Quick answer
What personal data does EuroCity Proxies keep?
As of October 2026, EuroCity Proxies keeps an account number, your orders and top-ups, and traffic totals. It keeps connection metadata for up to 30 days to handle abuse and billing disputes. An email address is optional. We do not log the content of your requests, full URLs or page data, and we collect no identity documents.
Who controls your personal data?
The data controller is ProxyGoat LLC, a Delaware limited liability company (USA). For any privacy question or request, write to [email protected].
This policy covers the website https://eurocityproxies.com, the client area, the API and the proxy gateway. It lists every item we keep and why; durations are given where they are fixed.
Which data do we process, for what purpose, and on which legal basis?
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Account number and password | Logging in and running your account | Contract, Art. 6(1)(b) | Account lifetime, then the period accounting rules set |
| Email address (optional) | Account recovery, receipts, replies to your messages | Contract, Art. 6(1)(b) | Until you delete it, or until account closure |
| Orders and top-ups: amount, coin, network, transaction ID, date | Delivery, refunds, accounting, fraud prevention | Contract, Art. 6(1)(b) · accounting duty, Art. 6(1)(c) · fraud prevention as a legitimate interest, Art. 6(1)(f) | Account lifetime, then the period accounting rules set |
| Traffic used, per plan and per sub-user | Showing usage, billing, refund checks | Contract, Art. 6(1)(b) | Account lifetime, then the period accounting rules set |
| Gateway connection records: time, account, exit IP, target hostname and bytes transferred | Answering abuse reports and settling billing disputes | Legitimate interest in handling abuse, Art. 6(1)(f); contract for billing disputes, Art. 6(1)(b) | Deleted after 30 days at most |
| API keys, sub-users and allowlisted IPs | Running the service as you set it up | Contract, Art. 6(1)(b) | Until you delete them or close the account |
| Support and abuse emails | Answering you and handling reports | Contract, Art. 6(1)(b); legitimate interest in handling requests, Art. 6(1)(f) | As long as needed to answer and close the case |
| Records disclosed to an authority | Meeting a legal obligation | Legal obligation, Art. 6(1)(c) | As long as that obligation requires |
How long do we keep data?
We do not log the content of your requests, full URLs or page data. To handle abuse reports and billing disputes, we keep connection metadata (time, account, exit IP, target hostname, bytes) for up to 30 days, then delete it. We keep your account number, orders, top-up records and traffic totals while your account is open, and afterwards only as long as accounting rules require. We disclose records to authorities only when the law requires it. Our upstream network provider may keep its own logs under its own policy.
When an account is closed, we delete the email address, API keys, sub-users and allowlisted IPs. Accounting records stay only as long as accounting rules require.
What do we not collect?
No KYC: no ID, no selfie, no documents to sign up, top up or buy. We do not ask for your name, address or phone number to open an account or buy a plan.
An account works without an email address. If you include personal details in a message, we keep them only as long as needed to answer.
Does the website use cookies or analytics?
The client area uses one session cookie to keep you logged in. It is removed when you log out or when the session ends. No advertising cookies are set on the public pages.
Related rules: the terms of service, the refund policy, the acceptable use policy and the contact page for data requests.
What about crypto payments?
Top-ups are matched by their exact amount and credited once the network confirms them. We see the amount, the coin, the network and the transaction details needed to credit the payment, and no identity documents, since we hold none.
Blockchain transfers are public by design. Anyone who knows your wallet address can see its payments, so choose the wallet you pay from with that in mind.
Who receives your data?
- The payment processor that confirms top-ups: amount and on-chain details only.
- Our upstream network provider, which carries the traffic and may keep its own logs under its own policy.
- Hosting and email providers that run our systems for us, under contract.
- Authorities, only when the law requires it, and only the records we hold.
We do not sell your data and do not share it for advertising.
Is data transferred outside the European Union?
Yes. ProxyGoat LLC is based in the United States, so data about your account is processed outside the European Union. Our upstream network provider and service providers may also process data in other countries.
What are your rights, and how fast do we answer?
Under the GDPR you can ask for access to your data, correction, deletion, restriction of processing and a copy in a portable format. You can object to processing based on legitimate interest. You may also lodge a complaint with your national data protection authority.
Write from the email address on your account; if it has none, give the date, product and amount of a recent order. Never send your account number or password.
We answer without undue delay and within the time limit set by the law that applies to you (one month under the GDPR). Some records, such as accounting records, must be kept even after a deletion request.
How do we protect your account?
Only staff who need the data for support, billing or abuse handling can access it. We never ask for your account number by email or chat. Keep your account number, password and API keys private, and revoke any API key you no longer use.
Can children use the service?
No. The service is for people aged 18 or over, and we do not knowingly keep data about children.
How does this policy change?
We publish each new version on this page with its date and list it in the changelog. If a change reduces your rights or extends a retention period, the changelog says so.