Connection details are kept temporarily, deleted within 15 minutes after the session ends
To make the VPN work, Surfshark servers temporarily keep details about your connection to a specific VPN server, such as your user ID and/or IP address and connection time stamps. Surfshark says this information is automatically deleted within 15 minutes after your session ends, and that it does not store information about the websites you visit.
Supporting quotations
our servers temporarily keep details about your connection to a specific VPN server, such as your user ID and / or your IP address and connection to VPN server time stamps. However, this information is automatically deleted within 15 minutes after your session ends.
we do not store any information about the websites you visit
Qualifications & exceptions
Retention applies to details about the connection to a VPN server, not to the sites you visit.
Deletion is stated as automatic within 15 minutes after the session ends.
"such as" means the examples listed (user ID, IP address, time stamps) are not stated as the full list.
Not stated here
The full list of connection details kept temporarily is not given; only examples are listed.
Retention & Deletion · Company practice
Account and service data kept while subscribed plus 2 years after last login
For account data, subscription and payment data, search-tool counts, Alternative ID persona data and Alternative email data, Surfshark says it keeps the data for as long as your subscription is active and for 2 years after your last login. Some data has a shorter stated period: VPN connection details are deleted within 15 minutes after the session ends, and forwarded emails are deleted as soon as they are forwarded.
Supporting quotations
We keep your personal data for as long as your subscription is active and for 2 years after the last login.
We keep your personal data for as long as your subscription is active and for 2 years after the last login.
We keep your personal data for as long as your subscription is active and for 2 years after the last login.
We keep your personal data for as long as your subscription is active and for 2 years after the last login.
We keep your personal data for as long as your subscription is active and for 2 years after the last login.
Connection information is automatically deleted within 15 minutes after your session ends.
The Emails you receive via the Alternative Email service along with sender and recipient email server IP address, sender email address and timestamps are deleted as soon as they are forwarded to your email address.
Qualifications & exceptions
The stated period is the subscription term plus 2 years after the last login.
Different periods apply to VPN connection information and to forwarded email content, in their own subsections.
Not stated here
The text does not say what happens to a subscription that lapses without any login; the clock is measured from the last login.
Retention & Deletion · Company practice
Alternative email: verify your address; forwarded emails deleted once sent on
To use the Alternative email service you must verify the email address that emails are forwarded to. Emails you receive through the service, along with the sender and recipient email server IP addresses, the sender email address and timestamps, are deleted as soon as they are forwarded to your address. Surfshark uses a trusted email service provider to provide this service.
Supporting quotations
To be able to use Alternative email service, you will have to verify your email address to which emails are forwarded.
The Emails you receive via the Alternative Email service along with sender and recipient email server IP address, sender email address and timestamps are deleted as soon as they are forwarded to your email address.
We use a trusted email service provider to facilitate this service.
Qualifications & exceptions
Deletion as soon as forwarded is stated for the received emails and the listed sender and recipient details.
The provider is described only as "trusted"; it is not named.
Not stated here
The retention line for this service in the data table says data is kept for as long as the subscription is active and for 2 years after last login; the text does not reconcile that with delete-on-forward for items such as the subject line, sender and receiver, and metadata.
Retention & Deletion · Restriction or exception
Stated retention periods can be exceeded or governed by this general rule
The policy gives specific retention periods per service, but its general retention rule says that unless the policy specifies differently, Surfshark keeps personal data until it is no longer necessary for the reasons it was collected, or until it receives a valid request to remove it, with some exceptions. It also says there may be cases where it needs to use and store personal data beyond the stated timeframes, for example to comply with legal obligations and/or to exercise and defend legal claims.
Supporting quotations
We keep your personal data for as long as your subscription is active and for 2 years after the last login.
unless specified differently in this Privacy Policy, we retain your personal data until it is no longer necessary for the reasons we initially collected it for, or until we receive a valid request to remove it, with some exceptions.
there may be instances where we need to use and store your personal data beyond the timeframes mentioned above for purposes such as compliance with our legal obligations and / or exercising and defending legal claims.
Qualifications & exceptions
The general rule applies unless the policy specifies differently, so the per-service periods in section 2 come first.
Longer storage is tied to legal obligations and exercising or defending legal claims; the word "for example" shows other reasons may exist.
Not stated here
What the "some exceptions" to deletion on request are is not listed in this passage.
The length of any extended storage is not stated.
