Privacy Policy
Data Controller
Ali Lamari, trading as CUDAnetes
Heideweg 31
34131 Kassel, Germany
Email: [email protected]
Wirtschafts-Identifikationsnummer: DE463338288-00001
CUDAnetes is a small business under § 19 UStG. See the Impressum for provider details.
What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, password hash, email verification status, plan and role | Account creation, login, contract administration | Contract performance |
| Session token, IP address, user agent, session timestamps | Authentication and account security | Contract performance; legitimate interest |
| Platform API keys (hashed), Vast.ai API key, proxy auth key, registry login (encrypted) | Authenticating requests and operating deployments on your behalf | Contract performance |
| Deployment configuration: image reference, args, environment variables, ports, GPU type, schedule, event history | Provisioning, monitoring, scaling and troubleshooting your deployment | Contract performance |
| Operational logs: IP address, user/deployment IDs, request metadata, errors, timestamps | Security, abuse prevention, debugging and service integrity | Legitimate interest |
| Polar customer and subscription IDs, plan; payment details are handled by Polar | Billing, plan enforcement and tax records | Contract performance; legal obligation |
| Feedback and support messages: email, plan, category, message, page URL, correspondence | Responding to bug reports, support requests and product feedback | Legitimate interest; contract performance |
| Browser storage: session cookie, theme preference, one-time toast | Authentication, appearance and short-lived UI notices | Strictly necessary / functional |
We do not use advertising trackers, marketing pixels, or analytics cookies. We do not sell your data or send marketing emails. We do not use automated decision-making with legal effect.
We receive data from you, your browser, Polar (subscription status) and Vast.ai (instance status). You provide account and deployment data voluntarily, but we cannot provide the service without the account and deployment data needed to operate it.
Deployment processing and roles
Docker image references and deployment configurations are stored on our servers for the duration of your deployment. The images themselves are pulled by Vast.ai; we do not store container images. Container runtime data (logs, model outputs, application data) is processed on your Vast.ai instances and is not stored by CUDAnetes. We retain deployment metadata (timestamps, status, GPU type, events) to operate the service and troubleshoot failures.
For personal data you process inside your containers, you are the controller and CUDAnetes acts as a processor to the extent we handle that data. Business customers can request a data processing agreement (DPA/AVV) at [email protected]. Our subprocessors are OVHcloud, Cloudflare and Fastmail. Vast.ai is not our subprocessor: we do not have a Vast.ai account and you contract with Vast.ai directly under your own account.
Third-party services and recipients
| Service | Purpose | Location |
|---|---|---|
| OVHcloud | Infrastructure and database hosting | EU (France) |
| Cloudflare | DNS, CDN, tunnel and security filtering | Global (US company) |
| Fastmail | Transactional email delivery (OTP, notifications) | EU region (Amsterdam); provider based in Australia |
| Polar | Merchant of Record: checkout, payments, subscriptions and tax | US |
| Vast.ai | GPU infrastructure you rent directly from Vast.ai under your own Vast.ai account; CUDAnetes is not a Vast.ai customer | Global |
Polar acts as an independent controller for payment and tax data; we receive subscription status and identifiers, not card details. We do not have a Vast.ai account or a direct contract with Vast.ai: you contract with Vast.ai under your own account. We transmit the deployment configuration and your Vast.ai API key to Vast.ai on your instructions. Vast.ai is therefore your provider, not our subprocessor, and a CUDAnetes DPA with Vast.ai is not applicable. Cloudflare and Fastmail process data on our instructions; their standard data processing terms apply.
Where our subprocessors or Polar process personal data outside the EEA, we rely on their data processing agreements and, where required, Standard Contractual Clauses or another lawful transfer mechanism. Fastmail is configured for its EU data region.
Cookies and browser storage
We use one strictly necessary HTTP-only session cookie for authentication. It is host-only, Secure, SameSite=Lax, and expires after 30 days of inactivity. We also store your theme preference in localStorage and a one-time UI notice in sessionStorage. These are functional and do not track you across sites.
Cloudflare may process technical request data (such as IP address and request metadata) for security and delivery. Polar's checkout runs on polar.sh and uses its own cookies and privacy policy. We use no advertising, analytics, or marketing cookies.
Data retention
- Account data — retained until you delete your account
- Deployment configurations — retained until the deployment is deleted
- Deployment event history — up to 6 months while the deployment exists
- Container runtime data — not stored by us; processed on your Vast.ai instances
- Operational logs — up to 60 days
- Database backups — up to 14 days
- Feedback submissions — up to 12 months; removed when you delete your account
- Session tokens — expire after 30 days of inactivity
- Invoices and accounting records — 8 years where a statutory retention duty applies
- Polar transaction records — retained by Polar under its own legal obligations
When you delete your account, we remove active account data and request deletion of the Polar customer. Backups, logs and statutory accounting records may remain for the periods above. Data in backups is not used for any other purpose and is overwritten by the normal backup cycle.
Your rights
Under GDPR you have the right to:
- Access — receive a copy of the data we hold about you
- Correction — have inaccurate data corrected
- Deletion — request erasure of your data ("right to be forgotten")
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interest
- Restriction — request that we limit how we process your data
- Withdrawal — withdraw any consent you have given, with effect for the future
To exercise any right, email [email protected]. We may ask for information to verify your identity and will respond within one month.
You also have the right to lodge a complaint with a supervisory authority. Our competent authority is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)
Wilhelmstraße 7
65185 Wiesbaden
Germany
Phone: +49 611 1408-0
Email: [email protected]
datenschutz.hessen.de
Security
Account data and deployment metadata are stored on EU infrastructure (OVHcloud, France). Traffic to CUDAnetes endpoints is encrypted in transit (HTTPS/TLS). Traffic between CUDAnetes and a GPU worker, and direct worker URLs, uses plain HTTP; do not send sensitive data over worker URLs unless your container terminates TLS itself.
Platform API keys are stored as hashed values — we cannot retrieve your raw key. Your Vast.ai API key, proxy auth key and registry login are encrypted at rest (AES-256-GCM) and only decrypted to operate your deployment. Other deployment configuration, including environment variable values you provide, is stored in our database; do not store secrets there unless necessary.
Access to production systems is restricted and logged. We maintain backups and review security issues as they arise. If a data breach affects your rights, we will notify you and the competent authority where legally required.
Changes to this policy
We will notify registered users by email at least 14 days before material changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.
Contact
Ali Lamari, trading as CUDAnetes
Heideweg 31, 34131 Kassel, Germany
Privacy: [email protected]
Support: [email protected]