1. Who we are
KatLink is a VPN service operated by KATSOFT ("KatLink", "we", "us"). KATSOFT is the data controller for the personal data described here. You can reach us through our contact page.
2. Information we collect
Account information
- Your name, email address and, if you provide it, your phone number.
- Your password, stored only as a one-way cryptographic hash. We can't see or recover your password.
Purchases
- The package you bought, the amount, the date, and the payment reference and status returned by our payment provider.
- Card payments are handled entirely by the payment provider. We never receive or store your full card number.
VPN service records
To provide your packages, enforce time and data limits, and help with problems, we record:
- The public key of each device configuration and the private VPN address assigned to it.
- Which gateway serves your device and when your device last connected (the WireGuard "handshake" time).
- How much data each device sent and received through the gateway.
Security and support records
- When you log in: the time, your IP address and your browser's user-agent string, so you can review active sessions and we can detect misuse.
- A record of important account changes, such as password changes, for security auditing.
- Messages you send to support.
3. What we don't collect
Our gateways route your traffic so it can reach the internet. We do not record the websites you visit, the content of your traffic, or the content of your communications.
4. How we use your information, and our lawful basis
- To provide the service (performance of our contract with you): creating your account, activating packages, generating device configurations, and enforcing package limits.
- To keep the service secure (legitimate interests): preventing fraud, abuse and unauthorised access, and investigating breaches of our Acceptable Use Policy.
- To meet legal obligations: keeping financial records and responding to lawful requests.
- To contact you about your account, packages and support requests. We will not send marketing messages without your consent.
5. Who we share it with
We don't sell your personal data. We share it only with:
- our payment provider, to process payments;
- hosting and email delivery providers that run our infrastructure on our behalf, under contract;
- authorities, when the law requires us to. We will disclose only the records we actually hold, which are described above.
Some of our servers and service providers may be located outside Nigeria. When data is transferred abroad, we take the steps required by the Nigeria Data Protection Act 2023.
6. How long we keep it
- Account information: while your account is open, then deleted or anonymised within 90 days of closure.
- Purchase and payment records: 6 years, to meet financial record-keeping requirements.
- VPN service records: up to 12 months after the related package ends.
- Login and security records: up to 12 months.
- Support messages: up to 24 months.
We may keep information longer if we are legally required to, or to resolve a dispute.
7. How we protect it
We use encrypted connections (HTTPS), strong password hashing, access controls that limit who can see customer data, and audit logs of administrative actions. No system is perfectly secure, but we work to protect your information and will notify you and the regulator of a personal data breach where the law requires.
8. Your rights
Under the Nigeria Data Protection Act 2023 you can ask us to:
- give you a copy of the personal data we hold about you;
- correct inaccurate data;
- delete your data, where we don't need to keep it for a legal reason;
- restrict or object to certain processing;
- give you your data in a portable format;
- withdraw consent you have given, at any time.
To make a request, contact us from the email address on your account. You also have the right to complain to the Nigeria Data Protection Commission.
9. Cookies
We use only cookies that are essential for the site to work: one that keeps you logged in, and one that protects forms against cross-site request forgery. We don't use advertising or analytics cookies.
10. Children
KatLink is not intended for children. You must be at least 18, or have the consent of a parent or guardian, to create an account.
11. Changes to this policy
If we make significant changes, we will update the date at the top of this page and let account holders know by email or in the dashboard.