Terms of Service

In short

• Nalvo.ai is run by Mamhol, a company in Qatar. Accounts are by invitation only.
• The Fleet Manager is free.
• The Compute Market is not offered in the countries that Mamhol excludes. At registration, booking, node registration, enrolment, listing, listing again and when a listing re-opens after a pause or a maintenance window, we check the declared country and, when the step comes from your own connection or a machine's, a country we look up from the IP address of that connection. A host whose own declared country is excluded cannot host. Once the check is switched on, you need a declared country, and so does each node. Each time Mamhol switches the check on, or adds a country while it is on, every listed node must confirm its country again through its node agent before it can be booked; the Fleet Manager arranges this automatically (section 3).
• In the Compute Market you book a whole machine by the hour. Your card is authorized when you confirm and charged at the end, only for the amount on your statement.
• You pay for the whole booked window, unless the host fails. If the host fails, you pay only for the time you actually received.
• Slow or unavailable GPU time is credited automatically: 100% for unavailable time, 50% for degraded time.
• Some hosts are Windows PCs. There the GPU is shared with the host's desktop, isolation is weaker than on a dedicated Linux server, and interruptions are more likely. Interrupted time and sustained GPU use by the host are credited automatically; lighter or shorter host use is not detected. The host, and other people with physical access to the host's PC, can reach the rental environment, so do not process highly sensitive data on a Windows host (section 17).
• Your files on the machine are deleted when the rental ends. Keep your own copies.
• Today every payment is a sandbox payment. Real payments start only once a licensed payment provider is live.

1. Who we are and what these terms cover

Nalvo.ai is a product of Mamhol, a company established in Qatar. In these terms, "Mamhol", "we" and "us" mean that company. "You" means the person or organisation using Nalvo.ai.

These terms cover the website nalvo.ai, the Fleet Manager at fleet.nalvo.ai together with the Nalvo node agent you install on your computers, and the Compute Market at market.nalvo.ai.

They work together with the Privacy notice, the Acceptable use policy and, for hosts, the Host agreement. A booking records the listing price and a terms digest when its hold is placed.

These terms are written in English.

2. Words we use

• Fleet Manager: the web app where you see and manage your own computers.
• Node: a computer paired with the Fleet Manager through the Nalvo node agent.
• Host: an account that offers a node in the Compute Market.
• Windows host: a host whose node is a Windows 11 PC that runs rentals in WSL2, Microsoft's Windows Subsystem for Linux (section 17). Other nodes are Linux machines.
• Renter: an account that books a node.
• Listing: a node offered for rent, with an hourly price and terms. Every change creates a new version of the listing.
• Booking or rental: one renter's use of one whole node for a booked window.
• Booked window: the hours you booked, from the start hour to the end hour.
• Statement: the calculation of what a rental costs, made when it ends.
• Sandbox: the test payment mode used today. Nothing is charged and nothing is paid out.

3. Accounts

• Accounts are by invitation only. An administrator gives you a one-time invitation link or code. It works once and expires.
• One account belongs to one person or organisation. Keep your password private. You are responsible for what happens under your account. Tell us at once if someone else has used it.
• Give us accurate information, including the country you declare. People and organisations under sanctions may not use Nalvo.ai (see the Acceptable use policy).
• We may suspend or close an account as described in section 14.

Countries where the Compute Market is not offered. The Compute Market is not offered in the countries that Mamhol excludes. The list is kept by Mamhol administrators. Today only Mamhol administrators can see the list; it is not shown in the Compute Market or on this website. You may not rent, host, list or enrol a machine in the Compute Market from an excluded country, or with a machine located in one.

