Version 2026-09-25

Privacy Policy

This policy explains what personal data gpyou_ handles, why, who else receives it and what rights you have. gpyou_ by Scheduled BV, Jacob van Ruisdaelstraat 67, 3583CB Utrecht Netherlands, is the controller for your account data. Questions and requests: privacy@gpyou.ai.

What we collect

• Account: your email address and, if you give them, your name. We store your password only as a scrypt hash. For a passkey we store its public key. Your authenticator app secret is stored encrypted, and recovery codes only as hashes.
• Company details: company name, address, country and VAT number, if you sign up as a company.
• Billing: your credit balance, ledger, purchases and top-up settings, and the Stripe customer and payment references. Stripe handles your card. We never receive the full card number.
• Usage: the GPUs, jobs, endpoints and storage you use, with times and charges.
• Security records: an audit log of account actions such as sign-ins, credential changes, holds and credit grants. For rate limiting we keep a one-way hash of your IP address for at most 24 hours.
• Email: the sign-in codes, links and account notices we send you.
• Assistant: if you use the built-in assistant, recent messages from that conversation are sent to answer you. We do not store the conversation.
• Signup: the policy version you accepted and, if signup needs approval, what you told us you want to build.

We do not use advertising or analytics trackers. The site sets one strictly necessary cookie that keeps you signed in, and remembers your light or dark theme in your browser.

Your content

Your datasets, models, images and endpoint traffic may contain personal data. For that data you are the controller and we process it only on your instructions, to run the jobs and endpoints you start. We do not read it, share it or train on it. We look only at specific material named in an abuse report, or when the law requires it. The Terms of Service and Acceptable Use Policy apply. Ask privacy@gpyou.ai for a data processing agreement.

Why we use it and on what legal basis

• To provide the service you signed up for (performance of a contract): your account, sign-in, running your jobs, billing and account emails.
• To meet legal obligations: tax and accounting records, and requests from authorities.
• Our legitimate interest in a secure, honest service: preventing fraud and abuse, rate limiting, audit logs, and reviewing abuse reports.

We do not sell personal data. We do not send marketing email. We make no automated decisions about you that have legal effects.

Who receives it

• Stripe: payments and saved cards.
• Cloudflare R2, in the EU jurisdiction: your stored objects and container images.
• GPU providers: RunPod and Vast.ai (United States) and Verda (European Union). Whichever runs your job receives the container, data and model it needs while the job runs. You can limit your jobs to one provider.
• GreenPT (European Union): assistant messages, only when you use the assistant.
• Our email provider: your address and the message, to deliver our emails.
• Our hosting provider: runs the database and servers that hold your account data.
• Authorities: only when the law requires it, or to report illegal content as described in the Acceptable Use Policy.

Transfers to providers outside the European Economic Area are covered by the European Commission's standard contractual clauses, or by the EU-US Data Privacy Framework where the provider is certified under it.

How long we keep it

• Account, company and usage data: while your account is open.
• Stored objects and images: until you delete them, or 30 days after your credit runs out.
• After you close your account we revoke all sign-in credentials. Ledger, payment and invoice records stay for seven years, as Dutch tax law requires.
• IP address hashes for rate limiting: at most 24 hours.
• Data under an abuse hold: until the review, and any legal proceedings, are finished.

Your rights

You can ask for access to your personal data, correction, deletion, restriction, a portable copy, or object to our use based on legitimate interest. Write to privacy@gpyou.ai. We answer within one month. You can correct most profile details yourself under Profile. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own EU country.

Security

Sign-in uses passkeys, or passwords with an optional second factor. Secrets are encrypted at rest. Traffic uses TLS. Each account can only reach its own data. Only platform administrators can manage customer accounts, and each change they make is recorded in the audit log.

Children

gpyou_ is not meant for anyone under 18, and we do not knowingly collect their data.

Changes

If we change this policy in a way that matters to you, we email you before the change takes effect. The version date is at the top of this page.