Privacy Policy

Version dated 20 October 2026

1 Operator and Scope

1.1. Товарищество с ограниченной ответственностью «Колибри.Эксперт» (a limited liability partnership), Business Identification Number (BIN) 220740014218, Republic of Kazakhstan, 010000, Astana, Baikonyr District, Almukhan Sembinov Street, building 24, apartment 511 (the “Operator”), processes the data of xgpu.store users to operate the cloud GPU service. Contact for all data-related matters: support@xgpu.store. This Policy applies to the website, accounts, orders, billing and support. Effective date: 20 October 2026.

1.2. Collection and processing are permitted on the bases provided by the legislation of the Republic of Kazakhstan. Where consent is necessary, the Operator must obtain it by a verifiable means; this Policy and merely visiting the website do not, in themselves, replace it. Processing without consent is permitted only on a specific statutory basis. Performance of a contract is not used as a universal substitute for required consent.

1.3. The service is intended for adult users. If the Operator becomes aware of a child’s data provided without the necessary basis, it restricts processing and takes the measures prescribed by law. Users must not submit excessive personal data or information about third parties without a lawful basis.

2 Data Processed

2.1. A username, email address and password are provided during registration; account and access recovery information is processed. An IP address is used during recovery to technically limit requests. Passwords and private SSH keys should not be sent to support.

2.2. Rental records include order and resource identifiers, configurations, region, software image, time, status, pricing plan, charges and balance. Technical events and logs are used for diagnostics and security. Sources include the User’s actions, the service’s systems and messages from infrastructure providers.

2.3. Payment records include the link to the account, amount, currency and network, status, date, payment and invoice identifiers, payment address, charges and refunds, and payment service responses and notifications. Apirone (labelled CryptoCore in the interface) and Cryptomus (CryptoRoad) are used. When a payment is created, transaction parameters and technical notification addresses are transmitted, rather than the user’s name or email address. The payment service also processes information received directly during payment; its scope may differ from the information received by xgpu.store.

2.4. Support processes contact details, request content and attachments. The website includes the TGLiveChat widget: messages sent through it are transmitted through that service and Telegram. According to TGLiveChat’s policy, it also processes page, referrer, browser, device and country information derived from the IP address, and stores chat history using Supabase. Its policy is available at https://tglivechat.com/privacy. Do not send secrets or excessive personal data in chat or diagnostic logs. Computing environments may contain files, models, results and third-party data; special conditions are set out in Section 7.

3 Purposes and Limits of Use

3.1. Data is needed for account creation, authentication, provision of resources, billing, handling requests, security and dispute resolution. Only necessary information is used for each operation. If a function is objectively impossible without specific data, the Operator explains this before collecting it; refusing to provide optional information does not restrict the core service.

3.2. The principal basis for collection and processing is consent obtained in accordance with the prescribed procedure, except where lawful exceptions apply. Applicable legal requirements are used for reporting and other mandatory actions. Evidence of consent, billing and requests is retained only to the extent necessary and lawful.

3.3. Service notifications concerning accounts, orders, security and changes to terms are part of service provision. Advertising mailings and optional analytics are not automatically included in consent to the core service. Marketing consent may be withdrawn through the link in a message or through support without terminating the core service.

3.4. This Policy does not grant the Operator the right to sell user data or use environment contents to train its own models. A new, separate purpose requires a separate lawful basis and appropriate notice.

4 Cookies and Automation

4.1. Cookies are used for sign-in and settings. The xgpu_lang cookie retains an explicitly selected language for up to one year; for signed-in users, the language is also saved in the profile. The website includes Yandex Metrica, including Session Replay and click maps, to analyse visits and interactions. It may process IP addresses, browser and device information, page and referrer URLs, cookie identifiers and recordings of actions on pages. Information on its cookies and their lifetimes is available at https://yandex.com/support/metrica/en/general/cookie-usage. The chat widget also uses browser storage for sessions and settings. Cookies can be restricted or deleted in the browser; this may disrupt sign-in and retention of settings. Processing and consent withdrawal requests should be sent to support. These methods do not replace the Operator’s obligation to obtain prior consent where required by law.

4.2. Billing automatically compares the balance with the cost of resources; insufficient funds may result in deletion of the environment and loss of data. The User may challenge the underlying information and the result through support; a person reviews the request. If such processing falls within Article 19-1 of the law of the Republic of Kazakhstan, the required basis and explanations are provided, and an objection is considered within three working days.

5 Recipients and Data Location

5.1. To the extent necessary for the relevant function, data is transferred to the infrastructure service Shadeform and suppliers of the selected computing resources; payment services Apirone and Cryptomus; Yandex Metrica; and TGLiveChat and the services it uses to transmit and store messages. They receive data for the purposes described in Sections 2–4. Data may also be transferred pursuant to a lawful request from an authorised body. Access by personnel and contractors must correspond to their tasks and confidentiality obligations.

5.2. The website’s primary server and the primary account database hosted on it are located in Kazakhstan. Computing resources may be located outside Kazakhstan in the selected region. The location of the primary database does not mean that all backups, logs and information held by external recipients are also located in Kazakhstan. When storing personal data and transferring it across borders, the Operator must comply with Articles 12 and 16 of the Republic of Kazakhstan Law on Personal Data and Their Protection, including applicable requirements for storage in Kazakhstan and transfer bases. The User’s selection of an overseas GPU does not replace necessary measures and consents.

6 Retention and Security

6.1. The account is maintained until closure; after closure, information is retained only for a specific purpose not yet completed or a legal obligation. Payment and accounting records are retained for the applicable mandatory periods. Materials relating to a specific dispute may be retained until its resolution and the end of the period necessary to defend claims, without retaining the entire account indefinitely.

6.2. Once the purpose has been achieved, information is deleted or irreversibly anonymised unless the law requires its retention. Access to data retained by way of exception is restricted to the corresponding purpose.

6.3. The Operator is required to apply proportionate legal, organisational and technical safeguards. Absolute security is not guaranteed. In the event of a security breach, the Operator takes measures and fulfils notification obligations in the cases and within the time limits prescribed by law.

7 Data Within GPU Environments

7.1. The User determines the content of tasks, information uploaded and whether its processing is permissible. For third-party personal data, the User ensures a basis, provision of information and other obligations applicable to the User’s role. The Operator retains its own obligations that cannot be transferred to the User.

7.2. Before such processing, the parties agree on any necessary processing mandate or contract, instructions, infrastructure recipients and regions. This Policy does not replace a separate contract where one is required.

7.3. Technical access to contents is limited to what is necessary for service provision, diagnostics on request, security or compliance with the law. The User must keep their own backups. Deletion of an environment does not confirm immediate destruction of all service records or backup records.

8 Rights and Request Procedure

8.1. The User has the right to obtain information about their data and its processing, access it, request correction and, in prescribed cases, blocking, deletion or destruction, withdraw consent subject to legal restrictions, and protect their rights. Additional rights are provided where required by applicable law.

8.2. Requests should be sent to support@xgpu.store with a description of the request. Account access or email verification is preferred for identity verification; additional information is requested only where necessary. Requests are fulfilled within statutory time limits, including specific short time limits; a general correspondence period does not extend them. If a request is refused, the reason and available means of appeal are communicated.

8.3. The User may contact Kazakhstan’s authorised body for personal data protection through the eOtinish government requests system or apply to a court. Data-related rights are not restricted by the contractual limit of liability for computing services. Changes to the Policy are communicated on the website and, for material changes, by email before the new processing begins; any necessary new consent is obtained separately.