1. Who is responsible
Sequester AG, Baarerstrasse 10, 6300 Zug, Switzerland is the controller for personal data it uses to operate nafnaf accounts, the marketplace, payments administration, security and communications. Send privacy enquiries and rights requests to [email protected] or Sequester AG, Privacy, at this address.
Independent GPU providers operate their own hosts. Their role for rental workload data depends on the processing they undertake and their agreement with the renter; they may be separate controllers or processors. Sequester's Swiss location does not mean every provider or every system processing data is in Switzerland.
This notice covers our website, account console, host-agent coordination and nafnaf-operated inference. It does not replace a data-processing agreement required for a customer's workload. See also our Terms of Service.
2. Information we process
- Account information: email address, account identifiers and account/login timestamps. If you choose Google sign-in, this also includes the identifier, name and profile-image information supplied by Google.
- Transactions and usage: orders, account credit, reservations, charges, refunds, payment references, rental state, resource measurements, model usage, token counts and associated billing records.
- Hosts and listings: provider account references, hostnames, hardware specifications, resource capacity, agent version, readiness and diagnostic information, availability, prices, host public IP addresses, approximate country and region inferred from those addresses, and network measurements.
- Access and operations: session and authentication records, API-key identifiers and hashes, SSH public keys, connection details, request identifiers and technical information needed for security, reliability and abuse prevention. Authentication rate limiting can use a hashed client address; this is not necessarily anonymous information.
- Abuse prevention: for Google and email sign-in and authenticated inference API calls, we record keyed fingerprints derived from your IP address and network prefix, including an IPv6 /64 prefix. We associate these fingerprints with account or API-key identifiers and timestamps. For signup limits, we also use keyed hashes of verified email addresses to count distinct accounts. These fingerprint records do not contain raw IP addresses, prompts or responses. The fingerprints and email hashes are pseudonymous, not anonymous.
- Short-lived API security logs: separately, we record the raw IP address of authenticated inference API requests with account and API-key identifiers and timestamps. These logs do not contain API-key secrets, prompts or response bodies.
- Sign-in verification: Cloudflare Turnstile processes technical signals such as your IP address, TLS fingerprint, browser user-agent and the site you are accessing to distinguish people from automated traffic. We verify its short-lived challenge token before starting email or Google sign-in.
- Content and communications: information you send in support requests or availability subscriptions, and prompts, responses or workload data to the extent needed to provide the service you request.
Information comes from you, authorised account users, connected hosts, sign-in and payment services, and your use of nafnaf. Do not submit another person's personal data unless you have the required authority and have given any necessary notices.
3. Why we process it
We use the information to authenticate users, maintain accounts, publish listings, match and fulfil bookings, provide inference, measure and bill resources, administer provider settlement, send requested service messages, respond to support, prevent fraud and abuse, secure and troubleshoot the service, and meet legal obligations or establish and defend legal claims.
We compare security fingerprints across accounts to detect repeated account creation and attempts to evade free-inference limits. We use these records only for security and abuse prevention, including rate limiting, new-account limits and shared free-use eligibility or allowances. A shared network can serve different people, so a network match is not proof that accounts belong to the same person. Contact [email protected] if a limit appears to affect you incorrectly.
Authorised administrators can review accounts that used the same exact API IP address within the last 24 hours. This is a security-review signal, not proof of a common account owner, and these flags do not automatically ban accounts or introduce additional usage limits.
We use sign-in challenges and temporary signup burst limits to reduce automated account creation. Accounts linked to suspected account farming may have free inference temporarily restricted pending review. You can contact [email protected] to request a review; shared IP addresses alone are not sufficient evidence of farming.
Where a law such as the GDPR requires a legal basis, the relevant basis is performance of a contract or requested pre-contract steps; compliance with legal obligations; our legitimate interests in secure and reliable operations, fraud prevention and legal claims, balanced against affected individuals' rights; or consent where required. Consent-based processing can be withdrawn for the future without affecting the lawfulness of earlier processing.
Information necessary to create an account or supply and bill a service is required for that service. You can choose not to provide optional information or not to use an optional integration. Prices, quotas and automated operational checks help run bookings; they are not a claim that we make every legally significant decision solely by automation.
