Privacy Policy

At ColdProxy (“we,” “us,” or “our”), we are committed to protecting your privacy. This Privacy Policy explains how Crestlane Systems LLC, the operator of ColdProxy, collects, uses, shares and protects personal data.

The data controller is Crestlane Systems LLC, a Wyoming limited liability company (Wyoming Secretary of State filing ID 2026-002099361), with its registered office and mailing address at 30 N Gould St Ste N, Sheridan, Wyoming 82801, United States. For privacy questions, requests or complaints, open a support ticket in the client area or email [email protected].

This policy applies to all services provided by ColdProxy and governs any information collected from individuals (“you” or “users”) who visit our website or use our proxy services. It does not apply to third-party websites, services, or applications, even if accessed through our proxy network.

This section covers the client area and the proxy service. Cookies are covered in section 4.

Your account and orders

When you register and use the client area at members.coldproxy.com, we collect:

• the contact details you give us, such as your name, email address and postal address;
• your orders, invoices, payments and account credit;
• your support tickets and our replies;
• the IP address you use when you sign in or place an order;
• your service settings, such as proxy usernames and passwords, and any IP addresses you allow to use a service.

We use this data to run your account, to provide and bill your services, to answer your support requests, and to keep the service secure. The registration and order forms show which details are required. Without them we cannot open an account or take an order.

We send you emails about your account, orders and services. We send marketing emails only if you opt in.

Payments

You can pay by card or cryptocurrency using the payment methods available at checkout.

Your payment information is processed by the relevant payment provider. We do not receive or store your full card number. The payment provider may also process your data for purposes such as fraud prevention, payment processing and compliance with legal obligations, in accordance with its own privacy policy.

We receive the payment status and other information necessary to process the payment and match it to your invoice.

No traffic logs

We do not keep logs of the websites you visit through our proxy service, the content of your proxy traffic, or which of our IP addresses each connection used.

To carry a connection, our servers process the IP address it comes from, your service credentials and the address you want to reach. A sticky session may also need a temporary link that keeps it on the same IP address. We delete that link after the session ends.

We do keep:

• your service settings, including any IP addresses you allow to use a service;
• how much data each service uses, for billing and plan limits;
• security records. To stop password guessing and similar abuse, we may block an IP address when it makes many failed sign-in attempts or invalid requests. We record the IP address and details of the block, never the websites you visit.

Our free tools

Our free tools, such as "What is my IP" and the proxy checker, send each request to our servers, and we use it only to produce the result you see. The IPv6 checker runs in your browser. Your browser sends the hostname you enter to Google Public DNS and Cloudflare DNS. They also receive your IP address, and may log both under their own privacy policies.

How long we keep data

• Account and service data: while your account is open. After you close your account, we retain relevant data for up to 6 years where necessary for legal claims or other legitimate purposes. We then delete or anonymise it, except for records the law requires us to keep longer.
• Accounting records, including invoices: 6 years from the end of the financial year they relate to, or longer where the law requires it.
• Support tickets: as long as your account data.
• Data-use totals: with the service's account data.
• Security records: only as long as we need them to protect our services.
• Cookies and the record of your cookie choice: see section 4.

You can ask us to delete your data. We answer without undue delay and normally within one month. If the law allows us more time, or requires us to keep something, we tell you why.

Automated decisions

Some decisions are made automatically. For example, a service can be suspended or ended when its invoice is unpaid or its paid time runs out. You can ask a person to review such a decision, give your view and challenge it.

This section covers coldproxy.com and our client area at members.coldproxy.com. It explains:

• the cookies and similar technologies we use;
• the data they collect;
• who receives it;
• how long we keep it.

Your choice

If you are in the European Economic Area, the United Kingdom, Switzerland or a related territory, or if we cannot tell where you are, we ask before we use analytics or advertising cookies. You can accept all, reject all, or choose Analytics and Advertising separately. You can use our sites whatever you choose.

