Privacy Policy

For your account, billing, support and the security of the Services, we decide how personal information is used and are responsible for it under this Policy.

Much of what you store in the Services is Customer Data that your Org controls, such as browser profiles, email received at your domains, identities and task results. That data may include personal information about other people (for example, the senders of messages you receive). We process that information on behalf of your Org, as its service provider, to provide the Services. If you are someone whose information an ExitNode customer stores, please contact that customer about it; we will help them respond as the law requires.

2.1 Information you give us

• Account and Org information: your name, email address, password (stored by our authentication provider in hashed form), profile picture if you add one, the Orgs you belong to, your role and permissions, and invitations you send or receive (including invitees' email addresses).
• Billing information: your plan, seats, Credits and transaction history. Card payments for subscriptions are handled by our payment processor; we receive only limited details such as a customer identifier, plan and payment status, not your full card number.
• Communications: messages you send us, such as support requests, and your communication preferences.

2.2 Customer Data you store in the Services

• Browser profiles: profile settings, fingerprint configuration, tags, notes, folders, bookmarks and extensions, and the browser state of each profile (cookies, browsing history, local and indexed storage, open tabs and form autofill data, excluding payment cards). Browser state is encrypted before it is stored, using keys we manage for you.
• Proxies and connections: proxy addresses and credentials, proxy provider account details, test results such as exit IP address, location, speed and IP risk score, and a log of proxy checks (including the computer name of the device that ran the check).
• Email and verification codes: messages received at catch-all domains you connect to ExitNode or at mailboxes you connect (including sender, recipients, subject and content), and the verification codes, magic links and order details we extract from them. Credentials for mailboxes you connect are encrypted.
• Phone numbers and SMS: temporary numbers you rent through the Services and the text messages and codes they receive.
• Identities: names, dates of birth, email addresses, phone numbers and postal addresses you enter or generate for use in profiles and tasks.
• Accounts on Third-Party Sites: login emails, passwords and two-factor secrets you store for tasks. These are encrypted, and we can decrypt them when a task you run needs them.
• Cards: for virtual cards you add or issue, the label, brand, last four digits, expiry, billing ZIP code, cardholder name and status at the issuer. Full card numbers and security codes are encrypted on your device before they are synced, and we cannot decrypt them.
• Tasks and orders: tasks you configure and run, their status and results, and order and shipping details (including shipping addresses and tracking numbers) from order emails you receive.
• Live monitoring: if an Org enables live monitoring, periodic low-resolution screenshots of running browser profiles, shown to authorized members of that Org. We keep only the most recent screenshot for each profile.

2.3 Information collected automatically

• Device information from the desktop application: a randomly generated installation identifier, your computer's name, its operating system, the application version, the time your device last started, and public cryptographic keys created on your device. We use these to authorize devices, enforce device limits and secure communications. We do not collect hardware serial numbers or network hardware addresses.
• Security and integrity signals: the desktop application checks your device for conditions that indicate tampering with the Software or interception of its traffic (such as system proxy settings, trusted certificates, an attached debugger, or traffic-interception tools among running programs). These checks run on your device; we receive only which conditions were detected, with your app version, operating system and a device marker. We do not receive the list of programs on your device.
• Usage and activity: actions taken in the Services, such as launching a profile or changing a setting, with the member, device and time, recorded in your Org's activity log.
• Log and network data: IP address, request details, user agent and timestamps when your browser or the desktop application connects to our servers, including records kept by our hosting providers.
• Website storage: the website and web console use strictly necessary cookies to keep you signed in and local browser storage to remember preferences such as layout. We do not use advertising cookies, third-party analytics or tracking pixels.

2.4 Information from other sources

• Card issuers you connect (status and spending information for your virtual cards), phone number providers (numbers and messages), shipping carriers (tracking status for your orders) and our payment processor (payment status).
• IP risk scoring and network information about proxy IP addresses you test. This describes the proxy's IP address, not you.

Some information the desktop application handles is stored only on your device and is not sent to us, including: passwords you save for websites; sign-in sessions for certain connected services; mailboxes you choose to keep on your device only, and the messages in them; your private device keys; and, unless you turn on cloud backup, your card issuer credentials (if you turn it on, they are encrypted on your device first and we cannot decrypt them). Your sign-in token for the application is stored in a file on your device that only your user account can read.

When you sign out of the desktop application, it deletes some of this information from the device (such as device-only mailboxes and cached codes); other items remain until you delete them or uninstall the application.

• To provide the Services: create and sync profiles, run tasks you start, test proxies, receive and display email and SMS, extract verification codes and order details, and support teams and billing.
• To secure the Services and enforce our Terms: authorize devices and licenses, enforce plan and device limits, detect and prevent fraud, abuse, tampering and reverse engineering, and investigate violations.
• To communicate with you about your account, security, changes to our terms and the Services, and support requests.
• To maintain and improve the Services, including troubleshooting and developing features, using aggregated or de-identified information where practical.
• To comply with law, respond to lawful requests, and establish, exercise or defend legal claims, including keeping records of your acceptance of our terms.

Automated extraction and AI. We use automated systems, including machine-learning models provided by third-party AI service providers, to find verification codes, links and order details in email you route to the Services, and to help with setup tasks such as recognizing proxy formats and spreadsheet columns. For email, we send only the parts needed, such as the sender, subject and the beginning of the message. We do not use these systems to make decisions that produce legal or similarly significant effects about you.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than providing the Services, security and integrity, and the other purposes permitted by California law.

