Privacy Policy

Information you give us:

• Account details: name, email address, password (stored only as a salted hash), country, phone number, and optional organization name.
• Onboarding details: company, role, company size, primary use case, workloads, expected spend, and how you heard about us.
• Billing details: the amounts you fund, a record of each purchase, and payment status. Card and bank details are collected and held by Stripe, not by us.
• Console inputs: SSH public keys, volume names and sizes, YAML configuration, instance settings, storage connector settings and credentials you choose to provide.
• Communications: messages to support and your marketing preferences.

Information collected automatically:

• Usage and log data: instance start and stop events, resource usage, API requests, job logs, errors and performance metrics.
• Device and network data: IP address, browser type, operating system, referring pages, and approximate location derived from IP.
• Cookies and similar technologies: a session cookie to keep you signed in and security cookies to protect your account.

Information from others: if you sign in with Google we receive your name, email address, profile picture and a Google account identifier, as permitted by your Google settings. Stripe tells us whether a payment succeeded.

Customer Content, such as prompts, datasets, weights and generated outputs that you run through the Services, is processed on your behalf. See the section on customer content below.

• To provide the Services: create and secure your account, authenticate you, run instances, meter usage, apply credits and process payments.
• To communicate with you: send transactional messages such as receipts, balance warnings, security alerts, outage notices, and changes to our terms.
• To send marketing, only if you opted in: product news, launch announcements and offers. You can withdraw consent at any time.
• To size capacity and improve the Services: analyze aggregated usage, diagnose problems, develop features, and tailor your console and recommended models.
• To keep the Services safe: detect and prevent fraud, abuse, and violations of our Terms, and enforce our rights.
• To meet legal obligations: tax, accounting, sanctions screening, and responding to lawful requests.

Where the GDPR or UK GDPR applies, our legal bases are: performance of a contract (providing the Services); legitimate interests (security, fraud prevention, product improvement, and direct communication with customers); consent (marketing, and optional cookies where required); and legal obligation.

We process prompts, datasets, model weights, checkpoints, outputs, and files you store on volumes only to run the Services for you, and to secure and troubleshoot them.

We do not use Customer Content to train our own generative models, we do not sell it, and we do not use it for advertising.

Our staff do not access Customer Content except where you ask for support, where needed to investigate abuse or security issues, or where required by law.

When you connect Amazon S3, Microsoft Azure or Google Cloud storage, we use the credentials you provide solely to read and write the locations you specify.

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We share it only as follows:

• Service providers acting for us, under contract: cloud and GPU infrastructure, database hosting (Neon), payment processing (Stripe), authentication (Google, when you choose it), email delivery, error monitoring and analytics.
• Professional advisers such as lawyers, auditors, and insurers.
• Authorities and other parties when we believe disclosure is required by law, to protect people's safety, or to enforce our Terms.
• A successor, in a merger, acquisition, financing or sale of assets, subject to this Policy or notice to you.
• Others with your consent or at your direction, such as when you connect a third-party storage account.

During signup you can choose whether to receive product and marketing communications from us by email and, where you provided a phone number, by phone or text message. This choice is optional and separate from accepting our Terms. We record the time of your choice.

You can withdraw consent at any time using the unsubscribe link in an email, by replying STOP to a text message, or by emailing us. We will still send necessary service messages such as receipts and security notices.

We are based in the United States and our providers may process information in the United States and other countries that may have different data protection laws than where you live. When we transfer personal information from the EEA, UK or Switzerland, we use appropriate safeguards such as the European Commission's standard contractual clauses and, where applicable, the UK addendum.

We keep personal information only as long as needed for the purposes above. Account and onboarding data are kept while your account is open and for a reasonable period afterwards. Billing records are kept as required for tax and accounting. Operational logs are retained for a limited rolling period. Customer Content on volumes is deleted after your account closes, following a short recovery window. Security and legal needs may require us to keep some information longer.

We use safeguards designed to protect personal information, including encryption in transit, hashed passwords, access controls, network isolation between customers, and logging of administrative access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach affecting your personal information we will notify you and regulators as the law requires.

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of, and obtain a portable copy of your personal information, and to withdraw consent at any time. You may also have the right to lodge a complaint with your data protection authority.

To exercise a right, email us at the address below from your account email. We may need to verify your identity, and we will respond within the time required by law. You will not be treated unfairly for exercising your rights.

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas and other U.S. states with privacy laws may have additional rights, including to know the categories of information we collect and to opt out of sale, sharing and targeted advertising. We do not sell or share personal information as those terms are defined, and we do not knowingly process sensitive personal information to infer characteristics.

Cookies: we use essential cookies needed for sign-in and security. You can block cookies in your browser, but the console will not work without them.

The Services are intended for adults and are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

When you build an application on the Services and process personal information of your own users, you determine the purposes and means of that processing and we act as your processor. We will process that information only on your documented instructions, ensure personnel are bound by confidentiality, apply appropriate security, assist you with data subject requests, and delete or return it on termination. If you need a signed data processing addendum, contact us.

We may update this Policy from time to time. We will post the new version here with a new date and, for material changes, notify you by email or in the console before they take effect.