Privacy Notice

How Pyrois handles personal data, under the Swiss Federal Act on Data Protection (FADP, revised 2023) and, where it applies to you, the EU General Data Protection Regulation (GDPR).

Last updated: 19 September 2026

This notice is a working draft and has not been reviewed by a lawyer. Every value written as […] is a fact only Pyrois can supply. It must be completed and reviewed before the platform opens beyond its private beta.

1. Who is responsible

The controller for the processing described here is:

[LEGAL ENTITY NAME], [street address], [postcode] Zürich, Switzerland Commercial register no. [CHE-XXX.XXX.XXX] Email: [[email protected]]

If you are in the EU/EEA and we are required to name a representative under Art. 27 GDPR, that is: [EU REPRESENTATIVE, or "not applicable"].

2. What we collect, and why

We collect only what a given interaction needs. Nothing here is sold, and none of it is used for advertising or profiling.

If you contact us

The forms at /contact and /beta collect your name, email address, company name and message. We use them to answer you and to assess beta access. Legal basis: our legitimate interest in responding to an enquiry you initiated (Art. 6(1)(f) GDPR); under the FADP, processing of data you volunteered for that purpose.

If you create a provider account

To onboard compute capacity we collect company legal details (legal name, entity type, registered address, tax/VAT number, website), facility and hardware information, contact details for the people you nominate, and bank details for payouts (account holder, IBAN/SWIFT, or US routing and account numbers). Legal basis: performance of a contract (Art. 6(1)(b) GDPR), and compliance with our own accounting and anti-money-laundering obligations (Art. 6(1)(c)).

Vendor API credentials you provide are encrypted before storage and are never readable by this website after you save them. They are decrypted only by the provisioning service that needs them.

If you create a consumer account

We collect the identity details from your sign-in (email address, name if supplied) and records of the workloads you deploy: configuration, timing and resource usage. Legal basis: performance of a contract.

Automatically, when you use the site

  • Server and security logs, including IP address, retained to operate and defend the service. Legal basis: legitimate interest in security.
  • Error reports when something breaks, which may incidentally include the URL you were on and technical context. When an error occurs, the report can include a short replay of the session leading up to it, with all text and form input masked.
  • Aggregate traffic measurement (Cloudflare Web Analytics), which sets no cookies and does not build a profile of you across sites.

Cookies and similar storage

We sort what we store in your browser into two categories. You choose in the banner shown on your first visit, and you can change your mind at any time through Cookie settings in the footer of every page.

Necessary: always on. Keeping you signed in (portal accounts only), protecting the site, error reports, and remembering your choices, including your answer to the cookie banner. The site does not work without these, so they cannot be switched off. Under Art. 45c of the Swiss Telecommunications Act we inform you of them; you can block or delete this storage in your browser, though signing in will then not work.

Analytics: only with your consent. If you switch this on:

  • Google Analytics 4, loaded through Cloudflare Zaraz, measures website traffic for our marketing, so we can improve the site: which public pages you read and whether a contact or beta form was sent. It sets first-party cookies (cf_zaraz_client, google-analytics_v4_*) that last up to one year. It never runs in the signed-in portals.
  • Sentry Session Replay records one visit in ten, with all text and form input masked, so we can find and fix bugs.

Legal basis: your consent (Art. 6(1)(a) GDPR; under the FADP, your consent). Nothing in this category loads until you say yes. If you withdraw, we delete these cookies from your browser and stop sending anything further.

Browser privacy signals. If your browser sends Global Privacy Control or Do Not Track, we treat it as a refusal: analytics stays off and we do not show the banner. You can still switch analytics on through Cookie settings.

We do not use advertising or cross-site tracking cookies.

3. Who else processes it

We use a small number of providers, each under a data-processing agreement, each acting only on our instructions:

  • Zitadel: sign-in and account identity. Processed in [REGION: confirm your instance].
  • Cloudflare: network delivery, DDoS protection and traffic measurement. Global edge network.
  • Sentry: error monitoring, and session replay where you consented to analytics. Processed in Germany (EU).
  • Google (Google Analytics 4, via Cloudflare Zaraz): usage analytics, only with your consent. Processed in the United States.
  • OVHcloud: encrypted backups. Processed in France (EU).

Compute workloads run on provider infrastructure you or our matchmaker select, in the region recorded on the workload. Those providers process workload content, not your account data.

We do not disclose personal data to anyone else except where the law requires it, or to enforce our terms.

4. Transfers outside Switzerland

Some processors above are in the EU/EEA, which the Swiss Federal Council recognises as providing adequate protection. Analytics data reaches Google in the United States; for that transfer we rely on Google's certification under the Swiss-U.S. and EU-U.S. Data Privacy Framework [confirm current certification status]. Where data reaches any other country without recognised adequacy, we rely on Standard Contractual Clauses with the Swiss addendum, together with technical measures, principally encryption in transit and at rest.

You may request a copy of the safeguards in place by writing to the address in section 1.

5. How long we keep it

  • Enquiries from the contact and beta forms: [PERIOD: decide].
  • Provider and consumer account records: for the life of the account, then [PERIOD] for accounting and legal obligations.
  • Payout and billing records: [PERIOD]. Swiss commercial-law retention is generally ten years; confirm.
  • Server and security logs: [PERIOD].
  • Analytics data in Google Analytics: [PERIOD: the GA4 data-retention setting, 2 or 14 months]. The cookies themselves last up to one year, or until you withdraw consent.
  • Your cookie choice: in your own browser, until you change it or clear it.
  • Encrypted backups: currently retained without a fixed expiry; a defined limit is being introduced.

6. Your rights

Under the FADP and, where it applies, the GDPR, you may:

  • Access the personal data we hold about you, and receive a copy
  • Correct anything inaccurate
  • Delete your data, where we are not required to keep it
  • Object to processing based on legitimate interest
  • Receive your data in a machine-readable format, or have it sent to another controller
  • Withdraw consent at any time, where processing rests on consent, without affecting what was lawful beforehand

Write to the address in section 1. We answer within 30 days. Requests are free unless they are manifestly unfounded or excessive.

We do not make decisions producing legal effects about you by automated means alone. Workload placement is automated, but it decides where a machine runs, not anything about you as a person.

If you believe we are handling your data unlawfully, you may complain to the Federal Data Protection and Information Commissioner (FDPIC) in Bern, or, in the EU/EEA, to your national supervisory authority.

7. Security

We hold personal data under access control, encrypt it in transit, encrypt credentials and secrets at rest in a dedicated secrets manager, and keep encrypted off-site backups. No system is perfectly secure, but where a breach is likely to result in a high risk to you, we will notify the FDPIC and, where required, you.

8. Changes

We will update this notice as the platform changes, and revise the date at the top. Where a change materially affects you, we will tell you directly.