# Privacy policy

> We collect only what we need to run your account and your servers and to answer your requests. No advertising trackers, no sale of data. You can access or delete your data at any time.

Source: https://overgpu.com/legal/privacy  
Updated: 2026-10-23  
Publisher: OverGPU (https://overgpu.com/)

## 1. Who is responsible

OverGPU ("OverGPU", "we") is responsible for the personal data processed through overgpu.com and the OverGPU service. Customers with an active server can ask privacy questions in a support ticket from their dashboard; section 6 explains how to exercise your rights.

## 2. What we collect

- **Account:** your email address, your password (stored only as a salted hash we cannot reverse), your name and the billing details you add for invoices, your two-factor authentication settings and your email preferences.
- **Security:** sign-in events and active sessions, with your IP address shortened (for example 203.0.113.x) and the name of your browser, so you can review them in your dashboard.
- **Orders and payments:** your servers and orders, the SSH public keys you add, the root password you choose for a server (stored encrypted and erased 30 days after delivery), your top-ups (amount, coin, deposit address, transaction ID), invoices and balance movements.
- **Requests and support:** your messages, support tickets and the details you send with them.
- **Technical data:** web server logs (IP address, browser, pages requested) kept for security. For rate limits we store only a salted hash of your IP address.

We do not use advertising or analytics trackers, and we never sell personal data.

## 3. Why we use it

| Purpose | Legal basis |
| --- | --- |
| Answering your request and preparing an offer | Steps at your request before a contract |
| Running your account, providing, billing and supporting your servers | Performance of the contract |
| Security, fraud prevention and abuse handling, including the bot check on sign-in forms | Our legitimate interests |
| Accounting, tax and legal obligations | Legal obligation |
| Product announcements by email, if you turn them on in your notification settings | Your consent, which you can withdraw at any time in Settings |

## 4. How long we keep it

- Account data: while your account is open. When you close it, we delete your sign-in data, sessions and SSH keys, and keep billing records as long as accounting and tax law requires.
- Sign-in and security events: 12 months.
- Root passwords chosen at order time: 30 days after delivery, or one day after an order is cancelled, declined or refunded.
- Requests that do not lead to an order: 24 months after our last exchange.
- Customer and billing records: for the duration of the contract, then as long as required by accounting and tax law.
- Web server logs: 30 days.

## 5. Who we share it with

We share personal data only with providers that help us run the service, under contracts that protect your data, and with authorities when the law requires it:

- **Hosting, network, content delivery and security**, including Cloudflare Turnstile, which checks that sign-in and sign-up forms are used by humans.
- **Payment processing:** crypto top-ups go through our payment infrastructure and third-party exchange and payment providers, which receive what they need to process the payment (amount, coin, deposit address, transaction, and your IP address for fraud prevention). They do not receive your name or email address from us.
- **Email delivery** for account and billing emails.

When data is transferred outside your country, we rely on appropriate safeguards such as standard contractual clauses.

## 6. Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict its processing, and withdraw your consent. Your profile, billing details and email address can be changed in Settings in your dashboard, where you can also close your account. Customers with an active server can send any other request in a support ticket; we answer within one month. You can also lodge a complaint with your data protection authority.

## 7. Security

We protect personal data with encryption in transit, hashed passwords, optional two-factor authentication, restricted access, and secure erasure of server disks between customers.

## 8. Changes

We will post any change to this policy on this page and update the date above.