To decide whether to ask, our content delivery network provider tells us which country your connection appears to come from, based on its IP address. The cp_geo cookie stores, for 1 day, only whether we need to ask you. It does not hold your country or IP address. If you use a VPN or proxy, the check sees that connection's country.

Outside those regions

• Analytics and advertising cookies are on by default where applicable law allows this. You can turn them off at any time in “Cookie settings”.
• If your browser sends a Global Privacy Control signal, we treat it as a refusal of Advertising where applicable.
• A refusal stays in place for as long as your browser keeps our cookie, up to 13 months.

How long your choice lasts

• Your choice applies to both coldproxy.com and members.coldproxy.com, in this browser.
• Where we ask, we ask again after 6 months. If we change how we use this data, we ask again about anything you allowed. Until you answer, anything you refused stays off.
• Where we ask, we also ask again if you clear your cookies or use another browser or device.
• You can change your Analytics and Advertising choice at any time with the "Cookie settings" link at the bottom of every page. For anything else, such as marketing emails or other objections, contact us.
• Withdrawing consent does not affect the lawfulness of what we did with it before you withdrew it. When you withdraw consent for Analytics or Advertising, our sites stop setting that purpose's cookies, and delete the ones they can reach in your browser. You can remove Google's cookies on its domains, such as IDE, through your browser settings. You can also ask us to delete the data we collected with that consent. We then delete what we can link to you, and ask Google to do the same.

Necessary cookies and storage

Cookie settings does not control these, except where this list says so. Some are needed for the sites and the client area to work. Others remember a feature or a preference you chose.

• cp_consent remembers your cookie choice for up to 13 months. It holds a random identifier, your choice, when you made it, the version of this policy, and whether you chose from outside the regions where we ask.
• If you create an account or place an order where analytics or advertising is on by default, cp_consent can hold only the random identifier, for 6 months. That lets us stop measuring the order if you later turn them off.
• cp_consent_ack records that our server has received your latest choice, so neither site sends it again. It lasts up to 13 months and does not make your choice last longer.
• cp_consent_last keeps a copy of your newest choice until you close your browser, so a slow reply from our server cannot bring back an older choice.
• cp_geo stores, for 1 day, whether we need to ask you.
• cp_promo keeps a promo code from a link you followed, so the cart can apply it. It is deleted when you close your browser. If Advertising is allowed during the visit in which you followed the link, it is kept for 30 days instead. If you turn Advertising off later, it is again deleted when you close your browser.
• The client area uses a session cookie to keep you signed in and to hold your cart. It is deleted when you close your browser.
• If you tick "Remember me" when you sign in, a cookie keeps you signed in for up to a year or until you sign out.
• While you write a support ticket, your browser keeps the draft until you send it or clear your browser's storage.
• When you are signed out, the sign-in, registration, password reset and support ticket forms use reCAPTCHA, a Google service, to block automated abuse. reCAPTCHA may set a _GRECAPTCHA cookie and store similar data in your browser, and it sends Google information about your device and how you use the page, including your IP address. Under Google's cloud terms, Google processes the reCAPTCHA data it receives on our behalf, for security.
• On card payment pages, Stripe sets fraud-prevention cookies for up to a year.
• Your light or dark theme, and a closed promotion banner, are remembered in your browser's storage until you clear it. In the client area, your browser also remembers how you set out tables until you clear its storage, and a closed notification bar until you close the tab.

Analytics (optional)

When Analytics is allowed, we use Google Analytics 4 to see which pages people visit and which purchases they make, so we can improve the site. This uses the following cookies:

• _ga and _ga_3NWMEWXSXW, Google Analytics cookies that tell visits from the same browser apart. They last up to 2 years, and your browser may delete them sooner.
• cp_attrib, our own cookie, which records how you first reached us, for 90 days after it was last updated: the campaign details in the link, the website you came from, the first page you opened, and the date.

Sign-up and purchase events

When you create an account, or when an invoice of yours is paid, our server sends Google Analytics a sign-up event or a purchase event, but only if Analytics is allowed for you. We no longer send purchase events for orders placed before these controls started on 30 September 2026.