4. Rental workloads and inference
GPU rental workloads and files run on the selected independent provider's hardware. The provider receives the technical information needed to start, maintain, meter and stop the rental. Host administrators may be able to access container systems and files. Check the host location, provider terms and any required data-processing agreement before sending personal, confidential or regulated information.
For nafnaf-operated inference, prompts and generated responses pass through our gateway to the model-serving infrastructure. The gateway records usage and billing metadata rather than storing prompt and response bodies in its accounting records. This statement is specific to the gateway's accounting implementation: it is not a promise that every infrastructure component, diagnostic log or backup has zero retention.
API-key secrets are stored as hashes by the inference gateway. Usage records associate requests with the relevant account and key, model, timestamps, token quantities, limits and charges. Do not include secrets or unnecessary personal data in prompts or operational logs.
6. International processing
Rental files are processed on the selected provider's host. The displayed country and region are approximate IP-based estimates, not verified data-residency commitments. Ask the provider to confirm the actual processing location before placing a workload with geographic restrictions. Platform and vendor processing is not restricted to Switzerland. The following describes the infrastructure and published vendor arrangements checked on 12 October 2026:
- Database: Germany. The current MongoDB Atlas database nodes use AWS's Frankfurt region. International support or optional service functions can involve the United States, Ireland, Canada, Australia, Israel, France, India, Italy, Spain, Portugal, Brazil, Singapore, Poland and the United Kingdom, as well as Germany. These are potential support destinations, not a claim that each receives every account's data. MongoDB's cloud terms incorporate its DPA, including applicable Swiss-adjusted contractual safeguards; its subprocessor list describes the recipients.
- API infrastructure: Germany. The current public API host is on Hetzner Online GmbH's German infrastructure. This does not locate every model-serving host or backup. Hetzner makes its processing agreement available for separate acceptance in the customer dashboard.
- Website delivery: international. Vercel's primary processing facilities are in the United States; current website responses also show routing through Germany. Vercel's DPA describes its Pro/Enterprise processor terms and Swiss transfer provisions, and its trust centre lists subprocessors. A response route is not a promise that all website data stays in those countries.
- Cloudflare: international network and support. Requests can be handled across its global network, including European locations such as Italy; metadata processing includes the United States and Europe. Potential affiliate support locations include the United States, United Kingdom, Singapore, Australia, Germany, Portugal, France, Japan, Canada, Netherlands, United Arab Emirates, India, South Korea, Mexico, Malaysia, Sweden and Switzerland. Cloudflare's account-service terms incorporate its DPA, with applicable Swiss transfer provisions. Its recipient list and network locations provide further detail. Account-less workspace tunnels use a separate service arrangement; we do not represent that the account-service DPA automatically covers them.
- IP geolocation: international. IPWHOIS.io's published policy permits storage in different countries without identifying all destination states. The lookup discloses a host's public IP address, not rental files, prompts, account email or payment information. Its policy does not establish a Swiss-only processing location or a nafnaf-specific processing agreement. Contact us for current recipient and transfer information before connecting a host subject to location restrictions.
- Email: United States. Resend processes and stores service data primarily in the United States, even if another email-sending region is selected. Its service terms incorporate a DPA with Swiss-adjusted Standard Contractual Clauses. Its subprocessors support hosting and delivery.
- Payments: international. Stripe may process information outside Switzerland, including in the United States and India. Its service-provider and affiliate list includes further recipient locations. Its standard service agreement incorporates data-processing and transfer terms, including applicable Swiss-US Data Privacy Framework arrangements and Swiss-adjusted Standard Contractual Clauses. Stripe acts as processor or independent controller depending on the activity.
- Google sign-in and fonts: international. Google processes service information on its worldwide systems, including in the United States. Google Ireland Limited is the controller identified for Swiss/EEA users under its general privacy policy, subject to service-specific terms. Google describes applicable adequacy decisions, Data Privacy Framework participation and contractual safeguards in its transfer information. These consumer/developer services are not automatically covered by a Google Cloud or Workspace DPA.
Where required for the relevant transfer, safeguards can include an applicable adequacy decision, a qualifying recipient's Data Privacy Framework participation, or recognised Standard Contractual Clauses adapted for Swiss law and any necessary supplementary measures. Contract incorporation does not itself establish every recipient's configured region or eliminate our compliance obligations. Contact [email protected] for information about applicable safeguards.
