## 1. Who we are and how to contact us

**Version 1.1.0 · 26 October 2026.** FOREHEED SRL operates ComputeCubed and is the controller for the account, marketplace, payment-record, security and support processing described here. Registration: **J16 /1871 /2016**; VAT: **RO36613367**. Registered office: **Str. Mihail Strajan, nr. 1, bl. a3, sc. 3, et. 4, ap. 14, 200010 Craiova, Dolj, Romania**.

Contact [privacy@foreheed.com](mailto:privacy@foreheed.com) for privacy requests, [contact@foreheed.com](mailto:contact@foreheed.com) for support, and [security@foreheed.com](mailto:security@foreheed.com) for security reports. You may also write to our registered office. Privacy requests are not consent to marketing.

## 2. Information we process

- **Accounts and beta applications:** identity-provider subject and issuer, email, display name, authentication and approval status, application answers, and related communications. Both consumers and businesses may apply; beta access requires manual approval.
- **Marketplace activity:** provider and renter identifiers, clusters and node inventories, hardware specifications, benchmarks, listings, selected capacity, rental history, connectivity and operational status, reviews and replies.
- **Payments and agreements:** wallet and ledger entries, amounts and currencies, Stripe customer/payment/transfer/account references, transaction status, receipts and limited card brand/last-four details when supplied, payout statements, and Terms version/hash and acceptance evidence. Stripe handles card entry and identity/bank onboarding; do not send us full card numbers or verification documents through support.
- **Technical and security records:** IP addresses, timestamps, device/browser user-agent data, request and task references, security events, application and cluster logs, and support reports. Terms acceptance records include the accepted document identity, server time, identity context and connection information.
- **Workload data:** code, files and other content that you place on rented resources. Providers may retain physical or privileged control of their hardware. Private connectivity and containers do not make the Provider unable to access a machine. Avoid uploading information whose processing you have not assessed or are not authorized to undertake.

We receive information from you, your identity/payment providers, hardware agents and the Service, and from providers, renters or reporters where relevant to a transaction or incident.

## 3. Purposes and legal bases

We use account, allocation and transaction information to take steps at your request and perform the service contract. We process billing, accounting and legally required records to comply with legal obligations. Security, fraud prevention, abuse handling, reliable operation and defending legal claims are based on our legitimate interests and those of affected users, subject to your rights and a balancing of interests. We use consent where a feature or law requires it; you can withdraw that consent without affecting earlier lawful processing. We do not treat accepting the Terms as consent to every use of personal data.

Some information is necessary to authenticate, approve an account, allocate resources, record charges or satisfy payment-provider requirements. Without it, we may be unable to provide the corresponding feature. Beta applications and serious account restrictions can be reviewed by a person; contact us to request review. Automated resource scheduling, metering and fraud signals assist operation; contact us to challenge an error or explain your circumstances.

## 4. Who receives information

Foreheed personnel and authorized service operators receive information needed for their duties. Identity, email, hosting, storage, network, monitoring, payment and support suppliers process relevant information to provide their services. Stripe processes payments and Connect onboarding under its applicable role and [privacy notice](https://stripe.com/privacy). Provider and renter counterparties receive the information necessary to supply and manage a rental; public listings and reviews are visible to their audience. Providers can have privileged access to their own hardware, as explained above.

We may disclose relevant information to professional advisers, insurers, payment partners, authorities or affected parties where necessary and lawful for compliance, a dispute, fraud, safety or security. We do not promise disclosure merely because someone asks. We do not sell account or workload data for advertising.

## 5. Locations and transfers

The Service uses Foreheed-operated infrastructure in Romania and independent provider hardware. A listing's available location information and your Provider selection matter to where workload data is processed; do not assume every rental stays in Romania or the EEA. Identity, payment, email and other suppliers may process data internationally. Where GDPR transfer rules apply, we use the relevant lawful mechanism, such as an adequacy decision or appropriate contractual safeguards, and assess the applicable requirements. Contact privacy@foreheed.com for information about relevant recipients, locations and safeguards for your use case before placing regulated or location-restricted information on the Service. This notice is not a promise that every provider or supplier meets a particular data-residency requirement.

