Privacy Policy

This policy applies to any NETXO user, regardless of the country they access from, and includes specific sections for users in the European Union (GDPR) and in the United States (CCPA/CPRA).

1. Who processes your data

NETXO is a product of ACKNET AUTOMATION NETWORKING & CYBERSECURITY (Ecuadorian Tax ID / RUC 0961278611001), domiciled at Cdla. Primavera II, Mz. 1, Solar 7, Sector 2C, Eloy Alfaro parish, Durán canton, Guayas province, Ecuador — the party responsible for processing the data described in this policy. You can reach us via WhatsApp, email (info@netxo.online) or Instagram for any question or to exercise your rights.

2. What data we collect

To provide network control and protection, NETXO collects:

• Account and sign-up data: first name, last name, email address, the country where you use NETXO, and your password (stored encrypted, never in plain text). When you sign up by email, we send a one-time verification code that expires after 15 minutes.
• Payment data: if you subscribe to a paid membership (Mobile or Home), your name and email are shared with PayPal to process the subscription charge. NETXO never sees, receives, or stores your card number or PayPal credentials — payment happens entirely on PayPal's own platform.
• Device identifiers: the MAC addresses of the devices on your network, and the unique identifier the app generates for each phone paired under the Mobile membership, so we can recognize them and let you manage them.
• Browsing history (domains): the domains each device attempted to visit and whether they were blocked or allowed, to show the filtering history. This log is kept for a maximum of 3 days and then deleted automatically. We never log the full page, path, or query parameters — only the domain name.
• Data usage: connection time and traffic (in bytes) for each device, to show usage statistics.
• Push notification token: if notifications are enabled, we store the identifier your device provides so we can send them (for example, if the router disconnects, if the VPN is turned off, or check-ins between the administrator and the protected device). Notifications are delivered through Firebase Cloud Messaging (Google).
• Device location — approximate and precise (on demand only, Mobile membership): if the account administrator (“Parent”) requests the location of a protected device (“Child”), that device shares its position at that specific moment. Only the last requested position is stored; NETXO does not track continuously or keep a history of routes, and location is never collected without the Parent explicitly requesting it. If the Child (or the Parent when setting up the device) grants Android’s “all the time” location permission, the device can answer that request even while the NETXO app is closed, showing a minimal system notification while it obtains the position; without that permission, location is only shared while the app is open. Background location is used solely to answer a one-off request from the Parent, never to track the device and never for advertising.

NETXO does not collect the content of your browsing (pages visited beyond the domain, messages, files, photos). Location is only obtained when the administrator expressly requests it, as described above.

3. NETXO Mobile's VPN service

This section applies only to the Mobile membership, designed for an adult ("Parent") to protect a minor's phone ("Child") under their supervision — not to the Home or Enterprise memberships, which protect the network through a router.

• The app uses Android's native VPN service (VpnService) to create a local tunnel on the phone itself that intercepts domain name (DNS) queries to apply the content filter. Only when the account administrator blocks that device's Internet access or restricts a platform (for example, a social network), the tunnel also drops, on the phone itself, the traffic to that destination to cut connections that are already open: that traffic is not sent to any server or inspected. The rest of the time, the rest of the traffic is not redirected or touched, and the content of your browsing is never accessed.
• Each query travels from the phone to our server encrypted with TLS (HTTPS) and signed with an HMAC key unique to that device, which authenticates the origin of every request and prevents a third party from impersonating it or intercepting the content in transit.
• The server decides to block or allow the domain based on the content filter the Parent chose, and responds only with that — it does not work as a general-purpose VPN, nor as an anonymity service or a way to access third-party restricted content.
• It does not redirect the device's traffic for advertising or monetization purposes.

4. What we use your data for

• Showing devices connected to the network and letting you block, filter, or schedule them.
• Applying the content filter the Parent chose on protected Mobile devices.
• Processing payment and managing your subscription through PayPal.
• Keeping your session securely logged in.
• Sending the notifications you personally enabled (for example, when a device connects, disconnects, or its VPN is turned off).
• Providing support when you contact us.

We do not sell or share your data with third parties for advertising purposes.

5. Legal basis for processing (users in the European Union)

We process your data based on the performance of the service contract (we need your network, device, and payment data to provide you with the control panel and the membership you subscribed to) and, in the case of push notifications, based on your consent, which you can withdraw at any time by disabling them from your panel.

6. Where your data is stored and international transfers

NETXO's own database (self-hosted Convex, the infrastructure where practically everything described in section 2 lives: account, devices, domain history, usage, on-demand location) sits on a server we manage ourselves, physically located in the European Union (Paris, France). That data does not leave the EU and is not transferred to any third party that commercially exploits it.

