legal
Privacy policy
Last updated: 4 October 2026
GPU Zero ("we") runs machine-learning training on cloud GPUs that you connect, and shows its runs, metrics and logs in a console. This page says which personal data that involves and what you can do about it.
Who is responsible
The data controller is Jonathan Vecchione, a natural person based in Italy. For anything about your data, write to vecchionejonathan@gmail.com.
What we process
- Your account. When you sign in we receive, from our sign-in provider, your email address, your name and an identifier that stays the same across sign-ins. If you sign in with Google, these come from your Google account. We never see or store a password.
- Your workspace. What you put into GPU Zero to run training: projects (a repository address and branch), the GitHub accounts you connect and their names, jobs, runs with their configuration and parameters, metrics, the list of checkpoints, and the output your training scripts print. Run output may contain personal data if your scripts print it.
- Credentials you give us. Tokens and keys for your cloud, your storage bucket or your repositories. They are stored encrypted, are never shown back, and are only handed to the jobs that use them.
- Checkpoints. Model weights and training state are written by the training process itself, to the storage bucket your workspace connects, or, if it connects none, to a bucket we operate on Cloudflare R2. Our servers do not hold them.
- Technical data. Your IP address and request details pass through Cloudflare, which serves and protects our sites, and may appear in our server logs.
The console keeps your sign-in tokens and your theme choice in your browser's local storage. We set no cookies of our own and use no analytics, advertising or tracking. Our sign-in provider sets the cookies its sign-in page needs, on its own domain.
Why, and on what basis
- To provide the service you sign up for - signing you in, running your jobs, showing their results: performance of a contract (GDPR art. 6(1)(b)).
- To keep the service secure and working - limits, abuse prevention, logs to fix faults: our legitimate interest (art. 6(1)(f)).
We do not sell your data, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.
Who else handles it
These providers process data on our behalf, each only for its part:
- Auth0 (Okta) - sign-in.
- Google - only if you choose to sign in with Google.
- Hetzner Online GmbH, Germany - the server and database that hold your account and workspace.
- Cloudflare - delivery of our sites, the connection to our server, and the default checkpoint storage.
- GitHub - only if you connect it, to read the repositories you choose.
- The GPU cloud providers your jobs run on, with your account or ours - they receive your code, the credentials your job needs and the data your training reads.
Some of them are based in, or transfer data to, countries outside the European Economic Area, such as the United States. Those transfers rely on the providers' Standard Contractual Clauses or the EU-US Data Privacy Framework.
How long we keep it
As long as your account exists. When you ask us to delete your account, we delete it and your workspace's data within 30 days. Checkpoints in a bucket of your own stay yours to delete.
Your rights
You can ask to access, correct, delete or export your data, to restrict its processing, or object to it, by writing to vecchionejonathan@gmail.com. We answer within one month. You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or the authority where you live.
Children
GPU Zero is not meant for anyone under 14, and we do not knowingly hold their data.
Changes
When this policy changes, the date at the top changes with it. If a change affects what we do with data we already hold, we will tell you by email before it applies.