Privacy Policy

Retention & Deletion · Company practice

Connection details are kept temporarily, deleted within 15 minutes after the session ends

To make the VPN work, Surfshark servers temporarily keep details about your connection to a specific VPN server, such as your user ID and/or IP address and connection time stamps. Surfshark says this information is automatically deleted within 15 minutes after your session ends, and that it does not store information about the websites you visit.

Supporting quotations

our servers temporarily keep details about your connection to a specific VPN server, such as your user ID and / or your IP address and connection to VPN server time stamps. However, this information is automatically deleted within 15 minutes after your session ends.

we do not store any information about the websites you visit

Qualifications & exceptions

• Retention applies to details about the connection to a VPN server, not to the sites you visit.
• Deletion is stated as automatic within 15 minutes after the session ends.
• "such as" means the examples listed (user ID, IP address, time stamps) are not stated as the full list.

Not stated here

• The full list of connection details kept temporarily is not given; only examples are listed.

Cross-references

• contrast (model-proposed): Surfshark says it keeps no logs of your online activity — The no-logs paragraph says connection time stamps are not collected, while the next paragraph (and section 2.2.1) says servers temporarily keep connection details including time stamps, deleted within 15 minutes after the session ends. The policy presents both without explaining the difference.

Retention & Deletion · Company practice

Account and service data kept while subscribed plus 2 years after last login

For account data, subscription and payment data, search-tool counts, Alternative ID persona data and Alternative email data, Surfshark says it keeps the data for as long as your subscription is active and for 2 years after your last login. Some data has a shorter stated period: VPN connection details are deleted within 15 minutes after the session ends, and forwarded emails are deleted as soon as they are forwarded.

Supporting quotations

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

Connection information is automatically deleted within 15 minutes after your session ends.

The Emails you receive via the Alternative Email service along with sender and recipient email server IP address, sender email address and timestamps are deleted as soon as they are forwarded to your email address.

Qualifications & exceptions

• The stated period is the subscription term plus 2 years after the last login.
• Different periods apply to VPN connection information and to forwarded email content, in their own subsections.

Not stated here

• The text does not say what happens to a subscription that lapses without any login; the clock is measured from the last login.

Cross-references

• qualified by (model-proposed): Stated retention periods can be exceeded or governed by this general rule — The general retention rule says data may be stored beyond the stated timeframes for legal obligations and legal claims, which qualifies the account-level retention period of subscription plus 2 years.

Retention & Deletion · Company practice

Alternative email: verify your address; forwarded emails deleted once sent on

To use the Alternative email service you must verify the email address that emails are forwarded to. Emails you receive through the service, along with the sender and recipient email server IP addresses, the sender email address and timestamps, are deleted as soon as they are forwarded to your address. Surfshark uses a trusted email service provider to provide this service.

Supporting quotations

To be able to use Alternative email service, you will have to verify your email address to which emails are forwarded.

The Emails you receive via the Alternative Email service along with sender and recipient email server IP address, sender email address and timestamps are deleted as soon as they are forwarded to your email address.

We use a trusted email service provider to facilitate this service.

Qualifications & exceptions

• Deletion as soon as forwarded is stated for the received emails and the listed sender and recipient details.
• The provider is described only as "trusted"; it is not named.

Not stated here

• The retention line for this service in the data table says data is kept for as long as the subscription is active and for 2 years after last login; the text does not reconcile that with delete-on-forward for items such as the subject line, sender and receiver, and metadata.

Cross-references

• contrast (model-proposed): Alternative email: email content and metadata handled for forwarding — The data table says Alternative email data, including the email content, subject line, sender and receiver, is kept while the subscription is active plus 2 years after last login, while the later paragraph says received emails and listed sender and recipient details are deleted as soon as they are forwarded. The policy does not reconcile them.

Retention & Deletion · Restriction or exception

Stated retention periods can be exceeded or governed by this general rule

The policy gives specific retention periods per service, but its general retention rule says that unless the policy specifies differently, Surfshark keeps personal data until it is no longer necessary for the reasons it was collected, or until it receives a valid request to remove it, with some exceptions. It also says there may be cases where it needs to use and store personal data beyond the stated timeframes, for example to comply with legal obligations and/or to exercise and defend legal claims.

Supporting quotations

We keep your personal data for as long as your subscription is active and for 2 years after the last login.

unless specified differently in this Privacy Policy, we retain your personal data until it is no longer necessary for the reasons we initially collected it for, or until we receive a valid request to remove it, with some exceptions.

there may be instances where we need to use and store your personal data beyond the timeframes mentioned above for purposes such as compliance with our legal obligations and / or exercising and defending legal claims.

Qualifications & exceptions

• The general rule applies unless the policy specifies differently, so the per-service periods in section 2 come first.
• Longer storage is tied to legal obligations and exercising or defending legal claims; the word "for example" shows other reasons may exist.

Not stated here

• What the "some exceptions" to deletion on request are is not listed in this passage.
• The length of any extended storage is not stated.

