Privacy Policy
1. Who is responsible
The controller for the processing described here is:
PRINT IT! SE
Altajská 1568/2, Vršovice
100 00 Praha 10
Czech Republic
Register court: Municipal Court in Prague (Městský soud v Praze) · Registration number: Section H, Insert 2104, Company ID (IČO) 069 60 090
Email: [email protected]
We have not appointed a Data Protection Officer. Our processing does not meet the conditions in Article 37(1) GDPR that make one mandatory: we are not a public authority, our core activity is renting hardware rather than large-scale monitoring, and we do not process special categories of data on a large scale. Privacy enquiries reach us at [email protected] and are handled by the board.
2. The most important point: we do not look inside your instance
GPUwerk rents whole dedicated GPU machines, in one of the tiers listed on the pricing page (currently NVIDIA DGX Spark, with further tiers listed as they become available). An instance is a dedicated machine: you are the only tenant on that physical machine for the duration of your rental, with root access inside your container rather than at the host level. SSH access is by public key only; password authentication for SSH is disabled across the fleet. Optional VNC desktop access, if enabled, uses a separately generated password for that connection only.
The optional in-browser terminal is a distinct feature with its own, narrower disclosure: each session generates a fresh, single-use keypair in your browser, used for that session alone. The private half is sent once, over TLS, to a short-lived server-side process whose only purpose is relaying that terminal session; it is held in memory for the life of the session, never written to disk or to logs, and destroyed when the session ends or times out. This is unlike your own SSH key, described above, which never touches GPUwerk at all.
We do not access, read, copy, index, analyse, or otherwise process the content of your workloads: your data, your models, your prompts, your outputs, your logs inside the machine. We are an infrastructure provider. What runs on the machine is yours.
If you process personal data on your instance, you are the controller for that data and GPUwerk acts as a processor. Our data processing agreement under Article 28 GDPR sets out the terms. On GPUwerk's own tiers we engage no sub-processors for customer workloads: the hardware is ours, it sits in EU-Central, and nobody else is in that path. The one exception is the Partner tier, which applies only if you choose it and is described in section 5a. See the full sub-processor list for the website and billing side.
The rest of this policy therefore describes only the personal data we process as a controller in our own right: the data needed to run an account, bill it, support it, and operate the website.
3. What we process, why, and on what legal basis
| Category | Purpose and legal basis |
|---|---|
| Account data: name, business name, email address, console login identifiers, role and permissions | Creating and administering your account, authenticating you, communicating about the service. Article 6(1)(b) GDPR, performance of a contract. |
| Billing data: billing address, VAT identification number, credit top-ups, per-minute usage records, invoices, payment references | Charging for use, issuing invoices, meeting tax and commercial retention duties. Article 6(1)(b) and Article 6(1)(c) GDPR. |
| Authentication data: SSH public keys you upload, API tokens, session records, and the password you chose if you sign in with an email address | Granting you access to your instances and to the console. SSH public keys are provisioned onto the instance; we hold no private keys. A password is never stored as you typed it: our identity server, on our own machine in Helsinki, keeps only a bcrypt hash, which cannot be turned back into the password. Article 6(1)(b) GDPR. |
| Sign-in data: either the identifier, name, email address and profile picture that GitHub or Google returns when you sign in through them, or, if you sign in with an email address instead, that address and a password | Creating and authenticating your account. This data is necessary to perform the contract, Article 6(1)(b) GDPR. Which of the three routes you use is your choice. GitHub and Google learn that you have an account with us; signing in with an email address tells them nothing, and sends a message to your address instead. See section 5. |
| Technical and operational logs: IP address, timestamps, console and API requests, instance start, stop and termination events, hardware health telemetry | Operating the platform, billing accuracy, troubleshooting, detecting abuse and attacks, security. Article 6(1)(b) and Article 6(1)(f) GDPR, our legitimate interest in a secure and correctly billed service. This telemetry describes the machine, not the workload running on it. |
| Sanctions checks: the country of the IP address a payment or deployment comes from, the billing address and card-issuing country Stripe reports, your name and billing name, and your confirmation at checkout that you are not acting for a sanctioned entity | Complying with EU sanctions law, which forbids us to provide computing services to entities established in Russia or Belarus (Council Regulations 833/2014 and 765/2006) and to persons on the EU sanctions list. Article 6(1)(c) GDPR. The IP country is looked up locally with a downloaded database (IP geolocation by DB-IP); names are compared locally with the EU consolidated sanctions list. No data is sent to a third party for these checks, and a possible match is always reviewed by a person before any lasting decision. |
| Support correspondence: emails, tickets, and whatever you choose to include in them | Answering your enquiry and keeping a record of it. Article 6(1)(b) GDPR, or Article 6(1)(f) where you are not yet a customer. |
| Website usage data: pages requested, referrer, approximate region, browser and device type | Delivering the site and understanding in aggregate which pages are useful. Article 6(1)(f) GDPR for strictly necessary processing; Article 6(1)(a) GDPR, your consent, for anything requiring cookies or similar storage that is not strictly necessary. What falls on each side of that line is itemised in the Cookie Policy. |
| Cookie consent record: the categories you chose, when you chose them, the policy version you were shown, and a random identifier generated for this purpose | Demonstrating that consent was given, as Article 7(1) GDPR requires us to be able to do. Article 6(1)(c) GDPR. It contains no name, email address or IP address, and is never joined to your account. |
Where a legal basis is consent, you can withdraw it at any time with effect for the future. Withdrawal does not affect processing carried out before it.
