Privacy Policy

PROSOX LLC · Effective date: October 26, 2026 · Last updated: October 26, 2026

1. Scope and Company Information

This Privacy Policy describes how PROSOX LLC, a limited liability company registered in Delaware, United States (“Prosox,” “we,” “us”), processes personal data in connection with prosox.io, customer accounts, proxy infrastructure, data collection services, APIs, Datasets, payments, support and compliance. It covers visitors, prospective and existing customers, their representatives and authorized users, persons who submit complaints or requests to us, and people who contact us. A separate Data Processing Agreement (“DPA”) may be required where we process data on a customer’s behalf. Capitalized terms not defined in this Policy, such as “Services,” “Proxy Services,” “Managed Data Services,” “API Services,” “Datasets,” “Traffic,” and “Upstream Supplier,” have the meanings given in Section 2.1 of the Terms of Service.

Individuals and legal entities in different countries may use the Services. Whether mandatory data protection requirements apply depends on the processing activities and applicable law, not solely on a user’s nationality or Prosox’s place of incorporation.

We serve customers in various jurisdictions, including the United States and CIS countries. Our processing is subject to the mandatory personal data, consumer protection and cross-border transfer requirements that apply to our activities. Particular operations may be subject to localization, notice, consent, security and data subject rights requirements. The choice of law in our Terms of Service does not override non-waivable statutory protections.

2. Controller and Processor Roles

Prosox’s status as controller, processor or service provider is determined for each processing activity by its actual characteristics and applicable law. Contractual liability limitations and allocations of responsibility in the Terms of Service do not release Prosox from its own mandatory data protection obligations. Where processing on a customer’s behalf requires a DPA, the parties execute it before that processing begins.

For registration, payments, fraud prevention, service administration, security and our own legal compliance, Prosox generally determines the purposes and means of processing independently and acts as a controller (or “business”). For data processed solely on a customer’s documented instructions, the parties’ roles depend on the circumstances and applicable law: Prosox may act as processor (or “service provider” or “contractor”) and the customer as controller. The parties enter into a DPA where required. Mere transmission of network traffic does not mean Prosox determines the purposes of all data collection conducted by the customer.

The intended allocation of roles for each type of Service is as follows, as further described in Section 6.3 of the Acceptable Use Policy (AUP) and Section 11 of the Terms of Service:

(a) for Proxy Services, the customer controls any personal data contained in its Traffic, and Prosox processes such data only transiently to transmit it;
(b) for Managed Data Services, the customer is the controller and Prosox acts as processor or service provider under a DPA, unless an Order or DPA provides otherwise;
(c) for Datasets that contain personal data, Prosox acts as an independent controller for their compilation and the customer acts as an independent controller for its receipt and use;
(d) for API Services, the role depends on the Service to which the API provides access. Joint controllership arises only where the parties in fact jointly determine the purposes and means of processing.

Joint controllership arises only where the parties in fact jointly determine the purposes and means of processing.

Where we act as a processor or service provider for a customer, this Policy does not describe that customer’s processing. Individuals should consult the customer’s privacy notice and direct their requests to the customer.

3. Categories of Personal Data

We may process:

(a) registration and contact details, company information and authorized-user details, including messenger usernames where you contact us or obtain Services through messaging channels such as Telegram;
(b) payment status, invoices, transaction identifiers and payment information, but not full card numbers where those are processed exclusively by a payment provider;
(c) support requests and contractual communications;
(d) identity, ownership, beneficial-owner and sanctions-screening information under KYC/KYB, which may include government-issued identification documents;
(e) IP addresses, device and browser information, cookies, diagnostic data and website usage events;
(f) technical proxy metadata needed for authentication, billing, network protection and abuse response, as described in Section 6;
(g) information contained in abuse complaints, copyright notices, governmental and legal requests and related correspondence, including the contact details of complainants;
(h) where Prosox offers Datasets, personal data contained in them, as described in Section 6.

The precise data varies by Service.

These categories reflect information associated with registration, payments, customer verification, website use, complaint handling and network operations. Not every category is collected for every individual or Service. Prosox does not collect biometric data, such as fingerprints, facial-recognition templates, voiceprints or iris scans, including for customer verification. This statement concerns Prosox’s own processing; independent third parties, such as payment providers, are responsible for their own practices under their own privacy notices. Do not submit sensitive personal data unless expressly requested through an authorized secure channel.