• What we check. Two countries are compared with the list: the declared country (yours, or the one declared for a machine), and a country we look up from the IP address of the connection (your own connection, or the connection of a machine's node agent). For a host's node, the country declared for the host's own account is compared with the list too. We check: when you register an account, as a renter or as a host, and when you set your declared country later (your declared country and your own connection); when you place a hold or book, including an extension (section 9) (your declared country and your own connection, and also the declared countries of the host's node and of the host's account); when a host registers a node (the node's declared country, the host's declared country and the host's own connection; no connection when the node is added from the Fleet Manager); when a host sets the country of a node that has none (the node's new country, and the host's own connection when this is done in the Compute Market in the browser; no connection when the Fleet Manager sets it); when the node's agent redeems the enrolment code and when it sends its probe evidence (the node's declared country and the agent's connection); when a host creates a listing, puts a node back on the market with "List again", or ends a maintenance window early with "End now" in the Compute Market (the node's declared country, the host's declared country and the host's own connection); and when a maintenance window ends on time, or the Fleet Manager resumes a listing it had paused, and the node's listing would take bookings again (the node's and the host's declared countries; no connection). If a country checked is on the list, that step is refused. When this happens as a window ends, on time or early, the window still ends, but the listing stays closed and the node is out of the market until the host uses "List again"; when it happens as the Fleet Manager resumes a listing, the listing stays paused.
• Hosts in an excluded country. A host account whose declared country is on the list cannot host, wherever its machines are: once the check is switched on, it cannot register a node, create a listing or list a node again, its nodes cannot be booked, and its listings are not shown in search.
• Declaring a country. Declare the country where you actually are, and for a machine the country where it actually is. Every node needs a declared country. Once the check is switched on and at least one country is on the list, you cannot register (as a renter or as a host), register a node or book without a declared country, and a node without one cannot be enrolled, listed or booked, and its listings are not shown in search. If your account has no declared country, for example because it was created before the check, you can set it yourself, once, in the Compute Market; it is checked like a registration. A host can likewise set the country of a node that has none, once, in the Compute Market or through the Fleet Manager. Once the check is switched on and at least one country is on the list, a node whose country was set this way cannot be booked until its node agent has confirmed it from the machine (see the next item). Once a country is declared, you cannot change it yourself: if yours, or your machine's, changes, write to us.
• Confirming a node's country. A node's country is confirmed by its node agent from the machine: the agent sends fresh probe evidence, and the country of the agent's connection is checked then, as at enrolment. This is needed when a host sets the country of a node later (see the previous item), and each time Mamhol switches the check on with countries on the list, or adds a country to the list while the check is on: every listed node, and every other node that has already sent its probe evidence, then has to confirm its country again before it can be booked again. The Fleet Manager asks the agent for this automatically, usually within minutes while the machine is online and paired with it; the host does not need to do anything. A confirmation counts only when a country can be looked up for the agent's connection and neither that country nor the declared country of the node or of the host's account is on the list. Once the check is switched on, a node waiting for confirmation cannot be booked, including for an extension (section 9), and its listing is not shown in search. A rental already running on it continues unless the law requires an earlier stop.
• Signing in is never refused. When you sign in to the Compute Market we make the same check, but only record the result if it does not pass.
• If a country is added to the list. Accounts and nodes there are not closed, and their owners can still sign in, but they cannot book, list or enrol from there or with those nodes. Listings of nodes in an excluded country, and of hosts who declared that country, are not shown in search. A host who declared that country can no longer host (see above). If the check is on when the country is added, every listed node, wherever it is, has to confirm its country again through its node agent before it can be booked again (see "Confirming a node's country" above). A rental that is already running, including one on a node whose host declared that country, is not cut off: it continues to the end of its booked window unless the law requires an earlier stop, and it is flagged for review by an administrator.
• Reporting mode. Mamhol can run these checks in a reporting mode first. In that mode nothing is refused or hidden, and checks that do not pass are only recorded. If the Compute Market has to be rolled back to an earlier version, the checks may return to reporting mode until Mamhol switches them on again, and some of the checks described here may not run until the current version is back.
• How the IP country is found. We look up the country, never a more precise place, in a copy of DB-IP's free country database kept on our own server. The result is not always right. If the database is not available, or the address is a private or local one, only the declared country is checked, and a node's country cannot then be confirmed by its node agent (see "Confirming a node's country" above). What we store is described in the Privacy notice.
• VPNs and proxies. If you connect through a VPN, a proxy or a similar service, the country we see is the country of that service, not yours. A step can then be refused even though you are not in an excluded country: turn the service off for that step, or write to us. Using a VPN, a proxy or a false declared country to get around the list is not allowed (Acceptable use policy).
• The Fleet Manager. This country check applies to the Compute Market only. The free Fleet Manager does not check countries today. The sanctions rules in the Acceptable use policy apply to all of Nalvo.ai.