• Service providers that process information on our behalf, by category: cloud hosting, database and authentication; object storage and content delivery; email delivery; payment processing; AI model providers; IP risk scoring (proxy IP addresses only); phone number and SMS providers; shipping and package-tracking carriers; and DNS and network services.
• Your Org. Owners, administrators and other authorized members of your Org can see Org content and activity according to their roles, including the activity log and, where enabled, live monitoring.
• Services you direct us to use. When you run a task, connect a mailbox, card issuer, proxy provider or phone number provider, or visit a Third-Party Site through a profile, information is exchanged with that party at your direction and under its own policies.
• Our personnel. Authorized ExitNode staff may access information, including Customer Data, when needed to provide support you request, keep the Services secure, investigate suspected violations, or comply with law.
• Legal and safety. When we believe disclosure is required by law or legal process, or necessary to protect the rights, property or safety of ExitNode, our users or others, including to enforce our Terms.
• Business transfers. In connection with a merger, acquisition, financing, reorganization or sale of assets, subject to standard confidentiality protections.

We keep personal information for as long as your account is active and as needed to provide the Services, and then for as long as needed for the purposes in this Policy, including legal, security, tax and accounting requirements and resolving disputes. Specific periods include:

• Org activity log entries: about 90 days.
• Proxy check log: 30 days, or 180 days for checks that changed a proxy's status.
• Completed verification requests: about 7 days.
• Browser profile state: the five most recent versions of each profile; deleted profiles stay in trash for 7 days before they are removed.
• Live monitoring: only the most recent screenshot per profile, deleted with the profile.
• Device-only mailboxes on your device: 30 days, up to 2,000 messages per mailbox.
• Other Customer Data: until you or your Org delete it or your account is closed, after which we delete it within a reasonable period (generally 30 days), except where we must keep it.
• Records of your acceptance of our legal terms, billing records and security records: for as long as needed to comply with law and to establish or defend legal claims, which may be after your account is closed.

We use administrative, technical and physical measures designed to protect personal information, including encryption in transit, encryption of sensitive fields and browser state, access controls by Org and role, and device authorization. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for protecting your credentials, devices and recovery passphrase.

• You can view and update your account information in the Services, and delete most Customer Data yourself.
• You can ask us to access, correct or delete your personal information, or to close your account, by emailing privacy@exitnode.app.
• You can stop non-essential email by following the instructions in it. We will still send messages about your account, security and legal terms.
• You can sign out of and uninstall the desktop application at any time.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), gives you the rights below. This section is our notice at collection and describes our practices in the last 12 months.

9.1 Categories of personal information

• Identifiers (name, email address, IP address, installation identifier, account identifiers): from you and your devices; used to provide and secure the Services; disclosed to hosting, authentication, email delivery and payment service providers.
• Customer records (contact and billing details): from you and our payment processor; used for accounts and billing; disclosed to hosting and payment service providers.
• Commercial information (plans, Credits, purchases, and orders recorded from your email): from you, your email and connected services; used to provide the Services and billing; disclosed to hosting and payment service providers and shipping carriers.
• Internet or other electronic network activity (activity log, request logs, security signals, browser profile history and storage): from you and your devices; used to provide and secure the Services; disclosed to hosting service providers.
• Geolocation data (approximate location derived from IP addresses, and locations of proxy exits): from your devices and network services; used for security and proxy testing; disclosed to hosting and IP risk scoring service providers.
• Audio, electronic or visual information (live monitoring screenshots, profile pictures): from your devices and you; used to provide those features; disclosed to hosting service providers.
• Professional information (your Org membership and role): from you and your Org; used to provide team features; disclosed to hosting service providers.
• Sensitive personal information: account log-in credentials; credentials for Third-Party Site accounts and mailboxes you store; and the contents of email and text messages received through the Services, where we are not the intended recipient. Collected from you and the services you connect; used only to provide the Services you request and to keep them secure; disclosed to hosting, AI model and phone number service providers as needed to provide them.

We do not knowingly collect information from consumers under 16, and we do not sell or share any consumer's personal information.

9.2 Your rights

• Know and access: the categories and specific pieces of personal information we have collected about you, the sources, purposes and recipients.
• Delete: personal information we collected from you, subject to legal exceptions.
• Correct: inaccurate personal information.
• Opt out of sale or sharing: we do not sell or share personal information, so there is nothing to opt out of. We honor Global Privacy Control signals as an opt-out request.
• Limit use of sensitive personal information: we use sensitive personal information only for purposes the CCPA permits without offering this right.
• Non-discrimination: we will not discriminate against you for exercising your rights.

9.3 How to exercise your rights

Email privacy@exitnode.app from the email address on your account, or write to us at Solutell LLC, Attn: Privacy, 2108 N St, Ste #7512, Sacramento, CA 95816, United States. We will verify your request by confirming control of your account's email address and, if needed, other information. You may use an authorized agent; we may require proof of the agent's authority and ask you to verify your identity directly. We will respond within 45 days, or tell you if we need up to 45 more days.

9.4 Shine the Light

California Civil Code § 1798.83 lets California residents ask for information about disclosure of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

9.5 Do Not Track

We do not track you across other websites. We do not respond differently to browser "Do Not Track" signals, but we honor Global Privacy Control as described above.

We are based in the United States, and we and our service providers process information in the United States and other countries. Those countries may have data protection laws different from yours. By using the Services, you understand that your information will be processed in these places.

The Services are not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact privacy@exitnode.app and we will delete it.

We may update this Policy from time to time. If we make material changes, we will notify you in advance through the Services or by email and, where required, ask you to review the updated Policy before you continue. The effective date at the top shows when this version took effect.

Privacy questions and requests: privacy@exitnode.app. Mail: Solutell LLC, Attn: Privacy, 2108 N St, Ste #7512, Sacramento, CA 95816, United States.