Providing registration, payment and verification information is a contractual requirement and, for verification, may be a legal requirement. If it is not provided, we may be unable to open an account, activate Services or continue providing them.

4. Sources of Data

We obtain information from you, your organization, authorized users, your use of the Services and of our website, messaging channels and bots (such as Telegram), payment and infrastructure partners (including Upstream Suppliers), security vendors, complainants and authorities, and lawful public and commercial verification sources. Personal data contained in Datasets is obtained from the sources described in Section 6. Not every category is collected about every individual.

5. Purposes and Legal Bases

We use data to register and perform contracts, authenticate users, process and account for payments, provide support, secure our network, prevent fraud and prohibited use, conduct sanctions checks, comply with law, improve Services, protect rights and send legitimate service notices. Marketing follows applicable consent and opt-out rules. Where EU or UK GDPR applies, legal bases may include performance of a contract, legal obligation, legitimate interests subject to balancing, and consent where required. Withdrawal of consent does not affect the lawfulness of prior processing.

Where EU or UK GDPR applies, we generally rely on the following legal bases:

(a) performance of a contract or steps before entering into one, for registration, account administration, provision of the Services, billing and support where the individual is our customer (Article 6(1)(b)); where we process the data of representatives, employees or authorized users of a corporate customer, who are not themselves parties to the contract, we rely instead on our legitimate interest in administering the business relationship with that customer (Article 6(1)(f));
(b) compliance with legal obligations, for tax and accounting records, sanctions compliance where legally required, and responses to binding legal process (Article 6(1)(c));
(c) legitimate interests, for network and information security, fraud and abuse prevention, risk-based customer verification beyond legal requirements, handling of complaints, enforcement of the Terms of Service and AUP, establishment and defense of legal claims, service improvement and, where Datasets contain personal data, their compilation (Article 6(1)(f));
(d) consent, for non-essential cookies and for marketing where consent is required (Article 6(1)(a)).

Where we rely on legitimate interests, our interests are those just described, and information about the balancing test is available on request at privacy@prosox.io.

Automated indicators may be used to detect fraud and abuse and protect accounts and infrastructure. Processing sensitive data and automated decisions producing legal or similarly significant effects are subject to mandatory notice, consent, assessment and opt-out requirements. If an account, transaction or Order is declined or restricted solely on the basis of automated processing with legal or similarly significant effects, the affected individual may request human review, express their point of view and contest the decision by writing to privacy@prosox.io, where applicable law provides that right. Requests may be sent to privacy@prosox.io.

6. Proxy Traffic, Logs, Managed Data Services and Datasets

The Terms of Service do not set a universal retention period for network logs and do not imply that Prosox records the contents of every connection. Specific log categories and retention periods depend on actual configurations, documented purposes, supplier agreements and mandatory legal requirements. A customer’s deletion request does not override a lawful obligation to preserve particular records.

In providing proxy and data collection Services, we may process account and session identifiers, connection times, proxy endpoints, traffic volumes and security signals, and, to the extent technically processed to route Traffic or enforce the AUP, destination host names or IP addresses and ports. As described in Section 11.2 of the AUP, Prosox does not, as a general practice, inspect or record the content of Traffic. Records may be held by Prosox or independent infrastructure providers, depending on their roles and configurations. We do not guarantee no logging, complete anonymity or retention of the contents of all traffic. Existing records may be preserved on lawful grounds in connection with incidents, disputes or legal obligations.

Upstream Suppliers may process connection data relating to Traffic routed through their infrastructure under their own terms and privacy notices, in some cases as independent controllers. To the extent an Upstream Supplier acts as an independent controller, it is responsible for its own processing. Where an Upstream Supplier processes personal data on our behalf as our processor, we remain responsible for that processing as required by applicable law. Nothing in this paragraph limits our own obligations under applicable law. Where an individual’s request concerns records held only by an Upstream Supplier, we will, where appropriate and lawful, inform the individual of that fact or forward the request.

When we provide Managed Data Services, we process personal data collected on the customer’s instructions as a processor or service provider under the applicable DPA. The customer, as controller, is responsible for the lawfulness of that collection and for providing notices to the individuals concerned.