4. Where the data comes from
Almost all of it comes from you directly: what you enter in the console, what you write to support, what your browser sends when it requests a page. If you are named as a contact person by a company that holds the contract, we receive your business contact details from that company. We do not buy personal data and we do not enrich it from third-party sources.
5. Who receives data
Inside our organisation, only staff who need it: operations, billing, and support. Beyond that, personal data on the website and billing side may be handled by service providers acting as processors under Article 28 GDPR:
- Payments and invoicing: Stripe. Card details are entered on Stripe's own payment page and never reach our servers; we hold the payment reference, not the card. Our contracting entity is Stripe Payments Europe, Limited, Dublin, Ireland.
- Transactional email: Resend (Plus Five Five, Inc., San Francisco, California, United States). Delivers account and billing email: sign-in notices, receipts, low-balance and closure warnings. It receives the recipient address and the message. There is no EU entity and no EU region: this is a transfer to the United States, and section 6 says so.
- Server hosting: Hetzner Online GmbH. Our control plane, the console, this website and the account database run on a Hetzner Cloud server in Helsinki, Finland. The GPU nodes themselves run in our own data center in Hradec Králové, Czech Republic, and we operate them. Some of them are owned by hosting customers, who have no access to them while someone else rents them, or to that renter's data, and no local login or physical access. Both locations are in the EU. Partner-tier machines are the exception, see section 5a.
- DNS: Cloudflare. We use Cloudflare only to answer DNS queries for gpuwerk.com. Traffic to the site and the console is not proxied through Cloudflare: it goes straight to our server, so Cloudflare does not see your requests, your IP address or your traffic.
- Sign-in: GitHub or Google, if you choose one of them. This is not a processor relationship: they are independent controllers for what happens on their side, and their own privacy policy governs it. They learn that you signed in to GPUwerk. Both are established in the United States; see section 6. Signing in with an email address involves neither of them. The identity server that checks your password is our own, in Helsinki; only the confirmation, sign-in code and password reset messages go out through our email provider, named above.
- Accountants, auditors, and tax advisers, where required.
On the website and in the console, and only if you accept them in the cookie banner, two further groups of processors are used. Neither is downloaded before you consent. The console downloads nothing of its own accord: it carries forward the same choice you made on the website.
- Analytics: Google Analytics 4 and PostHog (PostHog on its EU region, with session recording and autocapture off and the IP discarded at ingest). Used in aggregate to find which pages fail, not to identify you.
- Marketing: Google Ads and the Meta pixel. Used to attribute a signup, an enquiry or a purchase to the advert that produced it. This is the group to leave off if you would rather Google and Meta did not learn you visited; leaving it off changes nothing about the service. The events sent are page and product views, cart and checkout steps, a submitted contact form, a sign-up and a purchase with its order number and value; no names or message contents are sent. Your email address is never sent in plain form: with a sign-up or a purchase, Google Ads receives a SHA-256 hash of it (“enhanced conversions”), and when a payment is confirmed our server sends Meta the purchase together with a SHA-256 hash of your email address, the IP address and browser of the request that placed the order and your Meta cookie ids (Conversions API). With analytics allowed, our server also reports a confirmed purchase to Google Analytics with its random cookie id and no email or IP address. Details, and how long this is kept, are in the Cookie Policy.
Error reporting: Sentry (EU region), which catches JavaScript errors so a broken page is noticed by us rather than only by the person it broke for. It sets no cookie and stores no identifier, and is configured with personal data collection, IP capture and session replay all off. Article 6(1)(f) GDPR.
