Mullvad VPN
Mullvad is one of the most privacy-friendly VPN services available, with a genuine no-logging policy, EU-only data storage, minimal data collection, and a firm commitment never to modify or spy on your traffic. The main privacy trade-off is that if you pay by card or bank transfer rather than cash or cryptocurrency, Mullvad will hold your name and payment details for up to seven years as required by Swedish law. On the service side, there are no uptime guarantees and no refund rights if you paid anonymously, though disputes can be taken to Swedish consumer authorities rather than forced arbitration. The privacy policy can be updated at any time without notice, which is the one area where Mullvad's transparency falls short of its otherwise user-friendly reputation.
Last analyzed
Heads up: this analysis is AI-generated, can be incomplete or wrong, and is not legal advice. Use it as a starting point and read the original document before you agree — see our Terms.
Clause-by-clause breakdown
Every clause we flagged in Mullvad VPN's agreement, with what it means for you.
Some payment data is kept up to seven years due to Swedish law.
“Certain payment data must be kept for the statutory retention period described in applicable local laws such as the Swedish Accounting Act (some information must be stored for seven years from the end of the fiscal year).”
Quoted verbatim from the agreement What this means: Swedish law requires Mullvad to keep certain accounting records for up to seven years. This applies to payment data like bank wire details, not VPN activity. This is a legal obligation, not a choice by Mullvad.
What you can do: Use anonymous payment methods like cash, Bitcoin, or Monero to avoid having any payment data retained at all.
Mullvad guarantees nothing about uptime and accepts no liability.
“Despite our best efforts, the service is provided on an "as is" and "as available" basis, and we do not guarantee that the service will be available at all times, nor the accuracy of the service or any material provided by the service or on the Mullvad website. You are solely responsible for your use of the service.”
Quoted verbatim from the agreement What this means: Mullvad disclaims all guarantees about service availability and accuracy, and places full responsibility for use on you. If the VPN fails and your real IP is exposed, Mullvad accepts no liability. This is standard for VPN services but worth knowing.
What you can do: Enable Mullvad's kill switch feature in the app to block internet traffic if the VPN connection drops unexpectedly.
Privacy policy can change anytime with no advance notice required.
“This Privacy policy may be updated and, in such case, a new version will be published on Mullvad's website.”
Quoted verbatim from the agreement What this means: The privacy policy can be updated at any time, and the only obligation is to publish the new version on the website. Unlike the Terms of Service, there is no commitment to advance notice or a minimum notice period before privacy policy changes take effect.
What you can do: Periodically check mullvad.net/en/help/privacy-policy for updates, as there is no guaranteed notification for privacy policy changes.
GDPR data access rights are hard to exercise due to anonymous account design.
“However, in most cases we will not be able to provide you with any data since we not store data except payment data which we cannot give out since the purpose of processing the payment data do not require identification of the data subject and would require disproportionate effort for us to further acquire or process additional information to identify the data subject (article 11 in the GDPR).”
Quoted verbatim from the agreement What this means: Because Mullvad's account system is designed to be anonymous, they cannot easily link payment data back to you as an individual. This means exercising your GDPR right to access or delete your data is practically difficult — though this is a consequence of their privacy-by-design approach, not a hostile policy.
What you can do: If you paid by a method that creates a record (e.g. PayPal or bank wire), contact [email protected] with your transaction details to request data access or deletion.
Non-anonymous payment methods give Mullvad your name and contact details.
“Bank wire: sender name, address, bank account number PayPal: transaction-ID, sender name, origin country and e-mail address Swish: Swish-ID, name and phone number Stripe: Stripe charge ID, expire date, last 4 digits of the card, card type and origin country Since we support 14-day refunds, and because we encounter certain transaction issues (for example, double payments and subscription problems), we need to be able to track payments (i.e. if you use PayPal or Stripe) in order to give customers the service we offer. Transaction_id is permanently deleted after 20 days. Certain payment data must be kept for the statutory retention period described in applicable local laws such as the Swedish Accounting Act (some information must be stored for seven years from the end of the fiscal year). If not required by law or stated above, the data will be stored for no longer than necessary for the purpose. After the statutory retention periods, the data will be permanently deleted.”