We use two external providers, only for what's strictly necessary, and both are companies headquartered outside the EU (United States):

• Firebase Cloud Messaging (Google) — receives only the token needed to deliver a notification, never the rest of your data.
• PayPal — receives your name and email to process payment for a paid membership; for EU users, the contract is with PayPal's European entity, PayPal (Europe) S.à r.l. et Cie, S.C.A., headquartered in Luxembourg.

Since these are US-based corporate groups, some of that limited processing (a notification token, payment data) may reach infrastructure outside the EU. When that happens, it's covered by the mechanisms GDPR requires (Art. 44 onwards): the EU-US Data Privacy Framework (Google/Meta's adherence to the European Commission's adequacy decision) and/or Standard Contractual Clauses approved by the European Commission. This is not a free transfer of your data — it's the minimum necessary (an identifier or a contact detail) under legally recognized safeguards, never the rest of the information described in this policy.

7. Applicable law in Ecuador and in Spain

Ecuador — LOPDP. ACKNET is domiciled in Ecuador, so it is subject to the Organic Law on Personal Data Protection (LOPDP, 2021). Under this law:

• Competent supervisory authority: Ecuador's Superintendencia de Protección de Datos Personales (SPDP), with whom you can file a complaint if you believe your request wasn't handled properly.
• ARCO+ rights: access, rectification, cancellation, objection, and portability — already described in sections 9, 10, and 11 of this policy — are recognized for any user, whether or not they're in Ecuador.
• Minors' consent: processing a minor's data requires the consent of their parents or legal guardians. This is how NETXO works by design — see section 12: it is always the Parent/guardian who sets up and manages the minor's device, never the minor themself.

Spain/European Union — GDPR and LOPDGDD. NETXO also offers its service to users in Spain and the rest of the European Union (pricing in euros, support in Spanish, our own infrastructure hosted in the EU — see section 6). Because of that, GDPR and its Spanish implementation, the Organic Law 3/2018 (LOPDGDD), apply equally to that data, even though ACKNET is not domiciled in Spain:

• Supervisory authority: the Spanish Data Protection Agency (AEPD), for users in Spain (aepd.es); any EU user can also contact the authority of their own country.
• Minors' consent (Art. 7 LOPDGDD): same criterion as in Ecuador — the Spanish threshold is 14 years old, and it's always the Parent/guardian who manages the minor's device.
• Digital rights (Title X LOPDGDD): the right to portability (section 9) and the right to erasure/"digital forgetting" (section 11) are equally recognized.
• Legal basis: same as section 5, performance of the service contract, and express, revocable consent for push notifications.

8. Security

Passwords are stored encrypted. The token that links the router to the account, and the one that links each Mobile device, are stored as a hash or signed with HMAC (never exposed in plain text in transit) and can be regenerated at any time from the panel if you suspect they were compromised. Traffic between the app and our servers travels encrypted with TLS.

9. Your rights if you're in the European Union (GDPR)

You have the right to access your data, correct it, request its deletion, restrict or object to its processing, and to data portability. You also have the right to file a complaint with your country's data protection authority if you believe your request wasn't handled properly. To exercise any of these rights, contact us through the channels listed in this policy.

10. Your rights if you're in the United States (CCPA/CPRA)

If you're a resident of California or another state with equivalent legislation, you have the right to know what personal information we collect, to request its deletion, and to not be discriminated against for exercising these rights. As stated in this policy, we do not sell or share your personal information with third parties for advertising or commercial purposes, so a data-sale opt-out mechanism does not apply.

11. How to delete your account and your data

You can request the complete deletion of your account and all associated data (registered devices, domain history, usage statistics, saved location, and notification token) at any time, without needing to give a reason.

How to request it: message us on WhatsApp with the email address of your account, asking for your NETXO account to be deleted. You can also do this from Contact.

What gets deleted: your access account, the name and data of every device you registered, the blocked/allowed domain history, traffic and usage statistics, the last shared location, and the push notification token. Cancelling a paid subscription is done directly from PayPal.

Timeline: we process deletion within 30 days of your request, and we'll confirm through the same channel once it's complete.

For any other request related to your data rights (access, correction), the same contact channel applies.

12. Minors

NETXO does not offer sign-up or accounts of its own for minors. The account, the control panel, and any membership subscription are always managed by a responsible adult in the household or organization ("Parent").

The Mobile membership exists specifically for that adult to protect the phone of a minor in their care ("Child"): it is the Parent who installs the app on the minor's device, configures it, and grants the necessary system permissions. The data generated on that device (visited/blocked domains, connection status, on-demand location) is seen and controlled by the Parent from their own panel — the minor does not have an independent account or an admin panel. Any request to access, correct, or delete that data can be made by the Parent through this policy's contact channels.

13. Changes to this policy

If we update this policy, the new version will always be available at this same address.