• A sign-up event holds your browser's Google Analytics identifiers, and no contact details.
• A purchase event holds the invoice number, the amount, the currency, and the item descriptions and prices from your invoice.
• We never send Google your name, your email address, or your card or payment account details.
• A sign-up event is sent at once. We do not keep your Google Analytics identifiers or the cp_attrib details with the account.
• For a purchase event, we keep them in an order measurement record until the invoice is paid. If Analytics is still allowed then, we send the event, and either way we then delete them. Where we ask for consent, we do not send the event for an order recorded under an earlier version of this policy, even if you allow Analytics again. A record whose event is never sent, for example because the invoice is never paid, is deleted after 24 months. Deleting it does not delete the invoice or the order, which we keep as described in "How long we keep data".

Retention. Google Analytics retains user-level and event-level data according to the retention settings configured for our property, for up to 14 months. Standard aggregated reports may remain available for longer.

Trustpilot. When Analytics is allowed, we also show the Trustpilot rating widget, which Trustpilot loads from its own servers. Trustpilot then receives your IP address and browser details. Otherwise we show a plain link to our Trustpilot page.

Advertising (optional)

When Advertising is allowed, we use Google Ads to measure which ad clicks lead to purchases, and Google can show ColdProxy ads on other websites and apps to people who visited our sites. Third-party vendors, including Google, use cookies to show ads based on your earlier visits to our sites. This uses:

• Google Ads cookies whose names begin with _gcl_ or _gac_, which last 90 days;
• Google Ads data in your browser's storage;
• Google's IDE cookie on doubleclick.net, which lasts 13 months in the EEA, Switzerland and the UK, and 24 months elsewhere.

Google can also use your IP address to measure ads. If Analytics is also allowed, cp_attrib keeps the Google ad click identifier from the link you followed. When Advertising is allowed at the time you sign up or order, Google Ads can use that event to measure our ads.

You can turn off personalised ads from Google at https://adssettings.google.com. You can refuse Advertising on our sites in "Cookie settings".

Partner referrals

When you follow a partner’s referral link, our client area may set a cookie that records the referring partner so eligible orders can be credited to them.

Where consent is required, this referral cookie is used only when Advertising is allowed. It is kept for up to 3 months. You can delete it through your browser settings, although deleting the cookie does not undo a referral that has already been recorded.

The partner may see the orders credited to them.

If you do not allow these cookies

In the European Economic Area, the United Kingdom, Switzerland and other locations where prior consent is required, or where we cannot determine your region, no Google tag loads until you allow Analytics or Advertising.

The Google tag can still send Google a small amount of information without cookies, each time a page loads, for any purpose you have not allowed. This happens:

• where we ask, once you allow Analytics or Advertising and the tag loads;
• outside those regions.

The information can include:

• the time;
• your browser type;
• the page you came from;
• whether you arrived from an ad;
• your cookie choice;
• a random number created for each page load;
• which consent tool the site uses.

Your IP address reaches Google with each request. Google uses this to estimate total visits and conversions for us. Necessary cookies and storage stay on.

Record of your choice

When you make or change a choice, we keep a record as evidence of what you chose, for 24 months after our server receives it. The record holds:

• a random identifier;
• your choices, and which button you used;
• the versions of this policy and of the cookie banner you saw;
• the time;
• which of our two sites you used;
• whether your connection appeared to be outside the regions where we ask;
• your country, as estimated from your connection.

We do not store your IP address or browser details in this record. The identifier can link the record to an account or an order made in the same browser. Order measurement records follow the rules under "Sign-up and purchase events".