We use no external support desk. Support is plain email to a mailbox we operate. We use no tag manager, no data broker, and no advertising audience lists.
Exactly which cookie each of these sets, and for how long, is listed in the Cookie Policy.
We also disclose data where a law or a binding order from a competent authority requires it. None of the providers above touches customer workloads: they exist on the website, sign-in and billing side only, and none of them can reach an instance.
5a. Partner tier: independent partner hosts
The Partner tier, listed in the console as "DGX Spark 1× (Partner)", runs on a DGX Spark that an independent partner owns and hosts at the partner's own premises. GPUwerk vets each partner, and every partner signs GPUwerk's partner agreement before a machine can be paired. This section applies only if you choose the Partner tier for an instance. GPUwerk's own tiers, on-demand and reserved, are unchanged: they run on our own hardware in the Czech Republic, and no partner is involved.
If you choose it, the partner host is a recipient in one specific sense: your instance runs on a machine the partner physically holds. That makes independent partner hosts a category of recipient, for the Partner tier only. They are listed as such on the sub-processor list.
- Where the machine is. At the partner's premises, in the partner's country of residence. That country must be an EU member state, Iceland, Liechtenstein or Norway. All of them are in the European Economic Area, where the GDPR applies, so this is not a transfer to a third country. It is not necessarily the Czech Republic.
- What the partner has. Physical access to the machine, and the power and internet connection it runs on. Your traffic crosses the partner's line inside an encrypted WireGuard tunnel to GPUwerk, and your instance reaches the internet from GPUwerk's address, not the partner's. Your instance cannot reach the partner's local network.
- What the partner does not have. A login. Enrolling the machine wipes it and installs GPUwerk's locked system: every interactive account is locked, local console logins and the desktop are turned off, and SSH is open only on the tunnel, only to GPUwerk's operators, with short-lived certificates. The partner never learns who you are and cannot see your workload or data; their console shows only that the machine is rented, since when, the hours and their earnings. The partner agreement forbids tampering with the machine, its firmware or its operating system, and any attempt to inspect, copy or interfere with a renter's workload or data. A breach lets GPUwerk suspend the machine at once.
- What GPUwerk does. GPUwerk operates the machine remotely, as it does its own fleet. The machine's TPM proves its boot state to GPUwerk when it registers and on every boot, and its own secrets, such as its tunnel key, sit on an encrypted volume that opens only after that check passes. If the boot measurements change, the machine is suspended. One renter at a time gets the whole machine, and it is wiped between renters.
- The limit. Whoever holds a machine controls its firmware and its install media, and the TPM measurements cover the boot chain, not everything that runs afterwards. The locked system deters casual access; it cannot stop a determined owner. The encrypted volume holds the machine's own secrets, not your instance's storage.
For that reason, use only public or synthetic data on the Partner tier. It comes with no SLA. If you need your data on hardware we own, choose one of GPUwerk's own tiers.
6. Where the data goes, and the two places it leaves the EU
On GPUwerk's own tiers, your workloads never leave the EU. The GPU nodes run in our own data center in Hradec Králové, Czech Republic, and that is also where your instance workspace lives: on the node's own local storage, with one backup copy on our own backup server on the same network (section 7). The control plane, the console, this website and the account database run on a server in Helsinki, Finland. Everything described in section 7 stays inside the European Union. No third party has access to any of it, and no part of it is transferred to a third country. If you choose the Partner tier, your instance runs instead on a partner's machine in an EU member state, Iceland, Liechtenstein or Norway, as described in section 5a. That is inside the European Economic Area and is not a third-country transfer either.
Two account-side services do involve processing in the United States, and we would rather name them than let you discover them:
- Transactional email. Our email provider, Resend, is operated by Plus Five Five, Inc. in San Francisco. It has no EU establishment and offers no EU data residency, so sending you a receipt or a low-balance warning means your email address and the text of that message are processed in the United States. Resend certifies under the EU–U.S. Data Privacy Framework, and our data processing agreement with it also incorporates the standard contractual clauses.
- Single sign-on. Signing in with GitHub or Google is a request to a US-established company, which learns that you have an account with us. Which one you use is your choice, and signing in with an email address instead avoids this transfer entirely: that route never contacts either of them. The message carrying your sign-in code still goes through our email provider, which is the transfer described immediately above.
A third applies only if you accept the analytics or marketing cookies, and not otherwise:
- Analytics and advertising. Google (Analytics, Ads) and Meta are established in the United States. Accepting those categories means the pages you view on this website are processed there. Refusing means the scripts are never fetched, so no such transfer takes place. This is your choice to make and it is one click either way, see the Cookie Policy.
