Hello! The situation is not what you describe, since, according to the article we linked: 1) the CEO of Tesonet, the CEO of ProtonVPN and the CEO of CloudVPN are all the same one person. 2) CloudVPN is not a payment processor. It uses PayPal to collect subscriptions from NordVPN. It's not that you pay to NordVPN via a payment processor called "CloudVPN", you pay to CloudVPN via some payment processor (PayPal for example). In such transactions CloudVPN is not the payment processor, it is the final beneficiary of your payments. To allow such payments via a web site interaction with PayPal, PayPal wants that the beneficiary is the web site owner. Additionally, the developer of NordVPN application in the Google Play Store is CloudVPN. The developer of ProtonVPN application in the Google Play Store is Tesonet. So you know that: - CloudVPN is not a payment processor in the transaction phase, but the beneficiary of the payment - CloudVPN signs the application(s) of NordVPN (therefore it has full access to Google Play Store keys of NordVPN) - Tesonet signs the application(s) of ProtonVPN (therefore it has full access to Google Play Store keys of ProtonVPN) - the CEO of Tesonet, CloudVPN and ProtonVPN is the same person - CloudVPN introduced itself to PayPal as the web server owner of NordVPN This is a matter of trust, and when trust is involved, a lack of transparency should trigger a red alert. This is plainly incorrect even under a purely technical aspect. With Wireshark etc. you can only see that your packets go to or come from the VPN server. You have absolutely no idea of what happens once they are there, outside of your control. As an additional side note, please keep in mind that data mining does not necessarily involves inspection of the traffic content, which is rather trivial and obvious (another trivial consideration: otherwise end-to-end encryption would have meant death of intermediary data mining worldwide ). Kind regards