Quoted verbatim from the agreement What this means: If you pay by bank wire, PayPal, Swish, or Stripe, Mullvad receives identifying information such as your name, address, email, or phone number. This data is retained for up to 20 days for transaction IDs and up to seven years for accounting records required by Swedish law.
What you can do: Pay with cash, Bitcoin, Monero, or Bitcoin Cash to avoid providing any personal payment data to Mullvad.
Cash and crypto payments are excluded from the 14-day refund guarantee.
“We offer users a 14-day money-back guarantee. The 14-day period starts when your payment is made. Exceptions We do not offer refunds for cash and crypto payments. Refund requests for purchases made through the App Store or a reseller must be made directly with them.”
Quoted verbatim from the agreement What this means: A 14-day refund window exists, but it does not apply to cash or cryptocurrency payments — the most privacy-preserving options. Users who prioritise anonymity by paying with cash or crypto give up their refund rights entirely.
What you can do: If you want to test the service before committing, consider an initial payment by card to retain refund eligibility, then switch to anonymous payment methods for renewals.
Mullvad never logs your VPN activity or metadata.
“It is therefore our policy to never store any activity logs or metadata and to have as minimal data retention as possible.”
Quoted verbatim from the agreement What this means: Mullvad explicitly commits to never logging your VPN activity or metadata. This is the core promise of a privacy-focused VPN and goes beyond what most providers offer. It means your browsing, connection times, and IP addresses are not recorded.
What you can do: Verify this claim by checking Mullvad's published independent audits of their no-logging policy, which they reference on their website.
Your data never leaves the EU/EEA.
“No. We only store and process your personal data within the EU/EEA.”
Quoted verbatim from the agreement What this means: All personal data Mullvad holds stays within the EU and EEA, meaning it is subject to GDPR protections. Your data is never transferred to countries with weaker privacy laws, such as the US.
Mullvad does not profile you or use automated decision-making.
“No automated decision making (including profiling) takes place.”
Quoted verbatim from the agreement What this means: Mullvad explicitly states it does not use automated systems to profile you or make decisions about you. This is a meaningful commitment that many services omit.
Only strictly necessary cookies are used — no tracking or ads.
“This website uses only necessary cookies that are crucial for the proper operation of the website and are not used for any other purposes – or by any other organisation – than listed herein.”
Quoted verbatim from the agreement What this means: Mullvad's website uses only functional cookies needed to operate the site — login sessions, language preference, CSRF protection, and Stripe payment processing. There are no advertising, analytics, or tracking cookies.
Support emails are automatically deleted after 70 days.
“After "solving" or "closing" a support case/problem report, all related emails/problem reports are archived (removed from the inbox). After 70 days, all emails/problem reports sent to our support address are automatically, permanently erased (from inbox, deleted items, sent items, trash, and archives).”
Quoted verbatim from the agreement What this means: Support emails are automatically and permanently deleted 70 days after a case is closed. This is a concrete, time-limited retention commitment that protects users who contact support.
What you can do: Avoid including unnecessary personal details in support emails, as your email address and message content are retained for up to 70 days.
Payment transaction IDs are deleted within 20 days.
“Transaction_id is permanently deleted after 20 days.”
Quoted verbatim from the agreement What this means: Payment transaction IDs (used for PayPal and Stripe) are deleted within 20 days. This is a short, clearly defined retention window that limits how long payment-linked data is held.
You get one month's notice before any terms changes take effect.
“Any material changes to these terms will be notified via a prominent notice on mullvad.net/blog at least one month before the changes are applied. If you wish to exercise your right to reject such changes, you should stop using the service (for refunds, see below).”
Quoted verbatim from the agreement What this means: Mullvad gives at least one month's advance notice of material changes and posts them on their blog. This is better than most services, which use consent-by-continued-use with little or no notice. You can reject changes by stopping use of the service.
What you can do: Follow Mullvad's blog at mullvad.net/blog to stay informed of any upcoming changes to the terms.
