Privacy Notice

In short

• We collect what Nalvo.ai needs to work: your account, the computers you pair, and your bookings.
• The node agent records hardware, GPU readings, network type, heartbeats and readiness checks. It does not read your personal files or watch what you do.
• Every node's agent also sends yes/no answers about whether the computer is ready for Compute Market rentals and whether a restart is pending. During a rental on a Windows PC, the agent checks on the PC whether other programs use the GPU and sends only a yes/no answer, never program names.
• Our server sees the public IP address your computers connect from. For a node in the Compute Market, renters receive that address to connect.
• The Compute Market is not offered in the countries that Mamhol excludes. To check this, it looks up a country from the IP address of your connection when you register or set your declared country, sign in, book, register a node or set its country, list a node, list it again with "List again" or end a maintenance window early with "End now" in your browser, and from the IP address of a machine's node agent when it enrols or sends its probe evidence, including when it confirms the machine's country again after Mamhol switches the check on or adds a country while it is on. It uses a copy of DB-IP's country database on our own server: your IP address is not sent to anyone for this. When the Fleet Manager acts for you (adding a node, setting its country or resuming a listing it paused), and when a maintenance window ends on time, no connection country is looked up: only the declared countries of the node and of your account are checked. When a check passes, we keep at most your declared country and the result, not the country of your connection; when a check does not pass, we keep both countries and the result. We do not keep a history of where you connect from.
• We do not sell your data and do not use it for advertising.
• The website can use Google Analytics with a consent choice.
• Questions: hello@nalvo.ai.

1. Who is responsible

Nalvo.ai is run by Mamhol, which is responsible for the personal data described here.

This notice covers the website nalvo.ai, the Fleet Manager at fleet.nalvo.ai, the Nalvo node agent, and the Compute Market at market.nalvo.ai. It works together with the Terms of Service.

2. The website

The rental updates form asks for your full name, email address and a brief description of what you need compute for. When you submit it, we store those details in Nalvo's Compute Market service so authorised Mamhol administrators can respond to your request and contact you about rental availability. Submitting the form does not create an account or a booking.

Your form entries are not included in website analytics or saved in this browser's local storage. Please leave out passwords, access keys and sensitive or confidential information. You can also write to us from your own email app; we then receive your email address and your message.

Our hosting provider may record technical details of each request, such as IP address, time and browser type.

3. Your account

For the Fleet Manager and the Compute Market we keep:

• your username, and your password stored only as a one-way scrypt hash, never in readable form;
• your roles (for example host or renter), account status and creation time;
• the invitation you used, stored only as a hash;
• your sign-in sessions, stored only as hashes, with their expiry times;
• security counters, such as failed sign-ins per account and requests per network address;
• the country you declare;
• in the Compute Market, the SSH public key you add, and which version of these documents you accepted and when.

Signing in uses one session cookie, which the apps need to keep you signed in. The apps do not use advertising or analytics cookies.

4. What the node agent collects

When you pair a computer, the Nalvo node agent sends the following to your Fleet Manager. Rental heartbeats go to the Compute Market instead.

Hardware record, when it joins.

• The computer's name.
• A one-way fingerprint (SHA-256) of the machine's built-in identifier, not the identifier itself.
• Operating system and version, processor model and number of cores, memory size, and disk size (the system disk, or the Docker storage volume on Ubuntu nodes).
• Whether the computer is a virtual machine.
• For each NVIDIA GPU: model, unique GPU identifier, memory, driver version and temperature.
• The agent's version.

Network record. The connection type (Ethernet, Wi-Fi or unknown), the link speed, and whether the link is up. The agent does not send Wi-Fi network names or your local network addresses.

Heartbeats, about every 20 seconds. The agent's state; each GPU's temperature, utilisation and memory in use; the network record; the round-trip time to the Fleet Manager; how long the agent has been running; and readiness checks (NVIDIA tools work, a driver is present, and on Linux whether Docker is installed and at least 20 GB of disk is free), including the rental readiness checks and the pending-restart fact described below.

