4. SCAM AND PHISHING PROTECTION BY NORDVPN The data we process about the users of NordVPN's Scam and Phishing Protection service depends on how they use this service, but in general, we only process the information that is necessary for the service. Scam and Phishing Protection service (included in all NordVPN subscription plans at no additional charge) is a DNS-based service that checks domains against known malicious or unsafe domain lists and blocks ads, trackers, and harmful sites. It does not use any personal data other than what is strictly necessary for the provision of the NordVPN. Scam, Phishing, and Malware Protection service (the advanced version provided with certain NordVPN plans), is a security service that provides enhanced protection against multiple online threats. It processes only the minimal technical information required to identify harmful activity and does not collect or store your browsing history, the content of the pages you visited, the content of your communications, or any other similar personal data. Scam, Phishing, and Malware Protection has several sub-features: Advanced browsing protection, which identifies unsafe or suspicious websites before you interact with them. It checks domain names, URLs, publicly available crypto-wallet 06/09/2026, 14:20 Privacy Policy - Nord Account https://my.nordaccount.com/legal/privacy-policy/nordvpn/ 3/7
addresses found online, and limited hashed cookie data against databases of known malicious or fraudulent resources. This allows the feature to block harmful domains, detect fraudulent crypto-wallets, warn about phishing or scam sites, flag potentially risky search results, identify possible session hijacking, and check emails for suspicious links. All processing takes place in real time and uses only the data strictly necessary to detect threats. Most analysis occurs locally on your device and, in limited cases, minimal non-personal indicators (such as websites "reported as safe") may be sent to our threat intelligence systems solely to verify suspected threats and improve functionality. Ad and tracker blocker, which helps reduce unwanted advertisements and limit third- party tracking. It operates locally on your device by comparing domains and URL elements against advertising and tracking blocklists to block ads, restrict tracking scripts, and remove tracking parameters from URLs. If you have provided your consent to sharing Application-level analytics data, we may in certain limited cases process minimal anonymous indicators related to feature performance (for example, whether a blocking rule was applied) to improve the effectiveness of the feature. Such information cannot be linked to an individual user. Anti-malware scans newly downloaded files to determine whether they are malicious and, depending on the device's operating system, installed applications for known security vulnerabilities. For this purpose, we only process the scan results (that is, whether a file was identified as malicious and whether the scan was completed successfully). We may also process the URL from which a file was downloaded to help identify and block harmful sources. For vulnerability scanning, which is available on the Windows platform, we only process the application name and version to check for known vulnerabilities. When the initial file scan cannot tell if a file is malicious, that file may be uploaded to the cloud for a deep scan to detect malware. This option is only available for users that have enabled cloud-based threat scanner functionality. Only executable files may be uploaded for this purpose - other file types, which may contain personal data (such as .doc, .pdf, .jpg), will never be uploaded. Files sent to the cloud are processed in a way that ensures anonymity: we only analyze the technical indicators required for detection (such as file hashes or minimal metadata) and do not access or retain the full contents of the file. Scam, Phishing, and Malware Protection also displays statistics on how this service operates, such as the number of malicious files identified, items blocked, and similar metrics. This information is stored locally on your device and shown only to you. We may 06/09/2026, 14:20 Privacy Policy - Nord Account https://my.nordaccount.com/legal/privacy-policy/nordvpn/ 4/7
receive only aggregated totals to monitor overall performance, with no link to individual users.
5. OTHER SERVICES/FEATURES BY NORDVPN Meshnet. This service enables you to establish a point-to-point connection and route your online traffic through another device belonging to you or another NordVPN user. When you use this service, we process the following information: details on the connections and permissions you've created, the device's OS and its version, the hashed device ID, and the user's email address. If you use file sharing, we also process anonymized information about the number of files transferred, file sizes, and the type of documents (extensions) shared. Dedicated IP. A dedicated IP address is a unique internet protocol ("IP") address assigned exclusively to the user. The dedicated IP service is a subscription that gives the user a specific dedicated IP address (this IP address may be assigned to other users afterwards). Please be aware that if you purchase a dedicated IP address, your email and information related to your account will be linked to that IP address. Dedicated server. A dedicated server is a private virtual server exclusively allocated to a single user. The dedicated server service is a subscription that provides the user with isolated hardware resources and a static dedicated IP address for the subscription period (this server may be reallocated to other users afterwards). Please be aware that if you purchase a dedicated server, your email, IP address, and information related to your account will be linked to that server. Smart DNS. The Smart DNS service replaces the DNS server address provided by your internet service provider with a different one. Please be aware that this does not provide you with a new IP address. Due to the nature of this service, we have to store your IP address on our systems when you activate the SmartDNS service. Dark Web Monitor. This service scans whether your email address or any of the other assets you've added to monitoring have appeared in any known data leaks. All generated reports for an asset are wiped as soon as you remove it from monitoring. Transaction Monitoring. This service allows you to link your bank accounts to enable monitoring of your financial transactions for suspicious or unusual activity. To provide this service, we connect to your bank using a third-party platform, retrieve your transaction history, and use an automated analysis, which may include machine learning, to derive statistical patterns that represent typical account activity. These patterns are used as a reference point to analyze new transactions and alert you to potential fraudulent activity. 06/09/2026, 14:20 Privacy Policy - Nord Account https://my.nordaccount.com/legal/privacy-policy/nordvpn/ 5/7
To ensure ongoing monitoring performance, we check your latest account activity against these statistical patterns. By enabling this feature, you authorize the retrieval and real-time processing of your transaction data solely for the purpose of detecting unusual activity and generating security alerts. To provide the service, we process transaction amounts, counterparties, timestamps, and geographic or currency-related indicators. We do not store individual transactions: once the relevant statistical patterns have been derived, the underlying details are discarded and are not retained on our infrastructure. The only data we retain is linked bank account information, including institution name, account type, account display name, and the last four digits of the account number, together with the derived statistical patterns necessary to continue providing the monitoring service. When you remove a linked account from monitoring, we immediately lose access to your account data through the third-party platform, and we delete the last four digits of the associated account number, as well as generated alerts, and all derived statistical patterns related to that account. Call Protection. This service identifies and flags incoming phone calls, such as potential scams or other potentially unwanted call types. We only process the incoming call data that is strictly necessary to provide this service. We never access or process the actual content of the call - we only process metadata such as the caller's phone number, its assigned reputation flag, and, if available, the caller ID. This information is handled based on our legitimate interest to protect users from the widely recognized risks associated with scam and fraudulent calls. Where necessary, we engage trusted data processors to support the caller reputation and flagging functionality. Message Protection. This feature helps identify potentially harmful SMS messages - such as scams or other suspicious content - in real time. When you receive an SMS from an unknown sender, the message content, any included URLs, and the sender's phone number are analyzed by our backend to assess the potential risk of the message. We do not store SMS message content on our servers. Message content is used only for real- time threat assessment and is not retained after threat analysis. Limited information is stored only on your device for functionality and usage insights, such as the time a message was checked and the resulting threat classification. Back to the general Privacy Policy 06/09/2026, 14:20 Privacy Policy - Nord Account https://my.nordaccount.com/legal/privacy-policy/nordvpn/ 6/7
Support center Terms of service Privacy policy © 2026 Nord Security. All rights reserved. English 06/09/2026, 14:20 Privacy Policy - Nord Account https://my.nordaccount.com/legal/privacy-policy/nordvpn/ 7/7