Privacy Policy

1.1. The controller of the personal data of Users of the Maximum VPN service (hereinafter, the “Service”) is Sirius LTD (registration number 515230530, hereinafter, the “Company”, “we”, “us”), registered at the following address: גרוב יוסף 90, דירה 6, באר שבע, ישראל.

1.2. This Policy constitutes a mandatory disclosure in accordance with applicable personal data protection legislation.

1.3. All questions and requests shall be sent to support@maximum-vpn.com.

1.4. The Terms of Service are published separately at maximum-vpn.com/terms-of-service.

3.1. To provide the Service, the Company processes the following categories of data:

3.2. The Company does NOT collect: first name, last name, date of birth, telephone number, home address, government identifiers (passport, taxpayer identification number (INN), SSN), or biometric data.

3.3. Infrastructure Management. The Company uses automated systems (including AI-based load balancers) operating on on-premises servers within the jurisdictions of the State of Israel and the European Union. No operational data are transferred to external AI providers. These systems operate solely on technical parameters and do not analyze traffic content, DNS queries or Users’ personal data for commercial purposes.

3.4. Decisions Producing Legal or Similarly Significant Effects. With respect to the blocking, suspension or other restriction of an account (including in cases of reasonable suspicion of abuse, fraud or violation of the ToS), the Company applies a mixed procedure:

• an automated anti-abuse system may flag the account and impose a temporary technical restriction of access in order to protect the Service and other Users;
• the final decision on restricting or restoring access is made by an authorized employee based on a review of the available technical data and context.

3.5. The Company does not make fully automated decisions concerning Users. A User in respect of whom a decision to restrict access has been made has the right to:

• receive an explanation of the reasons for the decision;
• contest the decision and submit their own explanations;
• request that the decision be reviewed by another authorized employee who was not involved in the initial assessment.

4.1. The Company retains personal data only for as long as necessary for the processing purposes set out in §3. The specific retention period is determined on the basis of the following criteria taken together:

• the period of the User’s active use of the Service;
• a reasonably necessary period after cessation of use in order to complete settlements and close open requests;
• infrastructure operational security requirements (including backup rotation);
• applicable limitation periods and the need to protect the rights of the Company and the User in disputes.

4.2. Account Deletion. Upon the User’s request submitted via the personal account or to support@maximum-vpn.com, the Company deletes the account and the associated personal data without undue delay, except for data that must be retained under mandatory requirements of applicable law.

5.1. To provide the Service, the Company engages processors in the following categories: payment providers, hosting infrastructure, transactional email delivery services, and support request handling. Data are transferred to processors on the basis of data processing agreements. An up-to-date list of processors, indicating their jurisdiction and the categories of data transferred, is available upon request via support@maximum-vpn.com.

5.2. The Company does not sell, rent or disclose Users’ personal data for the marketing purposes of third parties. Monetization of User data is not carried out.

5.3. Telegram as an Independent Controller: when registering for and using the Service via the Telegram bot, Telegram FZ-LLC (Dubai, UAE) acts as an independent data controller for its platform and processes the User’s data in accordance with its own privacy policy (telegram.org/privacy). The Company shall not be liable for data processing carried out on the Telegram side. A User wishing to minimise data transfer may register via the web interface mxm-secure.ru.

5.4. Disclosure of data to government authorities is made solely on the basis of a valid court order or other legally binding directive of a competent authority of the State of Israel or of another jurisdiction in the manner provided for by international treaties. By virtue of the No-Logs Policy (§2), the Company technically does not hold traffic logs, DNS query logs or session-IP correlation records and is unable to provide such data.

6.1. Control plane — processing of personal data. The account database, billing, support request logs, crash reports and backups are hosted exclusively on servers within the jurisdiction of the the State of Israel and European Union. The Company does not use any other geographic regions for the storage of personal data.

6.2. The State of Israel is covered by a European Commission adequacy decision on the level of data protection, reaffirmed in January 2024. Transfers of personal data from the European Economic Area (EEA) to Israel do not require additional safeguards.

6.3. Data plane — VPN exit nodes. To operate the Service, the Company maintains a network of VPN nodes (exit nodes) in various countries around the world. These nodes perform exclusively the function of transit routing of encrypted traffic and, by virtue of the No-Logs Policy (§2), do not store any personal data of the User — neither IP addresses, nor DNS queries, nor traffic content, nor activity logs. Accordingly, exit nodes do not constitute a place of personal data processing, and their geographic location does not give rise to any obligations regarding international data transfers.

6.4. Technical and organisational security measures. The Company applies cryptographic protection to the transmission of User traffic (end-to-end encryption of the VPN tunnel) and to the storage of personal data (encryption of databases and backups), as well as organisational measures (least-privilege access control, logging of administrative actions, regular security updates, pseudonymisation of diagnostic data). The specific cryptographic algorithms, protocol versions and implementation details constitute a trade secret of the Company and are not subject to public disclosure for security reasons; such information is provided to the competent supervisory authority upon a substantiated request.

7.1. The User has the right to request access to the personal data being processed, as well as its rectification, erasure, restriction of processing, portability, to object to processing, and to withdraw previously given consent. Requests are to be sent to support@maximum-vpn.com and are handled within a reasonable period.

7.2. The User also has the right to lodge a complaint with the national personal data protection supervisory authority of their place of residence.

8.1. In the event of a personal data breach likely to result in a risk to the rights and freedoms of Users, the Company will notify the competent supervisory authority within 72 hours of becoming aware of the incident.

8.2. If the incident is likely to result in a high risk to the rights and freedoms of Users, the Company will additionally notify the affected Users without undue delay via email and in-app notification.

9.1. The Company reserves the right to amend this Policy. The updated version is published at maximum-vpn.com/privacy-policy with the date of the last update indicated.

9.2. The Company will notify Users of material changes (affecting the categories of data processed, retention periods, transfers to third parties or the scope of User rights) no less than 14 calendar days in advance via email or in-app notification. Such changes take effect for a particular User only after explicit confirmation via an in-app modal window. A User who does not agree with the updated version may cease using the Service and request deletion of their account via support@maximum-vpn.com; until confirmation is received, the functionality of the Service may be restricted to the extent that it requires the updated legal basis for processing.

9.3. Non-material changes (typographical corrections, restructuring, updates to contact details) take effect upon publication and do not require separate confirmation.

10.1. The website maximum-vpn.com uses cookies to ensure the operation of the website and for anonymous traffic analytics. Non-essential cookies are set only after the User's consent given via the cookie banner; consent may be withdrawn at any time through the browser settings.