Public IP address as seen by our server. Every connection reaches our server from a public IP address. We use it for security and rate limits. For a node in the Compute Market, it is also the address renters connect to during their rental. Our server tells the agent this address, so that the Nalvo egress guard can stop renters' containers from connecting to it. The agent keeps a copy of it on the computer in these cases: on Linux, when the agent is installed as a system service, in a local file on every computer, whether or not the computer was prepared for rentals; on Windows, only on a PC prepared for rentals, where the agent passes it to the egress guard in the rental environment and records it in its own state file. The copy stays on the computer. The Compute Market also looks up the country of this address when the agent redeems an enrolment code and when it sends probe evidence, including the fresh evidence it sends to confirm the node's country again (section 5).

Readiness facts from the Ubuntu installer. Whether Secure Boot is on, the Docker storage size, the free space on the system disk, whether SSH password login is on, and the NVIDIA driver version. Today these stay on the machine.

Self-test results, when you ask for a self-test. For each GPU: model, unique identifier, driver version, temperature, current and maximum clock speed, and PCIe link generation and width; the disk write speed, measured by writing a temporary file that is then deleted; and whether Docker can run a GPU container. A self-test is refused while a rental is running.

Other software on the GPU, when the Fleet Manager asks. Used to see whether the GPU is free, for platform switching and for rental protection: the process IDs and names of programs using the GPU; whether another marketplace's host software, such as Salad, is running; and on Linux, the IDs, image names and names of Docker containers that are not Nalvo's.

Results of jobs. The outcome of work the Fleet Manager asks for, such as checks, Nalvo Blocks results and rental container facts (port and host-key fingerprint).

Rental heartbeats, for nodes in the Compute Market, sent to the Compute Market: about every 60 seconds during a rental, whether the rented GPUs answer, whether the renter's container is running, whether a GPU reports a slowdown and, on a Windows PC, whether other programs on the PC used the GPU (yes or no; "yes" also when the agent could not read the GPU usage figures, or could not yet tell the rental environment apart from the PC's other WSL environments).

Rental readiness checks and pending restarts, with heartbeats. Every node's agent sends these with its heartbeats, whether or not the computer was prepared for Compute Market rentals. They are yes/no answers only. On Linux: whether Docker and the Nalvo egress guard work, whether the GPU is visible for rentals, whether the rental ports are the default range, and whether the system reports that a restart is pending. On Windows: whether Windows has a restart pending, read from Windows' pending-restart flags; and, for a PC prepared for rentals, whether the agent runs under the dedicated Nalvo account, whether WSL is installed with mirrored networking active, whether Docker and the egress guard work in the rental environment, whether the GPU is visible there, whether the NVIDIA driver is new enough, whether the dedicated account is kept out of the PC's other folders and drives, whether the agent can read the GPU usage counters, and whether the rental ports are the default range. On a Windows PC that was never prepared for rentals, the agent does not examine WSL or the PC's accounts: the rental checks are reported as "no", except the port-range answer, which is "yes" because the default range applies; the pending-restart answer is still the real one. On Linux the agent runs the same checks on every computer, so a computer that was not prepared for rentals reports its real answers, usually "no" (and "yes" for the default port range). The Fleet Manager uses these facts to decide whether a node may be listed, and to pause a listing while a node is not ready or a restart is pending.

Windows PCs prepared for rentals. To find out whether the host's PC used the GPU during a rental, the node agent reads Windows' per-process GPU usage counters on the PC itself (the figures Task Manager shows for each program), limited to the NVIDIA GPU's 3D, graphics and compute engines and leaving out the rental environment's own processes. To know which processes those are, it looks at the list of processes running on the PC and keeps the process IDs of the rental environment's own WSL processes on the PC; when another WSL environment runs on the PC, it may restart the dedicated account's WSL once for this while no rental is running. For the readiness check above it also confirms, outside rentals, that it can read these counters. To check that the dedicated account is kept out of the PC's other folders and drives, it tries, as that account, to open them. These readings are evaluated on the PC, and only yes/no facts leave it: with each rental heartbeat, whether other programs used the GPU (host GPU busy); with each heartbeat, the readiness checks above. The agent does not send the names, process IDs or usage figures of programs, or the names of folders, drives or files, from these readings. During a rental it also asks Windows to keep the PC awake; that sends nothing. This is separate from "Other software on the GPU" above, which still applies when the Fleet Manager asks.

Provider keys. If you connect an account you hold with another provider, the key you give us is encrypted at rest, never shown back to you and never written to logs.