Cross-references

• qualifies (model-proposed): Account and service data kept while subscribed plus 2 years after last login — The general retention rule says data may be stored beyond the stated timeframes for legal obligations and legal claims, which qualifies the account-level retention period of subscription plus 2 years.

Retention & Deletion · Company practice

Legal compliance and claims: email, subscription and payment information kept as the law requires

To comply with legal requirements and to exercise or defend legal claims, Surfshark may collect your email address, subscription information, payment-related information, other necessary information and/or legal documents. Its basis is a legal obligation where it must collect data by law, and its legitimate interest in defending its rights and interests in other legal processes related to you. It retains the data for as long as the specific law indicates. It says it is subject to tax and other statutory requirements and may have to protect its legitimate interests and legal rights, in which case it may need to collect and store a limited amount of the listed data.

Supporting quotations

2.3.13 To comply with legal requirements, exercise or defend legal claims

Email address, subscription information, payment-related information, other necessary information and / or legal documents.

Legal basis for the processing of personal data is a legal obligation to which we are subject (in case we need to collect your data statutorily) and our legitimate interest to defend our rights and interests (in case of other legal processes related to you, if any).

We retain this data for as long as it is indicated in the specific law.

We may have to protect our legitimate interests and legal rights. In these cases, we may be required to collect and store a limited amount of your personal data indicated above

Qualifications & exceptions

• Two bases are given: legal obligation (statutory collection) and legitimate interest (other legal processes related to you, if any).
• The listed data is described as a limited amount, but includes "other necessary information and / or legal documents".

Not stated here

• What "other necessary information" and "legal documents" cover is not specified.

Cross-references

• qualifies (model-proposed): Right to erasure: deletion of data in Clause 2, unless legally required or another legal basis — The right to deletion does not apply where Surfshark is legally required or has a legal basis to keep data; the legal compliance section lists such data retained as the law requires.

Retention & Deletion · Restriction or exception

Data may be kept longer to meet legal duties, respond to governments or enforce contracts

Surfshark says it may also retain personal data for longer periods to comply with legal obligations, respond to government requests, or enforce its contracts and Terms of Service, including investigating potential violations.

Supporting quotations

We may also retain personal data for longer periods to comply with legal obligations, respond to government requests, or enforce our contracts and Terms of Service, including investigating potential violations.

Qualifications & exceptions

• Applies to longer retention beyond the usual period.
• "Including investigating potential violations" is an example of enforcement, not stated as the only one.

Not stated here

• No maximum length for this longer retention is stated, and the text does not say whether it covers data the policy elsewhere says is deleted within minutes or never stored.

Cross-references

• qualifies (model-proposed): Default retention: until no longer necessary or a valid removal request — Longer retention to comply with legal obligations, respond to government requests or enforce contracts qualifies the default rule of keeping data until it is no longer necessary.

Retention & Deletion · Company practice

Tax, payment issues, fraud and accounting: payment data kept 10 years

To collect applicable tax, solve payment related issues, prevent fraud and ensure accounting, Surfshark collects part of the credit card number, payment amount, currency, date of payment, card expiry date, and residence country and state. Its basis is a legal obligation, and it retains payment-related information for 10 years from receiving it. To calculate VAT or sales tax it collects your country and, where applicable, state of residence. If you choose to receive an invoice, it may also retain the necessary data to generate and issue the invoice.

Supporting quotations

2.3.14 To collect applicable tax, solve payment related issues, prevent fraud, and ensure accounting

Part of the credit card number, payment amount, currency, date of payment and card expiry date, residence country, state.

Legal basis for the processing of personal data is a legal obligation to which we are subject.

We will retain payment-related information for 10 years from the receipt of this information.

To calculate applicable VAT/sales tax, we collect your country and, where applicable, state of residence. Should you opt to receive an invoice for the services rendered, we may also retain the necessary data to generate and issue that invoice.

Qualifications & exceptions

• Retention is 10 years from receipt of the payment-related information.
• Invoice data is retained only if you opt to receive an invoice.

Retention & Deletion · Company practice

Default retention: until no longer necessary or a valid removal request

Unless the policy specifies differently, Surfshark says it retains your personal data until it is no longer necessary for the reasons it originally collected it, or until it receives a valid request to remove it, with some exceptions.

Supporting quotations

unless specified differently in this Privacy Policy, we retain your personal data until it is no longer necessary for the reasons we initially collected it for, or until we receive a valid request to remove it, with some exceptions.

Qualifications & exceptions

• This is the default; the per-service periods in section 2 apply where they are specified.
• The rule is subject to "some exceptions", and the next sentence of the policy adds storage beyond the stated timeframes for legal reasons.

Not stated here

• What the "some exceptions" to removal on request are is not listed in this passage.

Cross-references

• qualified by (model-proposed): Data may be kept longer to meet legal duties, respond to governments or enforce contracts — Longer retention to comply with legal obligations, respond to government requests or enforce contracts qualifies the default rule of keeping data until it is no longer necessary.