§Legal · Privacy policy

What we know about you, and why it is not much.

The data an account, a payment and a support ticket need, kept in the EU, never sold, never profiled. Thirteen sections; the precise part is in the tables.

Version 1.0 Effective 22 September 2026 GPUBank SAS · Paris ≈ 6 min read · 13 sections

The short version

Six sentences that say what the 13 sections below say. If the two ever disagree, the sections win.

Plain English

We collect what the service needs

Email, name, country, a hashed password and your balance ledger. No identity documents, no data bought from anyone.

No trackers, no ads

First-party cookies only, no third-party analytics, no advertising pixels. Your data is not sold or shared with brokers.

Your workloads are not looked at

Disks, models, prompts, outputs and logs stay yours. We open nothing unless you ask, an abuse report demands it, or the law orders it.

EU by default

The console and its database run in France. EU regions never leave the EU. Other regions only if you pick them.

Crypto is public, your account is not

We keep the invoice, the amounts and the transaction id. The exchange sees the transaction, not your name.

Rights in one click

Export everything as JSON, close the account, or write to [email protected]. We answer within 30 days.

Who is responsible

What it means

GPUBank SAS decides what happens to your account data and answers for it. One address to write to: [email protected].

Controller: GPUBank SAS, Paris, France
Contact: [email protected] · postal address on the trust page and on every invoice
Authority: CNIL, France. You may complain to it or to the data protection authority of your own country.
Applies to: gpubank.io, console.gpubank.io, the API and the CLI

This policy explains what personal data we collect, why, for how long, who sees it and what you can do about it. It is written for people, not for lawyers; the tables are the precise part. The Service is for adults and businesses: we do not knowingly hold data about anyone under 18.

What we collect, and why

What it means

The list is short: what an account, a payment and a support request need. No identity documents, no behavioural profile.

What	Why we need it	Legal basis (GDPR)
Account	Email, name, company and country, a hashed password, the workspace name, your preferences. Country and VAT ID go on invoices.	Contract, art. 6.1.b
Sign-in security	IP address, browser, sign-in times, session ids, verification codes (hashed), two-factor settings.	Legitimate interest: keeping the account safe, art. 6.1.f
Balance and payments	The ledger of credits and debits, top-up invoices, the coin and network used, the amount received, the transaction id, the refund address you give.	Contract, art. 6.1.b · accounting obligation, art. 6.1.c
Resources	Names and settings of pods, jobs, endpoints, disks and buckets, their start and stop times, the seconds billed. Not their content.	Contract, art. 6.1.b
Support	Your tickets and emails, the resource or payment you attach, the log excerpt you choose to attach.	Contract, art. 6.1.b
Developers	API keys (hashed, shown once), webhook URLs and delivery results, SSH public keys.	Contract, art. 6.1.b
Site usage	Server logs with IP address and requested page, kept briefly and aggregated for capacity planning and abuse detection. No third-party analytics.	Legitimate interest, art. 6.1.f
Email	The address itself and the delivery status of the emails we send: codes, receipts, and the alerts you turned on.	Contract, art. 6.1.b · consent for optional alerts, art. 6.1.a

We never ask for identity documents. We do not buy data about you and we do not enrich your profile from other sources.

What we never do

What it means

No advertising, no selling, no profiling, no reading your data. If a new use ever came up, we would ask first.

We do not sell, rent or share personal data with advertisers or data brokers.
We run no advertising trackers and no third-party analytics on the site or in the console.
We build no behavioural profile and take no automated decision with legal effects about you. Abuse signals are reviewed by a person before any suspension.
We do not read the content of your disks, buckets, models, prompts or outputs, except with your consent for support, on an abuse report, or under a legal order.
We send no marketing email unless you opted in, and every email we send has an address you can reply to.

Cookies

What it means

Three first-party cookies, all needed to keep you signed in and safe. No banner, because there is nothing to consent to.

Cookie	Purpose	Lifetime
Session	Keeps you signed in to the console and holds your form drafts between pages.	Session, or 30 days with "keep me signed in"
XSRF-TOKEN	Protects forms and the API from cross-site request forgery.	Session
Remember me	Set only when you tick "keep me signed in on this device".	30 days

These are strictly necessary within the meaning of the ePrivacy rules and the CNIL guidelines, so no banner is shown. Block them in your browser and the console cannot keep you signed in. gpubank.io itself sets no cookie, and no cookie comes from a third party: the payment page and the video on the sign-in page are served by us.

Where your data lives

What it means

Account, balance and console data are in the EU, in France. Compute and disks are in the region you choose, and EU regions stay in the EU.

The console, its database, backups and support tools run on servers in France (EU), operated by our hosting provider under a data processing agreement.
Compute resources and their disks are in the region you pick: Paris, Frankfurt, Ashburn or Singapore. Choosing a non-EU region means your workload data is processed there, by your choice.
The site and the console are served through Cloudflare's network for TLS and DDoS protection. Cloudflare may process your IP address at its edge, including outside the EU, under the EU standard contractual clauses and its data processing addendum.
When a transfer outside the EU is needed (an exchange at checkout, or GitHub and Google if you sign in with them), it relies on an adequacy decision or on the standard contractual clauses.