4. The Fleet Manager (free)

What it is. A free service that shows your own computers in one place: their hardware, network, readiness, GPU temperature and connection, with insights and an assistant that answers questions about your fleet, both based on fixed rules. No AI model is used to reason about your data.

Price. The Fleet Manager is free of charge.

Pairing. You pair a computer by running a one-time command, or with the Nalvo USB installer on Ubuntu. The node agent itself accepts no incoming connections: it only connects out, over HTTPS, to the Fleet Manager and, for a node in the Compute Market, to the Compute Market. Rentals are different. On a computer prepared for Compute Market rentals, each renter's container listens on its rental port for the renter's SSH connection, and that port is open to the internet through the port forwarding you set up on your router (on a Windows PC also through a Windows firewall rule that the preparation script adds). The agent runs only a fixed list of jobs: hardware, network and readiness checks; a self-test when you ask for one; heartbeats; Compute Market enrolment and rental heartbeats; starting, checking, extending and stopping rental containers; on computers prepared for rentals, giving the egress guard the computer's current public address; on Windows PCs prepared for rentals, keeping the rental environment running (and, while no rental is running, restarting it once when the agent needs to tell it apart from other WSL environments on the PC; section 17) and asking Windows not to sleep during a rental; Nalvo Blocks; checking for other providers' software; replacing its own credentials; and uninstalling itself. It also updates itself: when it starts and every 6 hours it checks the Fleet Manager for a newer version, and installs it only if the file matches the published fingerprint. By pairing a computer you allow the agent to do these things on it. What the agent records is described in the Privacy notice.

Your control. You can remove a node in the Fleet Manager, or run the agent's uninstall command, at any time. A node you revoke uninstalls the agent by itself.

Nalvo Blocks. Optional, small background work units that a node can run between rentals. Each block gets a receipt in a sandbox ledger. Blocks do not pay real money today.

Other providers. If you connect an account you hold with another provider, you allow the Fleet Manager to act on that account only as you instruct it. You remain bound by that provider's own terms.

Your computers stay yours. You are responsible for your computers, their power and network, and any other software you choose to run on them. The Fleet Manager is a beta service: it can be unavailable, and its figures can be late or wrong.

5. The Compute Market: how a booking works

What every listing says. Every listing carries three statements: "Whole node — exclusive", "Specs self-reported — not hardware-attested" and "Admin-reviewed (software probe)". The GPU model, memory and other specifications come from the host and from a software probe. We do not guarantee them, and an administrator's review is not a guarantee of performance. Each listing also shows the host's platform, a Windows PC or a Linux machine, and search can be limited to one platform.

Booking by the hour. Bookings start and end on whole hours (UTC), with a minimum of one hour; a listing can set its own minimum and maximum. Search shows which nodes are free for your exact window. Once the country check is switched on, search does not show listings of nodes in excluded countries, of hosts whose declared country is excluded, of nodes without a declared country, or of nodes whose country is waiting to be confirmed by their node agent (section 3).

Hold. Reserving places a hold for 2 minutes, extended to 5 minutes once you start paying. While your hold lasts, nobody else can take those hours. Cancelling a hold is free.

Terms fixed at the hold. The hourly price and listing terms that apply when you place the hold are copied into your booking. If the host changes the listing later, your booking is not affected.

Confirming: authorization, not a charge. When you confirm, your card is authorized for the full booked window (hourly price × hours). An authorization reserves the amount on your card; it is not a charge.

