Privacy Policy
Last updated: 21 September 2026
1. Who is the controller of your personal data?
Cat Connect Oy
Business ID 3586838-7
Sturenkatu 26 lt. 36, 00510 Helsinki, Finland
Cat Connect Oy operates the Sota VPN service, the Sota Connect apps, the customer dashboard, the sotavpn.com, sotavpn.app and sotapayments.com websites, the Russian mirror sotavpn.cx and the download server sotacdn.com.
For data protection matters, contact us at [email protected].
2. From where do we collect your personal data?
To provide our services and fulfil our obligations, we process personal data. We want you to be aware of the different types of personal data we collect.
Information you provide
| Categories | Examples of personal data types |
|---|---|
| Contact information | Email address, Telegram account if you link one. |
| Device names | The name you give a device in your dashboard. |
| Communication and messages | Support tickets, emails, contact form messages, Telegram messages, attachments. |
Information we collect when you use our services
| Categories | Examples of personal data types |
|---|---|
| Account and subscription data | Account number, access key, plan, subscription status and expiry date, referral code and bonus days. |
| Device data | Devices signed in with your key and whether each is online. |
| Payment data | Order number, amount, currency, date, payment method, payment status, refund status. |
| VPN session data | Your device’s IP address, the server you connected to and the connection state, held only while you are connected and deleted when you disconnect. |
| Technical data | Dashboard session cookie. |
Information we receive from third parties
| Categories | Examples of personal data types |
|---|---|
| From payment service providers | Transaction reference, payment status, and card type. |
| From messaging platforms | Telegram username, when you contact us on Telegram. |
3. Why do we process your personal data?
| Purpose | Legal basis |
|---|---|
| Providing the VPN connection We route your traffic through the server you choose. The server holds your IP address and connection state while you are connected and nothing afterwards. | Performance of contract. |
| Account and subscription We maintain your account, access key and device list, and credit referral bonuses. | Performance of contract. |
| Payments and refunds We take payment, send receipts and expiry reminders, and process refunds as applicable. | Performance of contract. |
| Accounting We keep payment records as accounting material. | Legal obligation under the Finnish Accounting Act (1336/1997). |
| Customer support We answer your questions and resolve problems. | Performance of contract. If you are not a customer, our legitimate interest in answering people who contact us (Article 6(1)(f) of the GDPR). You have the right to object to processing based on legitimate interest. |
| Security We protect our servers and services against attacks and abuse. | Our legitimate interest in the security of our network (Article 6(1)(f) of the GDPR). You have the right to object to processing based on legitimate interest. |
| Establishment, exercise and defence of legal claims We handle payment disputes, chargebacks and other claims made by or against us. | Our legitimate interest in establishing, exercising or defending legal claims (Article 6(1)(f) of the GDPR). You have the right to object to processing based on legitimate interest. |
4. Do we disclose or transfer your personal data?
We use service providers that process personal data on our behalf. They act under our instructions and a data processing agreement and may not use your data for their own purposes.
| Category of recipient | Purpose |
|---|---|
| Hosting and network infrastructure providers | Operating the VPN servers, the website and the dashboard. |
| Email service providers | Delivering email between you and us. |
Some recipients determine the purposes and means of processing themselves and are independent controllers under their own privacy policies:
| Category of recipient | Purpose |
|---|---|
| Payment service providers | Processing the payment method you choose at checkout. |
| Messaging platforms | Delivering messages, if you choose to contact us through a messaging platform such as Telegram. |
| App stores | Distributing and updating the apps. |
Cryptocurrency payments are recorded on a public blockchain. The record of your wallet address, the amount and the time is public and permanent, and we cannot delete it. We store only the transaction reference.
We may be required by law to disclose your personal data to courts or authorities. Such disclosures are made only when required by applicable law.
In the event of a merger, acquisition or sale of all or part of our business, we may disclose your personal data to potential buyers.
5. Do we process your personal data outside the EU and the EEA?
Your personal data may be processed outside the EU and the EEA in the following cases:
| Processing | Safeguard |
|---|---|
| VPN session data, when you connect to a server outside the EEA or “Best server” selects one for you | An adequacy decision of the European Commission or standard contractual clauses. |
| Payment data, when the payment service provider for the method you choose is established outside the EEA | The transfer is necessary to perform the contract you have requested. |
| Cryptocurrency payment records | Public blockchain outside anyone’s control. |
| Messages, if you choose to contact us through a messaging platform established outside the EEA | Your choice of channel. A dashboard ticket stays on our own systems. |
| Other service providers established outside the EEA | An adequacy decision of the European Commission or standard contractual clauses. |
6. How long do we retain your personal data?
| Purpose | Retention period |
|---|---|
| Providing the VPN connection | Nothing after you disconnect. |
| Account and subscription | Until you ask us to delete your account or it has been inactive for 12 months after expiry. |
| Payments and refunds | Until the refund window and any dispute have closed, then as accounting material below. |
| Accounting | Accounting books ten years from the end of the financial year. |
| Customer support | 90 days after the case is closed. |
| Security | No access logs are kept. |
| Establishment, exercise and defence of legal claims | Until the limitation period has run, three years as a rule. |
7. What data protection rights do you have?
You have the following rights under the GDPR:
- Right of access (Article 15)
- Right to rectification (Article 16)
- Right to erasure (Article 17)
- Right to restriction of processing (Article 18)
- Right to data portability (Article 20)
- Right to object, in particular to processing based on legitimate interest (Article 21)
To exercise your rights, contact us at the address above. Because we do not verify identity, we may ask for your account number to locate your data. Support cannot recover a lost account number.
You have the right to lodge a complaint with the Data Protection Ombudsman (Fi: tietosuojavaltuutettu), www.tietosuoja.fi.
8. Can this Privacy Policy be amended?
We may amend this notice when our services, our processing or the law changes. The current version is available on our website. If a change is significant, we notify you by email before it takes effect.