## 6. Retention and deletion

We retain account and marketplace records while needed to operate the account, record transactions and resolve disputes, and longer only where a legal duty, security investigation or legal claim requires it. Closing an account or deleting a listing does not immediately erase financial, agreement or security evidence. Contact us for an assessment of the records relevant to your request.

Production backend and cluster logs have a **400-day retention policy**; unidentified streams use the same policy. Application issue-report records have a separate **90-day default**. Diagnostic material should be sanitized and credentials omitted. Backups are retained separately for recovery and expire under their backup schedules; an erased record can remain in a protected recovery copy until that copy expires. We restrict use of retained copies and reapply applicable deletion requests after recovery. Legal preservation can require longer retention of particular records. These periods do not promise recovery or 400 days of historical data for a newly created account.

Rental storage is temporary and may become inaccessible or be deleted when a rental ends, fails or is terminated. Keep your own copies. Foreheed cannot guarantee removal of copies independently held by a Provider or another recipient; we handle our duties and applicable requests with those recipients as required by law.

## 7. Browser storage and communications

The website and Console use browser storage or cookies needed for authentication, session security, preferences such as theme, and requested product features. These do not create consent to advertising.

With your consent, our production public website uses **Google Analytics 4**, provided by Google, to measure page visits, traffic sources, approximate location and device/browser information so we can understand and improve the website. The Google tag is not loaded and Analytics measurements, including cookieless measurements, are not sent before you accept analytics. Analytics does not run in the Console or on our development hosts. Rejecting optional cookies does not affect access to the website or Service. Our legal basis for this optional processing is your consent.

We disable Google Signals and advertising personalization features. We send public page addresses without query strings or fragments, fixed public page titles, and referrer origins rather than complete referrer addresses. We do not send account, rental, payment, form or workload contents to Analytics. Google receives technical connection information when your browser contacts its service. Google may process information internationally; see [how Google uses information from sites that use its services](https://policies.google.com/technologies/partner-sites) and the transfer information in section 5. Analytics data retention is configured separately in the Google Analytics property; browser cookie expiry does not set that retention.

| Storage | Purpose | Duration |
| --- | --- | --- |
| `computecubed-consent-v1` (local storage) | Remembers acceptance or rejection of analytics in this browser; it is not an Analytics identifier. | 180 days |
| `_ga` and `_ga_*` (first-party cookies) | Recognize browsers and maintain Google Analytics session information, only after analytics consent. | Configured for up to 180 days without renewing expiry on each visit. |

Use **Cookie settings**, available on every public page, to accept, reject or change your choice. You can also [open cookie settings here](/privacy#settings). Withdrawal stops Analytics collection, removes accessible Analytics cookies and reloads the page to unload the Google tag. Changes apply to this browser; clearing storage or using another browser may require a new choice. Withdrawing consent does not affect earlier lawful processing.

Service, security, beta-approval and transaction messages relate to providing or protecting the Service; any optional marketing subscription is separate and can be withdrawn.

## 8. Your rights and complaints

Subject to applicable conditions and exceptions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent for processing that relies on consent and request human review where applicable. We may ask for proportionate verification of identity and must protect other people's rights. We respond within the periods required by law; not every request requires deletion of legally retained transaction or security records.

Contact privacy@foreheed.com. You may also complain to Romania's [ANSPDCP](https://www.dataprotection.ro/?page=Plangeri_pagina_principala) or the competent supervisory authority where you live, work or consider an infringement occurred. You do not have to contact us before exercising that right.

## 9. Your responsibilities and changes

Do not send secrets, full payment details, or unnecessary personal data in reviews or support reports. If you process other people's data in a workload, you are responsible for the necessary lawful basis, notices, permissions and suitable arrangements with relevant Providers. Contact us before using the Service where a data-processing agreement or special safeguards are required; this notice alone is not such an agreement.

We publish a new version for material changes and provide additional notice where required. The version date identifies this notice; it does not retroactively authorize a new purpose or replace consent where consent is required. See the [Terms of Service](/terms) for the service agreement and contact details.