Access. You give us an SSH public key. When your window starts, the host's machine starts an isolated container for you with only the rented GPUs, limits on memory, processor and processes, and SSH login by key only, as the user "renter". On a Windows host the container gets all of the machine's GPUs (section 17). You receive the address, port and host-key fingerprint to connect.

Network. Your container can connect to the internet over IPv4, but it cannot open connections to private or local network addresses, such as the host's home or office network, its router or the host's machine itself. It also cannot open connections to the public IPv4 address of the host's own internet connection (the address our server last saw it connect from). It uses public DNS servers (1.1.1.1 and 8.8.8.8).

If the rental cannot start. If the machine has not started your rental within 10 minutes of the booked start, the rental fails, you pay nothing and the authorization is released.

End. The rental ends at the end of the booked window. The container is stopped automatically and anything still running in it stops.

Capture. After the rental ends we calculate your statement and capture that amount from the authorization. Any part of the authorization not needed is released. You receive a receipt.

6. What you pay: the booked window

The whole booked window is payable. The host keeps the whole machine for you, so you pay for the whole booked window. Stopping early, or not using the machine, does not reduce the price. Once a rental has started it cannot be shortened, except by a performance exit (section 8).

How it is calculated. Hourly price × booked seconds ÷ 3,600, rounded down to the cent once. Performance credits (section 8) are taken off before your card is charged.

Price and platform fee. The listing price is the price you pay. Mamhol keeps a platform fee from it (10% in the sandbox); the rest is the host's share.

Currency. The sandbox shows prices in US dollars.

Cancelling before the start. You can cancel a confirmed booking at any time before its start hour. The authorization is released in full and nothing is charged. After the start hour a booking cannot be cancelled.

If the host cancels. A host cannot delist a node or schedule maintenance over a confirmed booking. If a booking is nevertheless cancelled by the host or by us before it starts, the authorization is released in full.

7. When the host fails: pay only for delivered time

Our server measures delivery. During a rental the host's machine sends a heartbeat about every 60 seconds. Delivered time is the time between heartbeats received by our server, inside your booked window. A gap of more than 3 minutes between heartbeats counts as not delivered. Time the host claims is never used for billing.

Host fault. If our server receives no heartbeat for 3 minutes (or none in the first 2 minutes of the rental), or the machine fails to stop the rental correctly, the rental ends as a host fault. You pay only for delivered time, minus performance credits, and the rest of the authorization is released. The host's node is taken out of the market until the host has cleared the fault and listed it again.

Your data. When a host's machine fails, your container and workspace are lost with it. Keep checkpoints and results somewhere other than the node.

8. Automatic performance credits and early exit

With every rental heartbeat, the node agent checks the rented GPUs and your container:

• Unavailable, credited at 100%: a rented GPU does not answer or is missing, or your container is not running. On every host, the heartbeat after an interruption of your container, or after a gap of more than about two minutes in which the node agent could not observe your rental (for example the machine slept or the agent stopped), marks the whole interval since the previous heartbeat as unavailable.
• Degraded, credited at 50%: a rented GPU reports a hardware slowdown, a hardware or software thermal slowdown, or a hardware power-brake slowdown. Normal power-limit clocking under full load is not counted.
• Degraded also, on a Windows host only: a program on the host's PC other than your rental uses more than 15% of a 3D, graphics or compute engine of the GPU for at least half of a minute; or the node agent cannot read the GPU's usage figures; or it cannot yet tell your rental environment apart from other WSL environments on the host's PC. Lighter or shorter use is not detected, and use of the GPU's video encoding and decoding engines is not counted (section 17).

No claim needed. Credits are calculated automatically and taken off your statement before your card is charged. They never exceed the statement, and they are rounded down to the cent once.

Not measured automatically. Network speed, problems with the software inside your container, use of the machine by the host on a Linux host, and anything else not listed above. If you believe the host used the machine during your rental, or something else went wrong, open a dispute (section 12).

