Snapshot of the source text at fetch time, not a live mirror of the policy page.
Plain-English summary
ExpressVPN operates under the jurisdiction of the British Virgin Islands, meaning any legal demands for your Personal Data are subject to BVI laws (risk_flags-1). When making payments, you might be redirected to third-party payment processors who may collect additional personal data, and you should review their separate privacy policies (risk_flags-2). The service retains data related to transactional communications, such as order confirmations, for ten years (data_use-1), and your continued use of the services implies consent to receive these communications (data_use-2).
85% confidence
Ask Verbaterm
Follow up on findings with grounded answers from this review. Not legal advice.
Risk Flags
Critical issues and red flags raised by the policy text that could indicate significant risk or unusual provisions for the user.
low85% confidence confidence
Legal jurisdiction in the British Virgin Islands (BVI) for Personal Data
ExpressVPN operates under British Virgin Islands (BVI) jurisdiction, and any legal demands for Personal Data are subject to BVI laws.
Why it matters: Any demand via legal means for Personal Data is subject to BVI jurisdiction and laws.
Express Technologies Ltd. operates under BVI jurisdiction, in accordance with BVI laws (pursuant to Section 16 of the Terms). Consequently, any demand via legal means for Personal Data (or other types of data) is subject to BVI jurisdiction and laws.
How We Protect and Retain Your Personal Data, paragraph 1 · Citation strength: strong
low85% confidence confidence
Third-party payment processors may collect additional personal data
When paying for the service, you may be redirected to third-party payment processors who may collect and store personal data, which you should review in their respective terms and privacy policies.
Why it matters: For some forms of payment, you may be redirected to external websites operated by third-party payment processors. To understand what personal data these processors collect and store, you need to refer to their respective terms and privacy policies.
Specific Personal Data collected will depend on the payment method you choose and may include information such as name, billing country, billing address, and/or credit card number. For some forms of payment, you may be redirected to external websites operated by third-party payment processors (e.g., PayPal, BitPay, Paymentwall, Stripe, or other specific payment processors, depending on your location) to complete the transaction. To understand what personal data these processors collect and store, please refer to the respective processor’s terms and privacy policy.
Personal Data, paragraph 2 · Citation strength: strong
Data Use
This section deals with how your data is collected, processed, and shared, and any associated risks.
low85% confidence confidence
Transactional communications are retained for 10 years
Data associated with transactional communications, such as order confirmations and renewal notifications, is retained for ten years.
Why it matters: Data associated with transactional communications, including order confirmations, renewal notifications, and price increase notices, is retained for a period of ten (10) years.
We retain the data associated with these communications for a period of ten (10) years to ensure compliance with legal requirements and to protect our interests.
This section highlights clauses related to service cancellation, account termination, and subscription renewal processes.
✓
Looking good
No billing surprises spotted
Verbaterm only flags concerns it can cite. No cancellation, auto-renewal, or refund terms needed attention here.
Gotchas
Potentially overlooked clauses that may have unintended consequences or that deviate from common user expectations.
✓
Looking good
No hidden gotchas
Verbaterm only flags concerns it can cite. Nothing easy-to-miss stood out in this section.
Protections
This section highlights policies or features that are beneficial to the user and protect their interests.
Protection95% confidence confidence
No logging of online activity or connection logs
ExpressVPN does not collect logs of your online activity while connected to their services, including browsing history, traffic destination, data content, DNS queries, IP address, outgoing VPN IP address, connection timestamp, or session duration.
Why it helps: This commitment helps protect user privacy by ensuring that no records of their online activities or connection details are stored, making it impossible to link specific actions to an individual user.
**We do not collect logs of your online activity while you are connected to our Services, including no logging of browsing history, traffic destination, data content, or DNS queries. We also never store connection logs, meaning no logs of your IP address, your outgoing VPN IP address, connection timestamp, or session duration.**
ExpressVPN is committed to protecting your privacy, paragraph 4 · Citation strength: strong
Protection90% confidence confidence
Personal Data is not sold or leased to third parties
ExpressVPN explicitly states that they do not sell or lease your Personal Data to third parties.
Why it helps: This is a strong protection against unauthorized sharing of personal information, helping to maintain user privacy and prevent data from being exploited by other entities.
ExpressVPN uses your Personal Data only for the purposes listed in this Privacy Policy, and **we do not sell or lease your Personal Data to third parties**.