The locations above identify verified infrastructure and the potential vendor processing described in their public terms, not an exclusive location guarantee for backups, support or model-serving systems. Availability of a vendor's standard agreement is not a statement that every optional service or account configuration falls within that agreement. For a workload requiring a particular processing region, recipient or safeguard, obtain written confirmation from [email protected] before submitting it.
7. Cookies and browser storage
nafnaf uses a session cookie to keep you signed in and short-lived cookies for login binding and optional Google sign-in. The session cookie is configured with Secure, HttpOnly and SameSite protections. You can clear or block cookies through your browser, but authentication may stop working.
Our sign-in page embeds Cloudflare Turnstile for abuse prevention. Cloudflare acts as a processor when protecting our site and as a controller when using signals to improve Turnstile, as described in its Turnstile Privacy Addendum. This processing is separate from our 24-hour API IP logs.
Browser session storage remembers working state such as GPU search filters, rental drafts, SSH public-key entries, selections and checkout retry identifiers. These are operational conveniences rather than an advertising profile. Sign out and clear site data on a shared device.
The website does not embed an advertising or behavioural analytics SDK. Hosting providers can still process technical requests and security information, and external font requests disclose connection information to Google. The absence of an analytics SDK does not mean the absence of all logging. Optional tracking, if introduced, requires an updated notice and any consent required by law.
8. Retention and deletion
We retain personal data for as long as necessary for the relevant account or service, billing and accounting obligations, security, dispute resolution and other legal requirements. The appropriate period depends on the record, legal obligations, limitation periods and whether a dispute or preservation duty applies. Closing an account does not require deletion of records we must lawfully retain.
Security fingerprint records of individual signup events and the first network observed for an account expire 30 days after that observation. Fingerprint records summarising sign-in or inference activity expire 30 days after the most recent activity recorded in them.
The separate raw API IP logs expire 24 hours after each request. Administrator reports exclude requests outside that 24-hour window. Automatic database deletion runs asynchronously, so physical removal may occur after expiry. This short-lived log is separate from the 30-day fingerprint records.
The separate network record used to enforce signup limits expires 30 days after the latest newly verified email address is counted in it. Earlier email hashes may remain until that record expires; retries and rejected signup attempts do not extend its expiry. Expired security records are removed automatically from active systems. These 30-day periods apply to the fingerprint and email-hash abuse-prevention records described above, not to separate account, billing or infrastructure records.
Workload retention follows the rental's agreed storage rules, not just its compute duration. New quota-backed rentals can include a 72-hour grace period after storage funding runs out before files are deleted; older terms can differ. Deleting a workspace removes its files under that workflow. Keep your own backups and review the booked retention conditions.
Some short-lived authentication records and closed host-activity records are cleaned up automatically or during normal service activity. This is not a universal retention period for billing data, support records or backups. Deletion from active systems and expiry from backups may occur on different schedules, subject to appropriate restrictions on further use.
9. Your rights and choices
Depending on the law that applies, you may request information about and access to personal data, correction, deletion, restriction, portability or delivery of data, and may object to certain processing or withdraw consent. Rights are subject to legal conditions and exceptions, including record-keeping and the rights of others. We may ask for proportionate information to verify your identity.
Send requests to [email protected] or Sequester AG, Privacy, Baarerstrasse 10, 6300 Zug, Switzerland, with enough detail to identify your account and request. Do not send passwords, complete payment-card details or API secrets. You may also complain to the Swiss Federal Data Protection and Information Commissioner or another competent supervisory authority. Our Terms do not restrict those rights.
For data held by an independent GPU provider in its own capacity, contact that provider as well. We can address processing for which Sequester is responsible; we cannot promise to erase an independent party's legally retained records.
10. Security and updates to this notice
We use technical and organisational measures appropriate to the service, including access controls and protected authentication mechanisms. No system or transmission is completely secure. Users and providers must also protect their credentials, manage host access, keep software current and avoid exposing unnecessary data.
We update this notice when our processing changes and provide additional notice or obtain consent when legally required. The version date identifies the text you are reading; publication of a privacy notice does not waive your statutory rights.