Where Prosox offers Datasets that contain personal data, the sources and categories of personal data depend on the Dataset and are described in the documentation for the relevant Dataset; they may include information made publicly available online, such as names, professional details or publicly posted content. Where the GDPR or UK GDPR applies, we rely on legitimate interests (Article 6(1)(f)) only where, for the particular Dataset, our interest in providing structured web data to verified business customers is not overridden by the interests, rights and freedoms of the individuals concerned. We assess this before compiling the Dataset, taking into account the nature and source of the data, the context in which it was made public, the reasonable expectations of the individuals, and the safeguards applied. We do not compile a Dataset containing personal data where that assessment is not favorable, and we do not intend to include sensitive personal data or data relating to children. Datasets are made available only to customers who have completed verification under Section 5 of the Terms of Service and are bound by the license restrictions in Section 15.6 of the Terms of Service, which require customers to ensure that their own use and any onward disclosure are lawful.

Individuals may object to the inclusion of their personal data in a Dataset or request its deletion by writing to privacy@prosox.io, and we will exclude their data from future versions of the Dataset unless applicable law permits us to continue. Where individual notice is required by Article 14 of the GDPR, we provide it unless an exception under Article 14(5) applies. We rely on the exception for impossibility or disproportionate effort under Article 14(5)(b) only after assessing, for the particular Dataset, that its conditions are met, and in that case we apply appropriate safeguards, including publishing the information in this Section, data minimization, and honoring objections and deletion requests.

7. Cookies and Analytics

We use cookies and similar technologies that are necessary for authentication, security and core website functions. We also use analytics and advertising technologies, including Google Analytics, Meta Pixel and Yandex Metrica, to measure website use and the effectiveness of advertising. The providers of these technologies may receive device identifiers, IP addresses and website usage data and may process them in other countries, including the United States and the Russian Federation, as further described in our Cookie Policy. Where applicable law requires consent for non-essential cookies, we request it before setting them, and you may withdraw consent or opt out at any time through our cookie settings, your browser settings or the providers’ opt-out tools. We honor browser privacy signals, such as Global Privacy Control, where required by law.

At or before collection, we provide additional notices, consent options and opt-out mechanisms where required by applicable law and the collection method. The categories, purposes, recipients and retention periods described here depend on the Service actually used.

8. Disclosures and Government Requests

Except where applicable law requires or permits immediate action, such as in an emergency involving danger of death or serious physical injury, disclosure in response to a government request occurs only after verifying authenticity, authority, jurisdiction and legal basis, and assessing scope, to the extent permitted by law. Prosox may require proper process, seek clarification, narrow or challenge a request. A customer is notified only where lawful, practicable and appropriate; notification is not guaranteed.

Data may be disclosed to:

hosting providers;
network and upstream proxy suppliers (including information reasonably necessary to handle abuse complaints, as described in Section 10.4 of the AUP);
payment organizations;
identity, sanctions and fraud-screening services;
support, communications, analytics and advertising vendors (including the providers named in Section 7);
advisers;
parties to a bona fide corporate transaction subject to appropriate safeguards.

Data may also be disclosed to the National Center for Missing & Exploited Children where required by law, and to authorities where disclosure is required or permitted by law. Information about a customer is not disclosed to a private complainant solely on the basis of the complainant’s request. Government requests are evaluated under applicable law, authority, scope and restrictions, except where immediate action is legally required. A request from a foreign authority does not, by itself, automatically create an enforceable U.S.-law disclosure obligation. Only necessary information is shared for abuse investigations.

Disclosures are limited by applicable law, including the Stored Communications Act (18 U.S.C. §§ 2701–2713) where it applies, and by contractual obligations. Foreign government requests are assessed for authenticity, jurisdiction, legal basis, scope and restrictions, and any resulting cross-border transfer complies with Section 9. Where permissible, Prosox may seek clarification, narrow or challenge a request. Customer notice may be withheld if prohibited or if it would interfere with a lawful investigation. Prosox can respond only with respect to data in its possession, custody or control. The procedure for governmental and legal requests is described in more detail in Section 12 of the AUP.

9. International Data Transfers

Personal data may be processed in the United States and other countries where our authorized providers operate. Where applicable law restricts international transfers, we transfer relevant data only on a legally permitted basis or using a recognized safeguard. Depending on the circumstances, these may include standard contractual clauses, adequacy decisions or other lawful mechanisms. Mandatory localization requirements and special restrictions are observed where applicable. Analytics and advertising providers described in Section 7 may process data in the countries indicated there. Individuals may request information about the safeguard used for a particular transfer, and a copy of it where applicable law provides that right, by writing to privacy@prosox.io.

