Privacy policy | gpuai.shop

1. Who we are

gpuai.shop provides on-demand GPU compute. For the purposes of data protection law we are the data controller for the account and billing information described below, and a data processor for anything you place inside your instances.

2. What we collect

Account data

Your email address, a hashed password, and your display name. We need these to give you an account and cannot provide the service without them.

Billing data

Records of credit purchases and consumption. Card details are handled by Stripe and never reach our servers — we store only the identifier Stripe gives us for the transaction and the last four digits it returns for display.

Usage data

Instance metadata: which GPU, which region, which image, when it started and stopped, and how much network it moved. We use this to bill you accurately and to plan capacity.

Technical data

Server logs containing IP address, user agent and requested URL, retained for 30 days for security and abuse investigation.

What we do not collect

We do not inspect the contents of your instances, your storage volumes or your network traffic. We do not read your data, train on it, or share it. Support staff cannot log into a running instance without you explicitly granting access, and that grant is logged.

3. Why we are allowed to process it

Data	Purpose	Lawful basis
Account data	Providing the service	Performance of a contract
Billing data	Charging you, tax records	Contract, legal obligation
Usage data	Billing, capacity planning	Contract, legitimate interests
Technical logs	Security, abuse prevention	Legitimate interests

4. How long we keep it

Account data — until you delete the account, then 30 days
Billing records — seven years, because tax law requires it
Usage data — 24 months
Technical logs — 30 days
Instance contents — erased when you destroy the instance; we keep nothing

5. Who we share it with

We share the minimum necessary with a small number of processors:

Stripe — payment processing. Their privacy policy governs card data.
Our datacentre operators — physical hosting only; they have no access to your account data.
Email delivery provider — your address, to send transactional email.

We do not sell personal data, and we do not share it for advertising. We disclose data to law enforcement only on a valid legal instrument, and we will tell you unless legally prohibited.

6. International transfers

We operate in the US, EU and India. Account data is stored in the EU. Where data moves outside the EEA we rely on Standard Contractual Clauses. You choose the region your instances run in, and instance data stays there.

7. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and complain to a supervisory authority. Email us and we will respond within 30 days. We do not charge for this and we will not make you jump through hoops.

8. Security

Passwords are hashed with bcrypt. All traffic is TLS 1.3. Access to production systems requires hardware-backed multi-factor authentication and is logged. The security page has the detail, including what we do not claim.

9. Children

The service is not directed at anyone under 16 and we do not knowingly collect their data. If you believe a child has an account, tell us and we will delete it.

10. Changes

We will email account holders at least 30 days before any material change to this policy. The date at the top always reflects the current version.