Performance exit. If at least half of the last 30 minutes was degraded or unavailable, and at least 10 minutes were observed, you may end the rental early. You then pay for delivered time minus credits, and the rest of the window is not charged. The host's node receives a reliability mark.

9. Extending a rental

You can extend a booking that is confirmed, starting or running. An extension is a new booking on the same node, adjacent to yours: from your current end hour to the new end hour. It uses the listing's price and terms at the moment you extend, and is held, confirmed and authorized like any other booking, including the country check (section 3).

An extension is possible only if the node is free for the added hours, with no other booking and no maintenance window. Your container, port, host key and workspace carry on without a restart; only the end time moves.

10. Your data on the host's machine

Deleted when the rental ends. When your rental ends (at the end of the window, by performance exit or by a failure), your container and its workspace volume are deleted from the host's machine. If an extension continues the rental, deletion happens at the end of the last adjacent booking. The node agent also deletes a rental container by itself once its end time has passed by 2 minutes, even if it cannot reach the Fleet Manager. If the machine is switched off at that moment, the deletion runs when it is back online (on a Windows host, when the PC is back on and its rentals account is signed in). A stopped container is started again after an interruption only while the market still runs your rental; once the rental has ended it is not started again.

No backups. We do not back up your workspace. Copy your results off the machine before the rental ends.

What the host can technically do. The host owns and controls the machine. Your container limits what your work can reach of the host's machine, but it does not hide your data from the machine's owner, who has physical and administrator access. The Host agreement forbids hosts to access your container or data, and we act on any breach, but we cannot make it technically impossible. Consumer graphics cards offer no confidential-computing protection, and we make no such claim. Do not process data you could not accept a host seeing. On Windows hosts the isolation is weaker still, and other people with physical access to the host's PC can also reach your data (section 17).

What the host's machine receives. Your SSH public key, so that you can log in. A public key can include a comment such as a name or email address; remove it if you prefer. The host's view of your booking does not show your account name or payment details.

11. Sandbox payments today

During the closed beta every payment is a sandbox payment. No card is charged, no money moves and no host is paid. Amounts on statements and receipts show how the live system will calculate; they are not money owed by anyone.

Real payments start only after a licensed payment provider is live for Mamhol, and after these terms are updated to describe it and accepted. Nalvo.ai does not keep a prepaid balance or wallet for you: each booking is authorized on its own.

12. Refunds and disputes

No refunds of delivered time. Time that was delivered and charged is not refunded, except through a dispute or where the law requires it. Any applicable mandatory rights remain unaffected. Performance credits and host-fault settlement are applied before your card is charged, so they need no refund.

Opening a dispute. You can open a dispute from the rental within seven days after the end of the booked window. Choose a reason: not delivered, degraded, overcharge, or other.

Before starting formal proceedings, please contact us at hello@nalvo.ai so that we can try to resolve the problem.

How it is decided. An administrator reviews the evidence: the rental's event record, the heartbeats our server received, the health reports and the statement. The outcome is a refund of all or part of the amount charged, or a refusal with reasons. While a dispute is open, the host is not paid for that rental.

13. Records and receipts

We keep append-only, tamper-evident records of bookings, rental events and payments. Each statement and receipt carries a digest, so it can be checked later. These records let disputes be settled from evidence rather than memory. How long we keep them is set out in the Privacy notice.

14. Suspension and ending

You may stop using Nalvo.ai at any time: remove your nodes, uninstall the agent and ask us to close your account. Bookings already confirmed are completed or cancelled and settled under these terms.

We may stop a rental, pause a listing, or suspend or close an account if you break these terms or the Acceptable use policy, if the law requires it, or to protect other users or the service.

Payment obligations and open disputes continue after an account is closed.

15. Changes

Nalvo.ai is a beta service and will change. We will change these terms only with notice. A booking always keeps the terms pinned when its hold was placed.

