Privacy Policy

Version 0.2 · October 2026

Draft. This policy has not yet been reviewed by a lawyer. It describes how the service works today; a signed agreement or data processing agreement takes precedence.

1. Who we are

NomadGPU ("we") runs GPU jobs for clients on the clients' own Vast.ai and RunPod accounts. The data controller is [operator's legal name and address — to be added]. Contact for any privacy question: ops@nomadgpu.com.

2. What we collect

Website visitors. The site sets no cookies and runs no third-party trackers. Your colour theme choice is stored only in your own browser. Our hosting provider (Cloudflare) processes IP addresses to deliver the site and protect it from attacks; if enabled, its Web Analytics counts visits without cookies.
Applications and accounts. Name, email, company, country, a description of your GPU workloads and budget, and your password — stored only as a salted hash, never in plain text.
Service data. The API key for your Vast.ai account and, if you use your own storage, its keys; job specifications, logs, metrics, rental and cost records, invoices.
Your files. Code, checkpoints and outputs of your jobs, stored in your storage bucket or in your own folder of our shared bucket.
Communications. Messages in the support chat, emails, and — if you choose — your Telegram chat ID for notifications.
Security records. IP address, time and type of sign-ins and actions (such as stopping a job) in an audit log.

3. Why we use it

To provide the service you asked for: running and monitoring jobs, enforcing your limits, support (contract).
To keep the service secure, prevent abuse and check that clients are not subject to sanctions (legitimate interest and legal obligation).
To bill you and keep accounting records (legal obligation).
To send optional notifications by email or Telegram (your choice; you can turn them off at any time).

We do not sell your data, do not use it for advertising and do not train AI models on your files.

4. Who processes it for us

Cloudflare — website hosting, DNS, secure tunnel to our server, file storage (R2), email forwarding.
DigitalOcean — our server (Frankfurt, Germany), where the job journal and keys are kept.
Vast.ai — your GPU machines run on your own Vast.ai account under Vast.ai's terms; the machine owners (hosts) can technically see what runs on their machines.
EasyStaff (EasyStaff LP, United Kingdom) — if you pay our service fee by card or bank transfer: the payment and the details needed for it are processed by EasyStaff under its own terms. We receive the payment confirmation, not your card details.
Blockchain networks — if you pay in USDT or ETH: the transfer, your wallet address and the transaction hash are public on the network by design.
Telegram — only if you opt in to notifications there.
Email delivery provider — to send sign-in and notification emails.
DeepL (or, if configured instead, OpenRouter and the AI model provider it routes to) — only when you or we press "Translate" on a chat message: that message's text is sent for translation. We don't send it otherwise.

Some of these companies are based in the United States. Transfers rely on their standard contractual clauses.

5. How long we keep it

Account, service data and chat — while you use the service and up to 12 months after, unless you ask us to delete them sooner.
Your files in our storage — handed over or deleted within 30 days after the service ends.
Audit log — 1 year. Backups of the job journal — rolling 30 days.
Invoices and accounting records — as long as tax law requires.
Applications that we decline — deleted within 90 days.

6. How we protect it

Keys are kept only on our server and in encrypted backups; jobs get temporary storage keys limited to their own folder; the operator panel is closed behind two independent sign-ins; passwords are hashed with scrypt; checkpoints can be encrypted with your own key. No system is perfectly secure — if a breach affects your data, we will tell you without undue delay.

7. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, or send it to you in a machine-readable form. Write to ops@nomadgpu.com; we answer within 30 days. You can also complain to your local data protection authority.

8. Children

The service is for businesses and adults. We do not knowingly collect data from anyone under 18.

9. Changes

We will announce material changes at least 14 days in advance on this page and to active clients.