choice.
• Device & connection data. IP address, browser and device type, and similar technical metadata your browser sends with each request. Individual providers may minimise or mask parts of this data under their own configuration and terms.
• Click & outbound data. Which provider click-outs you follow from VpnSherpa, together with limited first-party attribution context needed to operate and measure the referral. A destination provider or affiliate network may process data under its own policy after you leave the site.
• Preferences. Your cookie consent choice and your selected country/region, so the site behaves consistently for you.
• Sherpa chat conversations. If you use the Sherpa chat, your message, selected country/region and up to six recent conversation turns are sent to our AI service provider to generate the reply. The Pages Function does not add a conversation database. Do not include medical records, account credentials or other sensitive personal data.
• Sign-up and consent data. If you subscribe with the email form in the site footer or the sign-up popup, we process your email address and, in the popup, your mobile number and optional first name. Each sign-up also records the consent wording you agreed to, the address of the Terms page it linked to, the channels it covers (email, or email and text) and when it was received; which form you used and the site language; the country indicated by your IP address and the dialling country of your mobile number; and how you first arrived on VpnSherpa: the page you landed on, the referring site, campaign (UTM) tags, ad click IDs and a random visitor ID, as listed in our Cookie Policy. The sign-up endpoint uses your IP address to limit repeated submissions and passes it on with the sign-up.

03 · Why & on what basis

Purposes & legal bases

Under the GDPR (and equivalent laws) we must have a legal basis for each use of your data:

• Consent. For optional marketing storage or tags. You may grant, refuse or withdraw this choice through Cookie settings.
• Legitimate interests. For keeping VpnSherpa secure and available, preventing abuse, operating first-party click-out attribution, measuring how the site is used with Google Analytics on every visit, answering a chat request you initiate, and improving the service in ways balanced against your rights.
• Legal obligation. Where we must retain or disclose limited data to comply with applicable law.
• Consent to sign-up marketing. For marketing emails and, if you gave a mobile number, texts from VpnSherpa and the partner sites listed in our Terms (Partner permissions). You give it by ticking the consent box when you sign up. You can withdraw it at any time with the unsubscribe link in any message or by contacting [email protected]; withdrawal does not affect messages sent before it.
• Legitimate interests in sign-up security. For checking sign-ups for automated abuse with Cloudflare Turnstile and limiting repeated submissions from one IP address.

04 · Who processes it

Processors & recipients

We use a small set of service providers to operate the site. Their role and applicable terms depend on the feature you choose to use:

Provider terms, locations and safeguards can change. We review the configured services and this list as part of each release.

05 · Where it goes

International transfers

Some of our processors — including Cloudflare — operate global infrastructure, so your data may be processed outside your country or the EEA/UK. Depending on the provider, destination and applicable law, transfer safeguards may include an adequacy decision, the European Commission's Standard Contractual Clauses, or the UK Addendum.

06 · How long

Retention

We keep personal data only as long as needed for the purpose it was collected, or as the law requires. Consent and country/region preferences persist until their configured expiry, you change them, or you clear site data. Google Analytics cookies last up to 2 years, and Google keeps the measurement data for the retention period set in our Analytics account. Affiliate providers apply the retention configured for the relevant referral programme. The chat Function does not add a conversation database; infrastructure and AI providers may retain limited request data under their applicable terms. Correspondence is kept only as long as needed to handle the enquiry and reasonable follow-up.

Sign-up data is kept while you remain subscribed, and afterwards only as long as needed to record your consent and its withdrawal or to meet legal obligations. The sign-up storage in your browser lasts as listed in our Cookie Policy.

07 · Your rights

Your rights & how to exercise them

Subject to applicable law, you have the following rights over your personal data:

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete your data where the law allows.
• Restriction — ask us to limit how we use your data.
• Portability — receive certain data in a portable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time, without affecting prior processing.

To exercise any of these, contact us at [email protected]. We'll respond within the timeframe the law requires. You can manage cookie consent yourself at any time via the “Cookie settings” button in the footer. Google Analytics is not switched off there; you can object to it by contacting us, or block it with your browser’s cookie or content-blocking settings.

08 · Minors

Children & minors

VpnSherpa is intended for adults and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with their data, contact us at [email protected] and we will delete it.

09 · Complaints

Right to complain

If you believe we've mishandled your data, you have the right to lodge a complaint with your local data-protection supervisory authority — for example, in the EEA your national authority, and in the UK the Information Commissioner's Office (ICO). We'd appreciate the chance to address your concern first, but that doesn't affect your right to complain.