Personal Data, paragraph 5 · Citation strength: strong
Protection90% confidence confidence
Personal Data controlled only by ExpressVPN
Any personal information associated with ExpressVPN accounts is controlled only by ExpressVPN and stored on systems owned or leased by them and their subsidiaries, without transfer of control to other related entities.
Why it helps: This ensures that your personal data remains under the direct control of ExpressVPN and is not transferred to their ultimate holding company or other related entities, which could potentially expose it to different data handling policies.
Any personal information associated with ExpressVPN accounts is **controlled only by ExpressVPN**, including being stored on systems, servers, and services owned or leased by ExpressVPN and its subsidiaries. In the limited circumstances where this data may need to be processed by other related entities, it may be shared only when required, and for the duration required, for processing solely related to the purposes and legitimate interests outlined in this Privacy Policy, while ensuring at all times the same data protection standards.
Personal Data, paragraph 6 · Citation strength: strong
Protection85% confidence confidence
Minimal data collection principle to operate services
The guiding principle for data collection is to collect only the minimal data required to operate world-class Services at scale, intending not to have sensitive data about customers.
Why it helps: This commitment to collecting minimal data reduces the amount of personal information that could potentially be compromised or misused, enhancing overall user privacy.
Our guiding principle toward data collection is to collect only the minimal data required to operate world-class Services at scale. We designed our systems (and strive to constantly improve them) to not have sensitive data about our customers. We cannot disclose, misuse, or abuse, even when compelled, data that we do not possess.
ExpressVPN is committed to protecting your privacy, paragraph 4 · Citation strength: strong
Protection90% confidence confidence
Zero-knowledge encryption for Keys Data and no access by staff/service providers
Keys Data stored in ExpressKeys is secured with zero-knowledge encryption, meaning no ExpressVPN staff or Service Providers can view or retrieve the information.
Why it helps: This ensures that sensitive data stored in ExpressKeys, like logins and passwords, remains private and inaccessible to even the service provider, significantly boosting data security and user control.
Keys Data refers to all the data stored within the ExpressKeys associated with your Account, which may include user logins and passwords to your services and accounts, as well as other types of data you choose to store. Keys Data is encrypted the moment you add it to ExpressKeys, and we are not capable of viewing, decrypting, or accessing Keys Data under any circumstance (even if you want us to). You may add, modify, and delete your Keys Data at any time by accessing your ExpressKeys dashboard.
(iii) Data added to ExpressKeys (“Keys Data”) (applicable only to ExpressKeys users), paragraph 1 · Citation strength: strong
Protection90% confidence confidence
Anonymized App Diagnostic Data if you opt-in
App Diagnostic Data, collected only with opt-in permission, is anonymized and cannot be tied back to individual users, meaning the service does not store which user sent which data or user IP addresses.
Why it helps: By ensuring diagnostic data is anonymized and collected only with consent, user privacy is maintained while still allowing the service to improve its functionality and troubleshoot issues.
App Diagnostic Data, which includes crash reports, usability diagnostics, and VPN connection diagnostics, is anonymized data that cannot be tied back to individual users. This feature is similar to a “send bug report” option. App Diagnostic Data is not shared by default. You must opt in, such as through the settings menu of your Apps, to send App Diagnostic Data to us.
Inability to provide user information based on VPN usage data
ExpressVPN cannot supply user information based on VPN usage statistics because the data does not exist.
Why it helps: This policy strongly protects user privacy by confirming that the company does not possess the data that could link an individual user to specific online activities, even if compelled to release such information.
Should anyone try to compel ExpressVPN to release user information based on any of the above, **we cannot supply this information because the data does not exist**.
Usage Statistics Data and App Diagnostic Data, paragraph 5 · Citation strength: strong
Protection85% confidence confidence
Ability to opt out of marketing emails
You can choose to not receive Marketing Emails by following the unsubscribe procedure described in these emails.
Why it helps: This provides users with direct control over the marketing communications they receive, allowing them to reduce unwanted emails.
* To send marketing information, such as offers, surveys, invitations, and content about other matters in connection with ExpressVPN that we believe may be of interest to you (“**Marketing Emails**”). You may choose to not receive Marketing Emails by following the unsubscribe procedure described in these emails.
Personal Data, paragraph 4 · Citation strength: strong
Report an issue
Flag a citation problem, stale policy text, or incorrect company match.
Verbaterm boundaries
This public review is informational only and is not legal advice. Verbaterm shows only findings tied to the cited source snapshot above.