• Accounts, orders and services: our contract with you, or steps you ask us to take before one.
• Contacts at business customers: our legitimate interests in managing the relationship, where the contract is with your organisation.
• Support: our contract with you when the request is about your service, and otherwise our legitimate interests in answering you.
• Security and fraud prevention, including reCAPTCHA and blocking password guessing: our legitimate interests in protecting our customers, accounts and services.
• Accounting records and disclosures the law requires: our legal obligations.
• Signing in, your cart and support ticket drafts: our contract with you.
• Remembering your theme, a closed promotion banner and similar display choices: our legitimate interests in keeping the preferences you chose.
• Analytics and Advertising, where we ask: your consent. You can withdraw it at any time in "Cookie settings".
• Analytics and Advertising, where prior consent is not required under applicable law: our legitimate interests in measuring, improving and promoting our services, provided those interests are not overridden by your rights and interests. You can object at any time or change your choices in “Cookie settings”. If we process your personal data for direct marketing purposes, including profiling related to direct marketing, your right to object is absolute and we will stop processing it for that purpose.
• The record of your choice: our legal obligation to be able to show your consent, and our legitimate interests in respecting your refusals and objections.
• Referral commission records: our legitimate interests in working out and paying what we owe the partner who referred you.
• Marketing emails: your consent. You can opt out at any time.
• Privacy requests and complaints: our legal obligations.

You can object to any use based on our legitimate interests. We then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. If you object to direct marketing, including profiling for direct marketing, we always stop.

We share relevant personal data with:

• Google, for Google Analytics, Google Ads and reCAPTCHA. Google may also use Google Analytics data to improve its own products and services. Google explains how it uses information from sites that use its services at https://business.safety.google/privacy/.
• Trustpilot, only when Analytics is allowed.
• Our content delivery network provider, which delivers and protects our sites and runs the region check.
• Network and hosting providers that carry traffic and host our services.
• Google Public DNS and Cloudflare DNS, when you use the IPv6 checker.
• The payment provider you choose at checkout, as described in "Payments".
• Courts, the police or regulators, when the law requires us to share data, for example under a valid court order.

Some providers act only on our instructions. Others also decide their own uses, such as payment compliance or fraud prevention, and their privacy policies explain them. You can ask us which recipients received your personal data.

If you sign in to the client area with Google, Facebook, GitHub, Yahoo or Discord, that provider receives what it needs for the sign-in, under its own privacy policy.

Some of the providers named above, including our payment providers, process personal data outside the UK, mainly in the United States, the European Union and Canada. For these transfers we rely on UK adequacy regulations, which cover the European Union and commercial organisations in Canada that its federal privacy law covers; on the UK Extension to the EU-US Data Privacy Framework, for US recipients certified under it; or, where neither applies, on the UK's standard transfer terms (the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses). You can ask us which of these applies to a recipient, and for a copy of the safeguards.

We use appropriate technical and organisational measures to protect personal data against unauthorised or unlawful access, use, change, disclosure, loss or destruction. We review them in line with the risks.

Depending on the circumstances, you can ask us to:

• give you a copy of your personal data;
• correct it if it is wrong or incomplete;
• delete it;
• restrict how we use it;
• send it to you, or where possible straight to another organisation, in a common machine-readable format.

You can also object to our use of your data, as section 5 explains. Some of these rights apply only in certain cases. If one does not apply to your request, we tell you why.

You can withdraw consent for Analytics and Advertising, or object to them, at any time in "Cookie settings". For other objections, and to stop marketing emails, contact us.

To make a request or a complaint, open a support ticket in the client area or email [email protected]. We answer requests without undue delay and normally within one month. We acknowledge complaints within 30 days, look into them without undue delay, keep you updated, and tell you the outcome.

You can also complain to:

• for processing covered by UK data protection law, the Information Commission's Office, at ico.org.uk;
• if you are in the EEA, the data protection authority where you live or work, or where you think the breach happened;
• if you are in Switzerland, the Federal Data Protection and Information Commissioner.

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us so we can look into it and, where appropriate, delete it.

We may update this Privacy Policy to reflect changes in our services, our practices or the law. We post each update on this page with a new “Last Updated” date. Where the law requires it, we tell you before a material change takes effect, or ask for your consent again.

If you have any questions or concerns about this Privacy Policy, or believe we may have collected your information in error, open a support ticket in the client area or email [email protected]. Section 9 explains how to make a request or a complaint, and where else you can complain.