These transfers rest on Chapter V GDPR: the European Commission's adequacy decision for the EU–US Data Privacy Framework where the recipient is certified under it, and standard contractual clauses under Article 46(2)(c) GDPR otherwise. A copy of the clauses we rely on is available from [email protected].
That is the complete list, and the third entry is under your control. If it ever grows, we will update this policy and have a valid transfer mechanism in place before any transfer happens. Your workloads are not on the list under any setting: no cookie choice can put a rented instance outside the EU. Only choosing the Partner tier can place one in Iceland, Liechtenstein or Norway, which are in the EEA.
7. Instance data lifecycle
Your instance's /workspace lives on the node's local NVMe while the instance runs or is stopped. Stopping the instance pauses the container and leaves the workspace on that same node, with the node reserved for you; starting the instance again resumes it there in seconds.
When you terminate an instance, we delete the container and its workspace volume from the node. Before a node is allocated to another customer it is sanitised: every tenant container and volume is removed from it, and the node fails its readiness check and is not allocated while any remain. This is deletion at the filesystem level. We do not currently operate self-encrypting drives or full-disk encryption on the nodes, and we therefore do not claim a cryptographic erase.
You are responsible for your own backups. Termination is not reversible and we cannot recover a terminated instance for you, because the workspace and its backup copy are deleted along with it.
If your account credit reaches zero or you hit your monthly budget, the instance is stopped and its node is released: it is wiped and sanitised for the next customer. Before that, the workspace is copied to our backup server and kept there for 7 days. Top up and start the instance within that window and the workspace is restored onto whichever node is free. After 7 days the copy is deleted and the instance is terminated. If the copy cannot be made, the instance is instead held on its node for 24 hours and then terminated, with the workspace deleted and no copy kept. We warn you before this happens through low-balance email, and you can prevent it entirely with auto top-up.
We keep one backup copy of each workspace, on our own backup server in the Czech Republic, on the same network as the GPU nodes. No third party stores or accesses it. While an instance is running or stopped on its node, that copy is refreshed periodically, currently about every six hours, so it can be several hours behind, and it covers only /workspace, not the rest of the instance's filesystem. It exists so that we can recover an instance from a hardware failure. It is not a backup service: we do not guarantee that it is current or complete, and you remain responsible for your own backups. The copy is deleted when the instance is terminated or the account it belongs to is closed. For an instance released from its node, as described above, it is kept for 7 days and then deleted. The same 7-day window applies if we have to move a stopped instance off its node, for example after a failed start. Your data exists on our systems only for as long as you keep paying for it, plus that 7-day window.
8. Cookies and local storage
The console uses strictly necessary cookies and browser local storage to keep you signed in and to remember basic interface preferences. These are required for the service to work and are set on the basis of Article 6(1)(f) GDPR and the corresponding national implementation of the ePrivacy Directive.
Everything beyond that is optional and off until you switch it on. Analytics and marketing storage is set only after you accept it in the cookie banner, on the basis of Article 6(1)(a) GDPR. The scripts are not merely disabled beforehand: they are not downloaded at all, so refusing means nothing is fetched from Google, Meta or PostHog.
Refusing is one click, in the same place and at the same size as accepting; there is no consent wall and no content behind an "accept to continue". You can change or withdraw the choice at any time from , in the footer of every page. Withdrawal takes effect at once and deletes the cookies the category set, rather than leaving them to expire. We ask again after twelve months.
The full list (every cookie, what sets it, what it does and when it expires) is in the Cookie Policy.
