Guide to reading your Data Subject Access Request 
 
TunnelBear is an easy-to-use privacy service that prioritizes personal security and simplicity 
in our applications. We believe that the world is a better place when everyone has access to 
an open and unrestricted internet. 
 
At TunnelBear, we’ve built our service with a focus on collecting the minimal amount of 
information needed to operate our network. All data collection, usage and retention is 
mapped and documented so that it can be continuously audited by our privacy team. 
 
The tables below will help you read the files in your data download and learn how it relates 
to our privacy policy. If you have any questions, please reach out to 
privacy@tunnelbear.com. 

Personal Data Captured and Stored by TunnelBear 

 
We think about personal data in two ways at TunnelBear: data that needs to be retained to 
operate your account and data that is temporary which we can delete on a retention 
schedule. 
 
All the data that TunnelBear collects and stores for the lifetime of your account is stored in 
Canada. This information is not transferred to any other country or company. 
 
Primary personal data storage 
 
The majority of TunnelBear’s personal data is stored in VMFarms facilities, a company 
based in Toronto, Canada, that is SOC type II certified. The complete set of personal data 
stored in this database is listed below.  
 
Record type  Data descriptions  Retention period  Privacy policy  DSAR Table / 
column 

Account  Email address  Retained until  Section 1.2  Users.csv/ 

information  account deletion  user 

Account  Twitter ID  24 hours  Section 1.2  Users.csv/ 

information  (optional)  twitterId 
 Account  Paid account status  Retained until  Section 1.2  Users.csv/ 
information  account deletion  fullversion, 
fullversionUntil, 
paymentStatus 

Operational  Device and app  Retained until  Section 1.3  Users_data.csv/ 

information  information  account deletion  version 

Operational  Total amount of  Reset on the last  Section 1.3  Users_data.csv/ 
information  data used this  day of calendar  packetsTotal 
month  month 

Operational  Last time your data  Reset in month of  Section 1.3  Users_data.csv/ 
information  was updated -  last usage  dataLastUpdated 
obfuscated to a 
monthly timestamp 

Payment  Fraud prevention  Retained until  Section 1.4  Card_audit.csv/ 

information  details - Last 4  account deletion  last4 
digits, last name  last_name 
and email address