Surfshark

The policy is unusually transparent — specific retention periods are given for every processing activity — but servers temporarily hold your user ID and IP address during VPN sessions (deleted within 15 minutes of disconnection), app diagnostics are properly opt-in with a 7-day hard cap, and the optional Alternative Number feature routes call and SMS content through Telnyx in the US.

The third-party list is unusually well-disclosed — named providers, purposes, and countries are all specified — but Google BigQuery stores and analyzes personal data, HasOffers (Tune Inc.) handles conversion attribution, AppsFlyer and Iterable handle marketing, Telnyx (US) processes call and SMS content, and data is shared with Nord Security group companies including US entities.

Specific retention periods are stated for every data processing activity — a meaningful transparency advantage over most VPNs — GDPR rights are enforceable under Dutch law with a supervisory authority, and diagnostics are properly opt-in; but customer support records are retained for 6 years, payment data for 10 years, marketing uses a legitimate interest basis until opt-out, and automated profiling determines subscription discount eligibility.

Transparent policy with specific numbers throughout, warrant canary, published transparency report, and GDPR-enforceable rights under Dutch law are genuine strengths; but the Netherlands is a Nine Eyes intelligence-sharing country, the no-logs audit is referenced at the Trust Center rather than named in the policy, no specific encryption standards are disclosed beyond SSL/TLS, and the Nord Security group ownership creates a broad corporate data-sharing structure.