What the agent does not do. It does not read your documents or personal files (the folder check above only tries to open folders and drives, and sends nothing about what it finds), your browsing, keystrokes, screen, camera or microphone, and it does not itself listen for incoming connections. On a computer prepared for rentals, renters' containers do listen on the rental ports (see the Terms of Service, section 4). Its own log stays on your computer.

5. What the Compute Market stores

• Accounts: as in section 3.
• Nodes: name, owner account, declared country, status and reliability counters, the software-probe evidence (GPU model and memory, system memory, disk, driver, operating system and processor) with its digest, the host platform (Windows or Linux) taken from that evidence, and the node's credentials, stored only as hashes.
• Listings: every version of each listing's price and terms.
• Bookings: the renter and host accounts, the node, the booked window, the pinned price and terms digest, and a hash-chained record of every change of state, including extensions, performance exits and disputes.
• SSH public keys added by renters and copied to each booking, and the connection facts posted by the host's machine: public address, port, username and host-key fingerprint.
• Rental heartbeats: sequence number, the time our server received each one, and the health facts listed in section 4.
• Payments: authorizations, captures, refunds, statements, receipts and ledger entries. These are sandbox records today. When live payments start, card details will be handled by the licensed payment provider and not stored by Mamhol.
• Disputes: reason, times, outcome and any refund.
• Audit and security records: an append-only record of control actions (who did what, and when), and server logs that give each error an incident number. Passwords and tokens are kept out of logs.
• Country checks: the declared country of accounts and nodes (as above and in section 3), Mamhol's list of excluded countries, and a flag for each country check that does not pass, as described below.

Country checks. The Compute Market is not offered in the countries that Mamhol excludes (Terms, section 3). To check this, it compares two countries with that list: the country declared for the account or node, and a country it looks up from the IP address of the connection (a person's own connection, or a node agent's). For a host's node, the country declared for the host's own account is compared with the list too. It does this at these steps, with the connection named in brackets:

• when an account is registered (as a renter or as a host) or sets its declared country later, at each sign-in to the Compute Market, and when a hold is placed or a booking is made (the person's own connection);
• when a host registers a node (the host's own connection; no connection country is looked up when the node is added from the Fleet Manager);
• when a host sets the country of a node that has none (the host's own connection when this is done in the Compute Market in the browser; none when the Fleet Manager sets it; in both cases the node's agent connection is then checked before the node can be booked again);
• when the node's agent redeems the enrolment code and sends probe evidence (the agent's connection). This includes the fresh evidence by which the agent confirms the node's country again: each time Mamhol switches the check on with countries on the list, or adds a country to the list while the check is on, every listed node has to do this before it can be booked again, and the Fleet Manager asks the agent for it automatically;
• when a host creates a listing, puts a node back on the market with "List again", or ends a maintenance window early with "End now" in the Compute Market (the host's own connection, from the host's browser);
• when a maintenance window ends on time, and when the Fleet Manager resumes a listing it had paused (no connection country is looked up; only the declared countries of the node and of the host's account are checked).

If one of these listing steps does not pass once the check is switched on, the listing does not open or re-open: after "List again" or the end of a window the node stays out of the market until the host lists it again, and after the Fleet Manager's resume the listing stays paused. For these listing steps, the country of the host's connection, where one is looked up, is kept only in the flag of a check that does not pass, as described below.

• How the lookup works. The country is looked up in a copy of DB-IP's free "IP to Country Lite" database, kept on our own server. Your IP address is not sent to DB-IP or to anyone else for this. The result is a country code only, never a city or a more precise place, and it can be wrong. Private and local network addresses give no country. If the database is not available, only the declared country is checked.
• What is stored. A check that passes leaves no flag. The audit record of an account registration, of a country declared later for an account or a node, and of a node registration notes the declared country and the result of its check; when the check passes, it does not note the country of the connection. For a check that does not pass (for example because a country is on the list, or because no country was declared), the Compute Market keeps one flag with both countries: the account or node concerned, the declared country, the country looked up from the IP address, the result (flagged or refused), the reason and the time. The audit record of such a step, where there is one, can also note both countries. The IP address itself is not kept in the flag or in the audit record. We do not keep a history of where you connect from.
• Who sees it. Only Mamhol administrators can see the list of excluded countries and the flags; other users of the Compute Market cannot. Administrators use them to review accounts, nodes and rentals. A rental that is already running when the country of its renter, of its node or of the node's host is added to the list is flagged for review, and so is one running on a node whose country is missing or not yet confirmed when Mamhol starts excluding countries, or switches the check on or adds a country while it is on.
• Reporting mode. Mamhol can run the checks in a reporting mode, in which nothing is refused and checks that do not pass are only recorded as flags.
• VPNs and proxies. If you connect through a VPN, a proxy or a similar service, the country looked up is the country of that service, and any flag records that country.

