Privacy Policy

Lilac provides software and remote operations for private GPU clusters. Depending on the deployment and enabled features, we process cluster inventory and configuration, hardware identifiers, health and performance metrics, events, diagnostic logs, access records, and usage and metering records. These records may contain personal information such as user identifiers, IP addresses, and information included in support requests.

We use this information to provision and validate nodes, manage access and node lifecycles, monitor service health, investigate incidents, support customers, and meter and bill for the Services. Access and operational responsibilities are defined for each engagement.

When Lilac processes personal information in customer-controlled workloads on a customer's behalf, we do so to provide, secure, and support the agreed Services, under the customer's instructions and applicable data processing agreement. The customer is responsible for its own applications, data collection, and privacy notices. Contact that customer to exercise rights concerning information it controls; Lilac assists as required by the applicable agreement and law.

We do not sell customer-provided data, files, software, or other content or use it to train models. Access to workload data is limited to what is needed to provide, secure, and support the agreed Services or comply with law. This policy update does not expand our rights to use previously collected information or reduce the protections that applied when it was collected.

• Service providers: See our subprocessor list below for the complete list of third parties that process data on our behalf.
• Identity providers: If you link your account to Google, we share data as needed to maintain that connection.
• Authorized customer and provider users: Your profile and relevant deployment or support records may be visible to authorized users of your organization and the customer or infrastructure provider responsible for the cluster, according to the deployment's access permissions and agreed responsibilities.
• Legal requirements: Law enforcement or government authorities when required by law.
• Business transfers: In connection with a merger, acquisition, or sale of assets.
• Professional advisors: Lawyers, auditors, and insurers as needed.

The following third-party service providers process personal data on our behalf:

• Access & update: Log into your account to review and update your information.
• Marketing opt-out: Unsubscribe from marketing emails using the link at the bottom of any email.
• Linked accounts: Manage connected services (Google) through your account settings.

Our Service may link to third-party websites. We are not responsible for their privacy practices.

We use technical, organizational, and physical safeguards to protect your information. However, no system is completely secure.

We retain your information according to this schedule:

• User account information: Duration of service plus 30 days after account closure.
• Transaction logs: 7 years, as required for financial compliance.
• API logs: 90 days.
• Deleted user data: 30 days soft-delete period, after which data is permanently removed.

Retention of cluster operational records depends on the type of record and the applicable service agreement. The specific periods above continue to apply to those categories. Data on customer-controlled infrastructure is handled under the agreed handover or decommissioning process; closing a Lilac account does not itself wipe a cluster.

We may retain certain information longer as required by law or for legitimate business purposes. Existing contractual deletion obligations and protections for previously collected information continue to apply.

We are headquartered in the United States. Your information may be transferred to and processed in the US or other countries.

The Service is not intended for anyone under 18. If you believe we have collected information from a child, please contact us.

We may update this policy from time to time. We'll notify you of material changes by updating the effective date at the top.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data, subject to legal retention requirements.
• Right to restrict processing: Request that we limit how we use your data in certain circumstances.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to processing of your personal data for direct marketing or based on legitimate interests.

To exercise any of these rights, email privacy@getlilac.com. We will respond to your request within 30 days.