16. Beta service and disclaimers

Nalvo.ai is provided as a closed beta, "as is" and "as available". Any applicable mandatory rights remain unaffected. Hardware specifications are reported by hosts and a software probe, and are not hardware-attested. We do not promise any level of availability; the performance credits and host-fault rules in sections 7 and 8 are how poor performance is compensated.

17. Renting from a Windows host

Some hosts are Windows 11 PCs, such as gaming computers. Listings show which platform a host uses. On a Windows host you get the same product as on a Linux host: one isolated container with the GPUs, SSH login by key as "renter", a private workspace and automatic credits. Before you book one, you should know the differences:

• How it runs. Your container runs in a Linux environment inside WSL2 (Windows Subsystem for Linux) on the host's PC, under a separate standard Windows account. Nalvo's preparation script normally creates that account for rentals. It uses an existing account instead only when the host explicitly tells it to, after a warning.
• All GPUs together. A Windows host is rented with all of its NVIDIA GPUs, as one unit.
• A shared GPU. The GPU usually also drives the host's Windows desktop. Its memory is shared with Windows and cannot be reserved for you, so less may be free than the card's full size. "Whole node — exclusive" means that no other renter shares the machine; it does not mean that the host's own desktop is switched off. The host must not use the GPU during your rental. During your rental the node agent reads the GPU's usage figures on the host's PC. When a program other than your rental, for example a game or other GPU-sharing software, uses more than 15% of a 3D, graphics or compute engine of the GPU for at least half of a minute, that time is counted as degraded and credited at 50% (section 8). Lighter or shorter use is not detected and not credited, although it can still slow your work. Use of the GPU's video encoding and decoding engines (for example when the host records or streams the screen) is not counted either. If the agent cannot read these figures during your rental, that time is also counted as degraded, and a PC whose agent cannot read them is not offered for rent. To leave out only your rental's own GPU use, the agent must tell the rental environment apart from other WSL environments on the host's PC, such as the host's own Salad or Docker Desktop. For this it may restart the rental environment once, but only while no rental is running. While it cannot tell them apart during your rental, all of that time is counted as degraded.
• Limited disk space. The rental environment on a Windows host has a fixed maximum size, by default at most 256 GB and less on a PC with little free disk space. That space is shared by your container, your workspace and the environment's own system and images. When it is full, writing in your container fails.
• Weaker isolation. Microsoft does not treat WSL as a security boundary, and some Linux protections that Docker uses on Linux hosts (AppArmor) are not available in WSL. Your container is kept apart from the host's own Windows account and from private network addresses, but its isolation is weaker than on a dedicated Linux server. As on every host, the host can technically see your data (section 10). On a Windows host, so can other people with physical access to the host's PC: the Windows account that runs the rentals may have no password, and anyone who can sign in to it can open the rental environment, including your container and workspace, without any further password. Do not process highly sensitive data on a Windows host.
• More interruptions. A Windows PC can be interrupted by a Windows or WSL update, sleep, the Nalvo account being signed out, a power cut or a lost connection. The host must avoid these during your rental, and the listing of a PC that is waiting to restart for updates is paused while no rental is running on it, but a restart can still fall inside your rental. An interruption stops the programs running in your container. A restart or a sign-out usually keeps the PC away for more than 3 minutes, and your rental then ends as a host fault (see the next item). After a shorter interruption, if your rental is still running, the node agent starts your container again with your workspace.
• Automatic credits for interruptions. You do not pay for time lost to an interruption. While the host's PC can still report, that time counts as unavailable and is credited at 100%. If it stops reporting for 3 minutes, the rental ends as a host fault and you pay only for delivered time minus credits (section 7). Reports arrive about once a minute. The report after an interruption, or after a gap in which the agent could not observe your rental (for example while the PC slept), marks the whole interval since the previous report as unavailable. A very short interruption that is over before the next report may not be noticed. If you think an interruption was missed, open a dispute (section 12).

Save checkpoints and results often, and do not use a Windows host for work that needs strong isolation or for highly sensitive data.

18. Contact

Email: hello@nalvo.ai. Mamhol operates Nalvo.ai.