IP geolocation by DB-IP (https://db-ip.com). The database is used under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).

6. Who can see what

• You see your own account, nodes, listings, bookings and statements.
• Hosts see bookings on their nodes, without the renter's account name or payment details. The host's machine receives the renter's SSH public key so the renter can log in. A public key can include a comment such as a name or email address. During a rental, the host's Fleet Manager can see the names of programs using the rented GPUs, which can include the renter's own programs.
• Renters see listing facts, including the node's name, declared country, platform (Windows or Linux) and reliability marks, and for their own rental the node's platform, public IP address, port and host-key fingerprint.
• Mamhol administrators see what they need for reviews, support, disputes and security.
• Service providers that run our systems: Google Cloud for our servers, Firebase Hosting for the website, Google Analytics (Google) for website measurement, and the licensed payment provider once live payments start.
• Authorities, where the law requires it.

No sale, no advertising. We do not sell personal data, do not share it for advertising, and do not use it to train AI models. The Fleet Manager's insights are rules-based, and no data is sent to an AI model provider.

7. Why we use it

• To measure website use with your consent.
• To run your account and sign you in safely.
• To pair your computers and show their status, readiness and connection.
• To review nodes before they are listed, to decide whether a node is ready to be listed, and to match bookings to free nodes.
• To start, measure and stop rentals, apply performance credits and calculate statements.
• To settle disputes from evidence.
• To prevent fraud, abuse and attacks, and to enforce the Acceptable use policy.
• To keep the Compute Market out of the countries that Mamhol excludes, and to follow sanctions rules (section 5).
• To meet legal duties.

8. How long we keep it

• Rental update requests: kept until a Mamhol administrator removes the request. Removal clears its name, email and compute description from the current request record. A minimal record preventing duplicate submissions and earlier server backups may remain. You can ask for removal by writing to hello@nalvo.ai.
• Express-interest applications: 180 days after their last activity, or until you delete them with your application's own link (see Express-interest applications).
• Google Analytics: event data retention is set in Google Analytics Admin. Analytics cookies can persist for up to 400 days. The nalvo_analytics_consent localStorage key stores your choice until you clear it; changing your choice updates it.
• Heartbeats: the Fleet Manager keeps the latest heartbeat of each node and a rolling record of its last 500 heartbeats.
• Hardware and node records: each hardware record is kept in an append-only history. Today it is not deleted when you remove the node.
• Accounts: while the account is open.
• Bookings, rental events, payments, statements and the audit record: these are append-only evidence and financial records.
• Country-check flags: today they are not deleted.
• Server logs: rotated by size.
• A renter's workspace on a host's machine: deleted when the rental ends (see Terms, section 10).

9. Where it is stored

Our servers run on Google Cloud. Google Analytics may process website data in countries outside your own, including the United States.

10. How we protect it

Passwords are stored as scrypt hashes. Session tokens, node credentials, and invitation, pairing and enrolment codes are stored as hashes. Provider keys are encrypted at rest. The node agent connects to the Fleet Manager and the Compute Market over HTTPS. Bookings, payments and control actions are kept in append-only, tamper-evident records. No system is perfectly secure.

11. Your choices and rights

You can remove a node or uninstall the agent at any time; collection from that computer then stops. You can ask us to see, correct or delete your personal data, or object to how we use it, by writing to hello@nalvo.ai. Some records, such as bookings and payments, may have to be kept as evidence or for legal reasons.

12. Children

Nalvo.ai is not intended for children.

13. Changes

We will update this notice before we collect anything new, and tell you about important changes.

14. Contact

Email: hello@nalvo.ai. Please do not send passwords, access tokens or payment details by email. Mamhol operates Nalvo.ai.