Sub-processors

What it means

The companies that touch personal data on our behalf, named. Any addition is announced on this page 30 days ahead.

Provider	What for	Where
Contabo GmbH	Dedicated servers for the console, its database and backups.	Germany (company) · datacenter in France, EU
Cloudflare, Inc.	DNS, TLS termination, DDoS protection and the tunnel to our servers.	United States · EU edge locations · SCCs and DPA
Exchange chosen at checkout	Converts the coin you pay with into Monero. Receives the transaction and the refund address you give, nothing else about you.	Named on the payment page, with its country
Kraken	Public market prices used to quote a top-up. No personal data.	United States · public data only
Datacenter partners per region	Host the GPU servers your resources run on. They see machines, not your account.	Paris, Frankfurt, Ashburn, Singapore · named on the trust page

Emails are sent by our own mail server. Should we switch to an email provider, it will be listed in this table 30 days before the first email goes through it.

How long we keep it

What it means

As long as the service or the law needs it, then gone. Accounting records are the long one: ten years, because French law says so.

Data	Kept for	Then
Account data	While the account is open, then 30 days	Erased
Ledger, invoices, receipts	10 years after the transaction (French accounting law)	Erased
Payment records	10 years, with the ledger: invoice, amounts, transaction id, refund address	Erased
Sign-in and security logs	12 months	Erased
Server and access logs	90 days	Erased; aggregates kept without personal data
Support tickets	3 years after closure	Erased
Disks and buckets	Until you delete them, or 14 days after the balance reaches $0	Erased; backups within 30 days
Backups	30 days, rolling	Overwritten
Data export	30 days available for download	Erased

Your rights

What it means

Access, correction, export, erasure, objection: from the console in one click, or by email. We answer within 30 days, usually much faster.

Access and portability · download everything we hold about your account as JSON from Account › Data & privacy.
Rectification · edit your details in the console at any time.
Erasure · close the account from the console; data is erased per the table above, except what accounting law makes us keep.
Objection and restriction · write to [email protected]; we stop the processing you object to unless a legal obligation prevents it.
Consent · optional alerts are switched off from Notifications; the change applies at once.
Complaint · to the CNIL (cnil.fr) or to the authority of your country. We would rather hear from you first.

We answer within 30 days. We may ask you to confirm the request from the email address of the account, and nothing more.

Security

What it means

Passwords and keys are hashed, secrets are shown once, servers are reached by key only, and the network is closed by default.

Passwords are hashed with a modern algorithm. Verification codes and API keys are stored hashed and shown once.
TLS on every connection, HSTS on the site and the console.
Servers accept SSH keys only, are firewalled to the services they need, and sit behind an encrypted tunnel with no public port.
Secrets live outside the code, on the servers only, and are rotated when a person who knew them leaves.
Disks are encrypted at rest. Customer-managed keys are available on request for reserved capacity.
Access to production is limited to named engineers, logged and reviewed. A personal data breach that puts you at risk is notified to you and to the CNIL within 72 hours.

Crypto payments

What it means

We see the transaction, not your wallet's history. Public blockchains are public: pay from a wallet you are comfortable linking to this payment.

A top-up creates an invoice with the amount in USD, the coin and network you chose, the address we generated for you, and the transaction id once it lands.
For coins converted by an exchange, the exchange sees your transaction and the refund address you give. It does not receive your name, your email or your account.
Monero payments go straight to our wallet: no exchange involved.
Blockchain transactions are public by design. We never publish them, but anyone can read a chain; use a wallet you control and keep that in mind.
Refunds go to the refund address you gave; we keep that address with the invoice.

Business customers and the DPA

What it means

If your workload processes other people's personal data, you are the controller and we are your processor, under a DPA you can sign online.

Our Data Processing Agreement covers the personal data you process on GPU resources, disks and buckets: we act only on your instructions, keep it in the region you chose, help with data-subject requests and security incidents, and delete it when you say so.
The DPA includes the EU standard contractual clauses for any transfer outside the EU that you decide by choosing a region.
Sign it from Workspace › Settings in the console, available with team accounts. Until then, a signed copy is available on request at [email protected].
Sub-processors are those listed in section 6. Changes are announced 30 days ahead, and you can object.

Changes to this policy

What it means

Dated versions, history at the bottom. A change that matters is announced by email 30 days ahead.

Each version carries a number and an effective date.
A change that reduces your rights or adds a purpose is announced 30 days ahead by email and in the console.
Clarifications and legally required changes may apply sooner. They are still dated and listed.

Document history

Every version, dated. A change that matters is announced 30 days ahead.

22 Sep 2026Version 1.0 · first published, with the console.

A question this page does not answer?

[email protected] answers within 15 business days · [email protected] for anything about the service.