Disputes go to Swedish consumer board or courts — no forced arbitration.
“The terms shall be construed in accordance with and governed by the substantive laws of Sweden. Any dispute, controversy, or claim arising out of or in connection with the terms shall be handled by the National Board for Consumer Disputes (ARN) or the Swedish courts, with the city of Gothenburg's district court as the court of first instance.”
Quoted verbatim from the agreement What this means: Disputes are handled under Swedish law, either through the ARN (a free consumer dispute body) or Swedish courts. This is actually user-friendly compared to forced arbitration clauses — the ARN is a legitimate, accessible consumer protection mechanism.
Data is only shared with payment and email providers under confidentiality.
“Your personal data will only be shared with third party suppliers who are performing services on our behalf and for the purposes stated above. The categories of such recipients are e-mail service providers and payment solution suppliers (which are subject to confidentiality).”
Quoted verbatim from the agreement What this means: Mullvad only shares your data with service providers (email and payment processors) who are contractually bound to confidentiality. There is no sale of data or sharing with advertisers.
App bug reports automatically strip out your IP and account number.
“Problem reported by the app: Redacted program logs, app version and operating system are sent. IP-addresses, account numbers, sensitive path and other PII are not sent. Please refrain from entering any personal data when reporting a problem by the app.”
Quoted verbatim from the agreement What this means: When you submit a bug report through the app, IP addresses and account numbers are automatically stripped out before sending. Only redacted logs, app version, and OS are transmitted.
What you can do: Avoid typing personal details into the free-text fields of in-app problem reports, as those are not automatically redacted.
Retention periods are short, specific, and publicly committed to.
“Transaction_id is permanently deleted after 20 days. Certain payment data must be kept for the statutory retention period described in applicable local laws such as the Swedish Accounting Act (some information must be stored for seven years from the end of the fiscal year). If not required by law or stated above, the data will be stored for no longer than necessary for the purpose. After the statutory retention periods, the data will be permanently deleted. After "solving" or "closing" a support case/problem report, all related emails/problem reports are archived (removed from the inbox). After 70 days, all emails/problem reports sent to our support address are automatically, permanently erased (from inbox, deleted items, sent items, trash, and archives).”
Quoted verbatim from the agreement What this means: Mullvad publishes specific, short retention windows: payment transaction IDs are deleted after 20 days, support emails are permanently erased after 70 days, and legally required accounting data is deleted after the statutory period ends. This level of specificity is rare and user-protective.
Mullvad explicitly promises never to modify or inject data into your traffic.
“We do not modify, redirect, or inject data into users' traffic. We do not block or filter domains except when requested by the owner of an IP address or when known botnet addresses cause our servers to be null-routed by hosting providers.”
Quoted verbatim from the agreement What this means: Mullvad explicitly commits to not tampering with your traffic in any way — no injecting ads, no redirecting requests, and no domain filtering beyond narrow technical exceptions. This is a meaningful user-protective commitment that many VPN providers do not make explicitly.
Frequently asked questions
Is Mullvad VPN's Terms & Conditions agreement fair?
- BeforeYouClick grades Mullvad VPN A on an A–E scale, where A is the fairest. Its agreement contains 0 critical clauses, 6 warnings and 12 good practices.
How long does it take to read Mullvad VPN's terms?
- Mullvad VPN's agreement takes about 72 minutes to read in full, across 18 clauses we reviewed. The summary on this page covers the same ground in under a minute.
When was Mullvad VPN's agreement last analyzed?
- We last read Mullvad VPN's Terms & Conditions on July 4, 2026. Companies change their terms without notice, so check the original document for the current version.
Is this analysis legal advice?
- No. This analysis is AI-generated, can be incomplete or wrong, and is not legal advice. Use it as a starting point and read the original agreement before you agree to it.
More agreements to read
- MurenaSecurityGrade B
- NordVPNSecurityGrade B
- BitwardenSecurityGrade C
- IVPNSecurityGrade C
- DuckDuckGoSecurityGrade C
- ProtonVPNSecurityGrade D