Cross-references
qualifies (model-proposed): Account and service data kept while subscribed plus 2 years after last login — qualifies: The general retention rule says data may be stored beyond the stated timeframes for legal obligations and legal claims, which qualifies the account-level retention period of subscription plus 2 years.
Retention & Deletion · Company practice
Legal compliance and claims: email, subscription and payment information kept as the law requires
To comply with legal requirements and to exercise or defend legal claims, Surfshark may collect your email address, subscription information, payment-related information, other necessary information and/or legal documents. Its basis is a legal obligation where it must collect data by law, and its legitimate interest in defending its rights and interests in other legal processes related to you. It retains the data for as long as the specific law indicates. It says it is subject to tax and other statutory requirements and may have to protect its legitimate interests and legal rights, in which case it may need to collect and store a limited amount of the listed data.
Supporting quotations
2.3.13 To comply with legal requirements, exercise or defend legal claims
Email address, subscription information, payment-related information, other necessary information and / or legal documents.
Legal basis for the processing of personal data is a legal obligation to which we are subject (in case we need to collect your data statutorily) and our legitimate interest to defend our rights and interests (in case of other legal processes related to you, if any).
We retain this data for as long as it is indicated in the specific law.
We may have to protect our legitimate interests and legal rights. In these cases, we may be required to collect and store a limited amount of your personal data indicated above
Qualifications & exceptions
Two bases are given: legal obligation (statutory collection) and legitimate interest (other legal processes related to you, if any).
The listed data is described as a limited amount, but includes "other necessary information and / or legal documents".
Not stated here
What "other necessary information" and "legal documents" cover is not specified.
Data may be kept longer to meet legal duties, respond to governments or enforce contracts
Surfshark says it may also retain personal data for longer periods to comply with legal obligations, respond to government requests, or enforce its contracts and Terms of Service, including investigating potential violations.
Supporting quotations
We may also retain personal data for longer periods to comply with legal obligations, respond to government requests, or enforce our contracts and Terms of Service, including investigating potential violations.
Qualifications & exceptions
Applies to longer retention beyond the usual period.
"Including investigating potential violations" is an example of enforcement, not stated as the only one.
Not stated here
No maximum length for this longer retention is stated, and the text does not say whether it covers data the policy elsewhere says is deleted within minutes or never stored.
Cross-references
qualifies (model-proposed): Default retention: until no longer necessary or a valid removal request — qualifies: Longer retention to comply with legal obligations, respond to government requests or enforce contracts qualifies the default rule of keeping data until it is no longer necessary.
Retention & Deletion · Company practice
Tax, payment issues, fraud and accounting: payment data kept 10 years
To collect applicable tax, solve payment related issues, prevent fraud and ensure accounting, Surfshark collects part of the credit card number, payment amount, currency, date of payment, card expiry date, and residence country and state. Its basis is a legal obligation, and it retains payment-related information for 10 years from receiving it. To calculate VAT or sales tax it collects your country and, where applicable, state of residence. If you choose to receive an invoice, it may also retain the necessary data to generate and issue the invoice.
Supporting quotations
2.3.14 To collect applicable tax, solve payment related issues, prevent fraud, and ensure accounting
Part of the credit card number, payment amount, currency, date of payment and card expiry date, residence country, state.
Legal basis for the processing of personal data is a legal obligation to which we are subject.
We will retain payment-related information for 10 years from the receipt of this information.
To calculate applicable VAT/sales tax, we collect your country and, where applicable, state of residence. Should you opt to receive an invoice for the services rendered, we may also retain the necessary data to generate and issue that invoice.
Qualifications & exceptions
Retention is 10 years from receipt of the payment-related information.
Invoice data is retained only if you opt to receive an invoice.
Retention & Deletion · Company practice
Default retention: until no longer necessary or a valid removal request
Unless the policy specifies differently, Surfshark says it retains your personal data until it is no longer necessary for the reasons it originally collected it, or until it receives a valid request to remove it, with some exceptions.
Supporting quotations
unless specified differently in this Privacy Policy, we retain your personal data until it is no longer necessary for the reasons we initially collected it for, or until we receive a valid request to remove it, with some exceptions.
Qualifications & exceptions
This is the default; the per-service periods in section 2 apply where they are specified.
The rule is subject to "some exceptions", and the next sentence of the policy adds storage beyond the stated timeframes for legal reasons.
Not stated here
What the "some exceptions" to removal on request are is not listed in this passage.