9. How long we keep things
| Data | Retention |
|---|---|
| Account data | For the life of the account. On closure we anonymise it rather than delete it, because the billing records it is attached to have a statutory retention period. See section 10a. |
| Invoices and accounting records | For the statutory retention period applicable to us, currently 10 years, per Czech accounting and VAT record-keeping obligations. |
| SSH public keys and API tokens | Until you remove them, or until the account is closed. |
| Technical and operational logs | 90 days, then deleted, unless a specific security incident requires us to keep a record longer. Billing-relevant usage records are not covered by this line: they are part of the invoice trail and follow the accounting retention period above. |
| Web server logs for gpuwerk.com | 14 days, then deleted. Each entry holds the requested URL, the time, the status code and the browser identification string sent by the visitor's browser or crawler. Client IP addresses are deliberately not written to these logs. |
| Sanctions check records | 10 years, the record-keeping period we apply to sanctions compliance. Holds each checkout confirmation (with the IP address and browser it was given from), and for checks that refused a request or flagged it for review, the result, the countries seen and the IP address. Checks that find nothing are not otherwise recorded. |
| Support correspondence | 24 months after the matter is closed, so that we can follow up on a recurring fault or a disputed charge. Deleted after that unless it forms part of an accounting record or an unresolved legal claim. |
| Cookie consent records | 24 months from the choice, so that we can show what was consented to while it was in force. Holds a random identifier, a timestamp and the categories chosen: no name, email or IP address. |
| Instance contents | A running or stopped instance's workspace stays on its node, with one backup copy on our own backup server, refreshed about every six hours. Terminating the instance or closing your account deletes both. When your credit or monthly budget runs out, the instance is released from its node and the backup copy is kept for 7 days, then deleted. |
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy, Article 15
- have inaccurate data corrected, Article 16
- have data erased where the conditions are met, Article 17
- have processing restricted, Article 18
- receive your data in a portable format and have it transmitted to another controller, Article 20
- object to processing based on legitimate interests, on grounds relating to your situation, Article 21
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, Article 22. We do not make such decisions.
- withdraw consent at any time, where processing rests on consent, Article 7(3)
Write to [email protected] and we will respond within the periods the GDPR sets. If your request concerns personal data that a customer processes on their own instance, we will refer you to that customer, since they are the controller for it and we cannot see that data.
You also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement. The authority competent for us is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic.
10a. Closing your account, and what closure actually does
You can close your account yourself, from the console or with POST /v1/account/closure. Closure is not immediate: it takes effect fourteen days after you ask for it, and you can cancel it at any point during those fourteen days. We email you when a closure is scheduled, so that a closure requested by someone who is not you can be stopped before anything happens. Terminate your instances or complete workspace offload first; we will not close an account while any instance still reserves a machine. Scheduling closure disables automatic top-ups. Cancelling closure does not re-enable them.
When the fourteen days elapse we remove your name, email address, editable billing profile, profile picture, saved card references, and every SSH key and API key on the account. We revoke existing login sessions locally and queue deletion of the authentication account, retrying if the authentication service is temporarily unavailable. Issued invoices and retained accounting records still contain the buyer details recorded when they were issued.
We do not delete the account record itself, and you should know why. Your invoices, payments and ledger entries are attached to it, and Czech accounting and tax law requires us to keep those records for years after the account is gone. Deleting the record would either destroy documents we are legally required to retain or leave them attached to nothing. So the record survives as a numbered stub with no personal data in it. Article 17(3)(b) GDPR permits exactly this, and Article 17(3)(e) applies to the accounting records themselves. Once the retention period expires those records are deleted too.
What we cannot undo: closure is final at the end of the fourteen days, and your instance workspaces are deleted with it. Export anything you want to keep first.
10b. Taking your data with you
You can download everything we hold about your account at any time, as a single JSON file, from the console or with GET /v1/account/export. It contains your account details, your full billing ledger and payment history, your instances and their event log, your SSH keys, and the list of messages we have sent you. It does not contain API key or token values, because we store only their hashes and could not include them if we wanted to. Instance workspaces are separate and larger: a running or stopped instance's workspace is available from GET /v1/instances/{id}/workspace. Once an instance is terminated, whether by you, by closing your account, or 7 days after it was released for credit or budget exhaustion, its workspace and its backup copy are gone and there is nothing left to export.
This is your Article 20 GDPR portability right and, for business customers, the switching and retrieval rights under the EU Data Act. There is no charge for it, and no charge for the bandwidth to move your data to another provider.
11. Is providing data mandatory
There is no statutory obligation to give us your data, but account and billing data are necessary to enter into and perform the contract. Without them we cannot open an account or provide instances. Everything else is optional.
12. Security
We apply technical and organisational measures appropriate to the risk, in line with Article 32 GDPR. On the platform side this includes a machine dedicated to a single customer, with no workload sharing between customers, SSH public key authentication with passwords disabled fleet-wide, deletion of a tenant's container and workspace before the node is offered to anyone else, and access control limiting staff access to what their role requires. Partner-tier machines have the different measures and limits set out in section 5a.
13. Changes to this policy
We update this policy when the service or the law changes. The current version always lives at this address with the date of the last update at the top. If a change materially affects how we process your personal data, we will tell account holders by email before it takes effect, or otherwise give reasonable advance notice in the console.
14. Related documents
See also our Imprint and our Terms of Service. The Article 28 data processing agreement and our sub-processor list are published separately.