10. Retention and Deletion

After Services end, data is deleted, de-identified or retained in accordance with applicable law, legitimate purposes, the Order and any executed DPA. Termination of a contract does not by itself require immediate deletion of accounting, payment, compliance or security records.

We retain personal data only for as long as reasonably necessary for the relevant purpose, taking into account mandatory retention periods and preservation obligations. Retention criteria vary by category:

(a) account and profile data are held during the customer relationship and afterward only for account closure, defense of legal claims, fraud prevention or legal compliance;
(b) invoices, payments and transaction records are retained for applicable tax, accounting, audit and claims periods;
(c) identity documents, KYC/KYB and sanctions screening records are retained for applicable verification, compliance and documented risk-management purposes, and records subject to the recordkeeping requirements of the U.S. Office of Foreign Assets Control are retained for the period those requirements prescribe;
(d) support correspondence and contractual records are retained for the relationship and legitimate follow-up or disputes;
(e) technical network metadata and security logs are retained according to actual configurations, operational needs, incident investigation, applicable law and relevant provider arrangements;
(f) cookies are retained according to their type, purpose and the Cookie Policy;
(g) complaint, notice and legal-request records are retained for as long as needed to handle the matter, to document our response and to establish or defend legal claims;
(h) personal data in Datasets is retained only for as long as needed for the purposes of the Dataset and is removed following a justified objection or deletion request;
(i) records of security incidents and personal data breaches are retained for as long as needed to investigate and remediate the incident, to document it as required by law (including under Article 33(5) of the GDPR where it applies), and to establish or defend legal claims.

Unless a different starting point applies by law, retention periods run from the end of the relevant relationship, transaction or matter. Where a legal hold, investigation, dispute or legally required preservation (including preservation required by 18 U.S.C. § 2258A(h) or 18 U.S.C. § 2703(f)) applies, relevant records may be preserved longer. Deleted data may persist in backups for a limited period until overwritten in the ordinary course, during which it is not used for other purposes. Records held by Upstream Suppliers are subject to their own retention practices. We do not promise a universal fixed retention period or assert that all traffic content is recorded.

11. Security

We use administrative, technical and organizational safeguards appropriate to the risks, which may include access controls, authentication, encryption in transit, vendor assessment, monitoring and incident response. Absolute security cannot be guaranteed. Customers must protect their credentials, API keys and user access.

12. Data Subject Rights and Appeals

Depending on jurisdiction and statutory exceptions, individuals may request access, correction, deletion, portability or restriction, object to processing or withdraw consent. Requests should be sent to privacy@prosox.io. We may verify identity and authority, seek clarification, deny requests where law permits, and respond within applicable deadlines. If Prosox acts only as a processor, a request may be referred to the relevant customer-controller.

Response deadlines depend on the applicable law; for example, the GDPR and UK GDPR generally require a response within one month, extendable by two further months where necessary, and U.S. state privacy laws generally require a response within 45 days, extendable where permitted. An authorized agent may submit a request on an individual’s behalf where applicable law permits, subject to verification of the agent’s authority. Where we must retain data despite a deletion request, for example to comply with a legal obligation or to establish or defend legal claims, we restrict its use to those purposes and explain this in our response. Where we have disclosed personal data to processors acting on our behalf, we communicate rectification, erasure and restriction to them where required by law.

Right to object. Where we process personal data on the basis of legitimate interests, individuals in the EEA and the United Kingdom have the right to object at any time, on grounds relating to their particular situation, and we will stop unless we demonstrate compelling legitimate grounds or need the data to establish, exercise or defend legal claims. Individuals may object to direct marketing at any time, without giving reasons, and we will then stop using their data for that purpose.

To appeal a denial, email privacy@prosox.io with “Privacy Appeal” in the subject line and identify the original request. Where Delaware law applies, we provide a written appeal decision within 60 days; if denied, we explain how to contact the Delaware Department of Justice. Other jurisdictions’ deadlines and remedies apply as relevant.

