Privacy Policy

This Privacy Policy explains how GHIVETECHNOLOGIES (OPC) PRIVATE LIMITED (CIN U62099KA2026OPC228987) (“GHive”, “we”) collects, uses, shares and protects personal data when you use the Platform. It is designed to meet India’s Digital Personal Data Protection Act, 2023 (DPDP) and, for users in the EU/EEA/UK, the GDPR.

1. Who is the data controller

GHive is the controller for personal data processed about account holders. For data inside a Renter’s workloads/containers, the Renter is the controller and GHive/Hosts act as processors or merely provide infrastructure; enterprise customers can sign a DPA.

2. What we collect

• Account data: name, email, password (hashed), role (renter/host). If you sign in with Google or GitHub, we receive your name and email address from them; we do not receive your password.
• Host payout data: for Hosts, your name as per PAN, your PAN and your UPI ID, which we need to pay you and to meet tax obligations. We check that the same PAN or UPI ID is not already used by another GHive account, that the PAN is valid at the Income Tax Department in the name you gave, and that the UPI ID belongs to a bank account in that name; we keep the names those checks return.
• Payment data: we use Razorpay as our payment processor. Card/UPI/bank details are handled by Razorpay — GHive stores only transaction records (amount, status, order/payment IDs), not full card numbers.
• Technical data: IP address, device/browser information, cookies/session tokens. We keep the IP address your account was created from with your account.
• Usage & logs: rentals, instances, metering samples, wallet transactions, and security/audit events.
• Host telemetry: for Hosts, machine identifiers and hardware specs (GPU model, VRAM, utilisation, temperature) reported by the host software.
• Generation data: if you use the image and video service, your prompts, any picture you upload, and the images and videos generated for you, plus how long each took and which GPU made it.
• Moderation records: prompts our screening refuses, kept with the time and your account so we can enforce the Acceptable Use Policy and, where the law requires, report illegal requests.
• Survey answers: if you answer our optional GPU survey, your answers (such as your role, industry, workloads, GPU needs, budget band and anything you type in the free-text boxes). If you are signed in, they are linked to your account; if not, they are not linked to you unless you leave contact details. Only if you ask us to contact you and tick the consent box do we keep the name, email, and (optional) phone/WhatsApp number and best time to reach you that you give.

We do not intentionally access the contents of a Renter’s compute workloads.SSH sessions to a rental are end-to-end encrypted, and our relay cannot read them.Browser access to a rental (JupyterLab and web apps) currently travels over plain HTTP through our relay, protected by an access token but not encrypted in transit, so do not use it for sensitive data; use SSH instead.

To protect Hosts, the host software automatically checks the processes running in a rental for a fixed set of signs of cryptocurrency mining, or of the rental being resold through another compute marketplace’s host software. The check runs on the Host machine, and only the name of a matched sign is reported to us — never your commands or files.

3. Why we use it (purposes & legal bases)

• To provide our services, run rentals, meter usage and process payments — performance of a contract.
• To produce the images and videos you ask for — performance of a contract.
• To prevent fraud, abuse and illegal use, including screening prompts before they are run, checking that a signup comes from a person and a permanent email address, and finding accounts one person has made in breach of our Terms (for example, accounts created from the same IP address or sharing a PAN or UPI ID), and to secure the Platform — legitimate interests / legal obligation.
• To comply with tax, accounting and legal obligations — legal obligation.
• To communicate service and support messages — contract / legitimate interests.
• Marketing emails, if any, only with consent (where required), with opt-out.
• To plan GPU supply, features and pricing from survey answers, and to contact you about your GPU requirements only if you asked us to in the survey — consent. Survey answers are seen only by the GHive team, never by Hosts, and survey contact details are not used for marketing emails. You can withdraw this consent at any time (Section 8).

4. Who we share it with

• Payment processor — Razorpay, to take payments and (for Hosts) make payouts.
• Infrastructure — our cloud hosting provider (e.g. AWS) for the control plane, database and backups.
• Email — our email provider, to send account, verification and service messages.
• Sign-in providers — Google or GitHub, only if you choose to sign in with them.
• Identity verification — Cashfree Payments, for Hosts only: your PAN and name, to check them against Income Tax Department records, and your UPI ID, to get the account holder’s name from your bank.
• Signup check — Cloudflare (Turnstile), when you create an account with a password: it processes your IP address and browser signals to tell a person from an automated script.
• Hosts — receive what is needed to run a rental (the Renter’s SSH public key and the instance request). Hosts do not receive your payment details or your GHive account credentials. Be aware: your workload runs on a machine the Host physically controls, so a Host is technically able to reach data you place inside your instance. Hosts are contractually forbidden to (see the Host Agreement) and we act on reports, but we cannot make it impossible. Treat an instance like any machine you do not own: do not put secrets, personal data, or irreplaceable work on one you have not chosen to trust.
• Hosts, for image and video generation — to generate an image or video, your prompt and any picture you uploaded are sent to the Host machine that does the work, and the result comes back from it. Hosts never receive your name, email or payment details, and are contractually forbidden to read, copy or keep what passes through their machine (see the Host Agreement). The work does run on a computer the Host physically controls, so as with rentals, do not put personal or sensitive information in a prompt or picture.
• Authorities — where required by law, or to investigate fraud, abuse or safety. This includes reporting requests for sexual content involving minors.
• We do not sell personal data.

5. International transfers

Data may be processed in India and other countries where our providers operate. Where we transfer EU/UK personal data internationally, we rely on appropriate safeguards (e.g. Standard Contractual Clauses).

6. Retention

We keep personal data for as long as your account is active and as needed to provide the service, then for the period required by law (e.g. tax/accounting records are typically retained for several years). Security/audit logs are retained for a limited period for fraud prevention.

• Pictures you upload to generate from are deleted within six hours.
• Generated images and videos: we keep your most recent 9; older ones, and any you delete, are deleted permanently. The record of each purchase (including its prompt) is kept with your transaction history.
• Survey answers are kept for up to 24 months, then deleted. Survey contact details are deleted within 12 months, or sooner if you ask us to stop contacting you. Deleting your account deletes the survey answers linked to it.
• Refused prompts are kept as long as needed to enforce our policies and meet legal obligations, and longer where they are evidence of a crime.

7. Security

We use measures including hashed passwords, encrypted sessions (HTTPS), httpOnly cookies, rate limiting, per-agent token authentication, access controls and audit logging. No system is perfectly secure; you also play a part by keeping credentials and keys safe.

8. Your rights

Subject to applicable law (DPDP/GDPR), you may request to access, correct, update, or delete your personal data, object to or restrict certain processing, withdraw consent, and (GDPR) data portability. To exercise these, contact support@ghive.co.in. You may also lodge a complaint with your data protection authority.

9. Cookies

We use strictly necessary cookies for authentication and security (e.g. your session). We do not use them to track you across other sites. Any future analytics cookies will be subject to consent where required.

10. Children

The Platform is not directed to children under 18, and we do not knowingly collect their data.

11. Grievances & contact

Privacy queries: support@ghive.co.in. Grievance Officer (India, as required under DPDP/IT Rules): Chandrashekar Shetty, support@ghive.co.in, +91 95350 55183, #156, 2nd Main, 4th Cross, Bangarappa Nagar, RR Nagar, Rajarajeshwarinagar, Bangalore South, Bangalore 560098, Karnataka, India. We acknowledge a grievance within 24 hours and resolve it within 15 days, as the IT Rules require. A complaint about intimate or sexual images of a person shared without consent is acted on within 24 hours.

12. Changes

We may update this Policy; material changes will be notified in-product or by email.