Privacy Policy

1.1Murphy Proxies is operated by MURPHYHOLDING OÜ, a company registered in Estonia. We act as the data controller for the personal data processed through https://murphyproxies.com.

1.2You can reach our team at contact@murphyproxies.com for any privacy-related question.

2.1Account data: email address, hashed password (or OAuth identifier when you sign in via Google), display name, and account creation date.

2.2Billing data: full name, company name, billing address, country, VAT number, and the payment-method metadata returned by our payment processor (last 4 digits, brand, expiry). We never store the full card number - it is handled exclusively by Stripe.

2.3Service usage data: the proxy plans you purchase, bandwidth consumed, gateway access logs (timestamp, source IP, target host) retained for security and abuse prevention, and dashboard activity.

2.4Technical data: device, browser, IP address, referrer, pages visited, and interactions, collected through Google Tag Manager / Google Analytics 4 to operate, secure and improve the website.

2.5Audience measurement data, collected by our own first-party tool (see section 5): pages visited, time spent and scroll depth, clicks on links and buttons, the steps reached in the checkout and any error shown there, promo codes tried, page loading speed, technical errors, device type, browser, operating system, screen width, language, time zone and country. When you are signed in, these events are linked to your account.

2.6Marketing data: UTM parameters and click IDs (gclid, fbclid) used to attribute campaigns when you reach us from an ad or partner.

2.7Bot protection data: when you pay, Cloudflare Turnstile checks in the background that the payment is made by a person and not by an automated script. To do so it processes your IP address and technical signals from your browser and device (see section 6).

3.1Provide and operate the service (Art. 6(1)(b) GDPR - contract performance): account, billing, delivery and support.

3.2Ensure security, prevent fraud and abuse (Art. 6(1)(f) GDPR - legitimate interest): gateway logs, anti-abuse signals, and the bot check run at checkout to stop payments made with stolen cards.

3.3Comply with legal obligations (Art. 6(1)(c) GDPR): accounting records, tax invoicing, responses to lawful requests.

3.4Improve the service and measure marketing (Art. 6(1)(a) GDPR - consent, via the cookie banner): analytics cookies, advertising cookies.

3.5Measure the audience of the website and improve the checkout with our own first-party tool (Art. 6(1)(f) GDPR - legitimate interest in understanding how the site is used and why purchases fail). You can object at any time, as explained in section 5.

4.1Strictly necessary cookies: session, authentication, CSRF protection. These cannot be disabled.

4.2Analytics cookies (Google Analytics 4 via Google Tag Manager): only set after you accept the cookie banner.

4.3Advertising cookies (Google Ads conversion tracking, Meta pixel if enabled): only set after consent.

4.4You can change your choices at any time by clicking "Cookie settings" in the footer of the site.

5.1Besides the tools above, we measure how the website is used with our own tool, hosted on our own servers. It sets no cookie. It keeps a random visitor identifier and a session identifier in your browser's local storage. The visitor identifier is renewed after 13 months.

5.2It records the audience measurement data listed in section 2. We do not store your IP address for this purpose, and we remove email addresses and IP addresses from recorded labels and error messages.

5.3When you are signed in, the events are linked to your account. We use this to understand which pages and campaigns bring customers, where the checkout fails, and whether customers come back. We also use it to follow up on a checkout you started but did not complete.

5.4This data is never sold, never shared with advertising networks and never used to build profiles for third parties. Only our team can access it.

5.5You can object at any time with the button below, which also deletes the identifiers stored in your browser. We also honour the Global Privacy Control and Do Not Track signals: if your browser sends one, nothing is recorded.

6.1Payment processing: Stripe Payments Europe Ltd. (Ireland).

6.2Hosting and infrastructure: Vercel Inc. (United States), with Standard Contractual Clauses in place.

6.3Email delivery and account communications: our transactional email provider.

6.4Analytics and advertising: Google Ireland Limited (Google Analytics, Google Ads, Google Tag Manager).

6.5Bot protection at checkout: Cloudflare, Inc. (United States), through Cloudflare Turnstile, which runs in invisible mode. Its processing of your data is governed by the Cloudflare Turnstile Privacy Addendum.

6.6Our own audience measurement data stays on our own infrastructure and is not shared with any third party.

6.7We never sell your personal data to third parties.

7.1Some of our service providers are based outside the European Economic Area (EEA). Transfers to such providers are governed by the European Commission Standard Contractual Clauses and any additional safeguards required by GDPR.

8.1Account and billing data: kept for the duration of your account plus 10 years after the last invoice (tax law requirement).

8.2Gateway access logs: retained for up to 30 days for security and abuse-prevention purposes, then deleted or anonymised.

8.3Analytics data: up to 14 months in Google Analytics 4.

8.4Our own audience measurement events: up to 25 months, then deleted automatically. The visitor identifier in your browser is renewed after 13 months.

8.5Marketing identifiers (click IDs, UTM): up to 90 days.

9.1You have the right to access, rectify, delete, restrict, port your personal data, and to object to processing based on legitimate interest. You may also withdraw your consent at any time.

9.2To exercise these rights, email us at contact@murphyproxies.com. We will reply within 30 days.

9.3If you believe your rights have been violated, you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or with the supervisory authority of your country of residence.

10.1We protect your data using TLS 1.2+ in transit, encryption at rest where applicable, hashed and salted passwords, role-based access control, and least-privilege principles. Payment data is handled exclusively by Stripe (PCI DSS Level 1).

11.1We may update this Privacy Policy from time to time. The "Last updated" date below indicates the date of the most recent change. Material changes will be notified by email or via a banner on the site.