13. Rights Under U.S. State Laws

Where the Delaware Personal Data Privacy Act applies to particular processing, Delaware residents may request confirmation and access, correction, deletion, a portable copy, information about categories of recipients, and opt out of covered sales of personal data, targeted advertising and certain profiling. California and other states’ residents have rights under applicable laws, subject to exceptions. Requests and appeals may be sent to privacy@prosox.io; we respond within legally required periods after any necessary verification. We do not discriminate against individuals for exercising their rights.

Если применяется Закон Калифорнии о защите прав потребителей на неприкосновенность частной жизни (CCPA), жители Калифорнии вправе с учётом установленных законом исключений запросить сведения о категориях и конкретных сведениях о себе, которые мы собрали, о категориях источников, деловых или коммерческих целях и категориях третьих лиц, которым они были раскрыты; потребовать удаления и исправления; отказаться от любой продажи или передачи (sharing) персональной информации. Категории собираемой нами персональной информации указаны в разделе 3, источники — в разделе 4, цели — в разделе 5, категории получателей — в разделе 8, сроки хранения — в разделе 10. Чувствительную персональную информацию, например номера документов, удостоверяющих личность, собираемые для проверки, мы используем только в целях, разрешённых регламентом CCPA. Использование нами рекламных технологий, например Meta Pixel, может считаться передачей (sharing) персональной информации для межконтекстной поведенческой рекламы в значении CCPA, а Наборы данных, не исключённые из сферы закона как публично доступная информация, могут считаться её продажей (sale). Если применяется CCPA, жители Калифорнии вправе отказаться от такой продажи или передачи, включив сигнал Global Privacy Control или написав на privacy@prosox.io; мы предоставим и иные механизмы отказа, которых требует CCPA.

14. EEA, United Kingdom and Other Jurisdictions

Where EU or UK GDPR applies, individuals may have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent, and may lodge complaints with a supervisory authority, in particular in the country of their habitual residence, place of work or place of the alleged infringement. Depending on purpose, processing may rely on contract performance, legal obligation, legitimate interests or consent, as described in Section 5. Further details about legal bases, transfers, representatives and contacts are provided where required by law.

15. Children

Paid Services are intended for adults aged 18 or over. We do not knowingly solicit or collect personal data from children when registering accounts. If we learn that a child’s data was collected unlawfully, we will take steps required by applicable law, including deletion where required.

16. Security Incidents

We investigate suspected personal data security breaches and notify regulators, customers and individuals when and within the time limits required by applicable law and agreements. Not every technical incident automatically triggers a notification obligation. Where we act as a processor, we notify the affected customer-controller without undue delay after becoming aware of a breach affecting its data, as required by applicable law and the DPA. Where an incident occurs at an Upstream Supplier or other provider, our assessment and any notification depend on when and what we learn from that provider.

17. Changes and Related Documents

For consistency, related documents use the names in the Terms of Service: Terms of Service, Acceptable Use Policy (AUP), Cookie Policy, Refund and Cancellation Policy, and KYC/KYB Policy. Mandatory data protection laws prevail. An executed DPA governs processing on a customer’s behalf within its scope; this Privacy Policy provides public notice of actual processing and is not a contract, except to the extent applicable law requires otherwise; and the Terms of Service govern general contractual obligations. Nothing here automatically expands the data Prosox actually collects.

We may update this Policy as Services, processing practices or laws change, by publishing the updated version and updating the “Last updated” date. Registered customers receive notice of material changes as provided in Section 21 of the Terms of Service, and other individuals receive notice where required by law. Where a change requires consent under applicable law, we will obtain it before applying the change. The allocation of subject matter among these documents and the order of precedence are set out in Sections 3.2 and 3.3 of the Terms of Service. Mentioning a DPA does not itself create one. Mandatory legal provisions prevail in the event of conflict. Contractual disputes with customers are resolved as provided in Section 20 of the Terms of Service; nothing in that Section or in this Policy limits any individual’s right to lodge a complaint with a supervisory authority or to seek a judicial remedy under applicable data protection law.

The English version of this Policy is the official version. Any translation is provided for convenience only, and in the event of any inconsistency the English version prevails, except where mandatory applicable law requires otherwise.

18. Contact Information

PROSOX LLC, 16192 Coastal Highway, Lewes, Delaware 19958, County of Sussex, United States.
Web-site: https://prosox.io.
Privacy requests: privacy@prosox.io.
General inquiries: info@prosox.io.
Support: support@prosox.io.
Abuse and intellectual-property reports: abuse@prosox.io.