Privacy policy

Obsidian Peaks Technologies AB, org.nr 559581-1455, Celsiusgatan 2, 112 30 Stockholm, is the controller for the personal data described here. Questions and requests: info@obsidianpeaks.com.

Account: your name, email address and password (stored as a hash); for a company account, the company name, org number, VAT number and address; the SSH public keys you add; the terms version you accepted, with the time, IP address and browser.

Billing: your balance, top-ups, invoices and what each instance used (GPU time, disk, traffic). Card details go to Stripe; we never see the full card number, only the last four digits, the expiry and a token.

Logs: when you sign in and from which IP address; when instances start, stop and end; metering; every use of our operations key (time, person, reason); support chat messages and emails you send us.

Site: the contact form sends your name, email and message to us by email. The site sets no cookies and runs no analytics; it keeps your currency choice in your browser’s local storage. The contact form is protected by Cloudflare Turnstile, the only third-party script on the site.

What you put in an instance is yours and is not something we collect. Section 6 of the customer terms says when we look inside an instance.

• To provide the service you signed up for (contract): account, instances, billing, support.
• To bill and keep accounts (legal obligation): invoices and payment records are kept as bookkeeping law requires.
• To keep the service secure and enforce the terms (legitimate interest): sign-in logs, the operations-key log, abuse investigation.
• To answer you (legitimate interest): the contact form and support.

The sub-processors we use, and what each touches, are listed in the data processing agreement: Stripe (payments), Cloudflare (site, DNS, edge), Hetzner (the Console server and the model mirror; CPU servers and extra-IP relays when you order them), Google Workspace (email), Resend (contact-form delivery). The GPU boxes are our own hardware in Sweden. We do not sell personal data, and we hand it to authorities only when the law requires it.

The GPU boxes are in Sweden. The Console runs on a server in Finland (EU). The site is served by Cloudflare’s network. A CPU server or an extra IP is in the country you choose; the United States and Singapore are outside the EU/EEA, and choosing them is your instruction to place that server or address there.

• Account data: while the account exists, then 12 months, in case of disputes.
• Invoices and payment records: 7 years, as the Swedish Bookkeeping Act requires.
• Sign-in and operations logs: 12 months.
• Instance disks: deleted when the instance is destroyed or lapses past the grace period; we keep no backups of them.
• Contact-form and support messages: 24 months.

You may ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and take it with you. Write to info@obsidianpeaks.com. You may also complain to the Swedish Authority for Privacy Protection (IMY).

This site sets no cookies. The Console sets a session cookie when you sign in, which is needed to keep you signed in.

We post changes here with a new date. A change that matters is announced in the Console.