Privacy policy | SoloRack

1. Who is responsible

The controller of your personal data is SoloRack.

For any privacy question or request, write to team@solorack.com.

We have not appointed a data protection officer.

2. The short version

Without your consent, this website runs no statistics. It sets one cookie of its own, only when you sign in to My account, to keep you signed in. The support chat loads only when you open it, and then sets its own cookies, which keep your conversation going across visits. Until you choose, the only third-party script that loads by itself is Cloudflare’s bot check on the sign-in form and on the waitlist form, which appears while orders are closed, when every Mac is rented and on the GPU slices page. Fonts are served from our own domain.
Usage statistics run only if you accept them in the banner (section 3.10), and never in My account. If you reject them, we only count your visit, without cookies. The support chat is on every page, and nothing from Crisp loads until you open it.
We collect only what we need to rent you a Mac or run your GPU slice, take payment, support you and meet our legal duties.
We do not sell your data, show ads or build profiles.
Card details go to Stripe, never to us.
We do not look at the files on your rented Mac or your GPU slice, except in the cases in section 3.6.
When a rental ends, we delete your account and all your files from the Mac, usually within minutes. We keep no copy and cannot get them back, so download what you need first.
When a GPU slice is deleted, everything on it goes, with no copy (section 3.7).

3. What we collect, why, and on what legal basis

3.1 Visiting this website

What: your IP address, the date and time, the page requested, your browser’s user agent and the page you came from. Cloudflare, our hosting provider, processes this to deliver the site.
Why: to deliver the website and protect it from attacks and misuse.
Legal basis: our legitimate interest in running a secure website (GDPR Art. 6(1)(f)).
How long: Cloudflare keeps these logs for a short time under its own rules. We do not use them to build statistics about you.

3.2 Buying a rental

What: your name, email address, billing address and country; your company name and VAT number if you are a business; what you bought, when and for how much; your choices at checkout, such as accepting the terms and asking for an immediate start; and the location evidence needed for VAT, such as your billing country and the country of your IP address. Stripe keeps your card details. We see only the card brand, the last four digits and the expiry date. We give you a customer code, such as c-0001, and keep it with your Stripe customer ID in our rental records; your name, email address and billing details stay with Stripe. We record each payment page we create for you, with these codes, so that every payment reaches the right Mac. We also save in Stripe the language of the website you bought on, so that our emails use it. Top-ups of credit for GPU slices work the same way, and each one also goes into your credit ledger (section 3.4).
Why: to make and carry out the contract, take payment, issue invoices, apply the right VAT, keep proof of your choices at checkout, and prevent fraud.
Legal basis: the contract (Art. 6(1)(b)); our legal duties under tax and accounting law (Art. 6(1)(c)); our legitimate interest in preventing fraud and defending legal claims (Art. 6(1)(f)).
How long: invoices and accounting records for as long as tax law requires. Other order data until the contract ends, plus the time needed to defend legal claims. Your customer code and Stripe customer ID are kept as long as the billing records, and the record of a payment page for 90 days after it closes.

3.3 Emails with us

What: your email address and name, the content of your messages and any attachments. We also send you service emails, in the language you use on our website: sign-in links to My account, the email that your Mac is ready, reminders before renewals and end dates, payment problems, the end-of-rental notice and the receipt of an online withdrawal. Our emails about GPU slices (low credit, credit at zero and slice deleted) are always in English. Our emails never contain passwords.
Why: to answer your questions, give support and run your rental or GPU slice.
Legal basis: the contract or the steps before it (Art. 6(1)(b)); for general questions, our legitimate interest in answering them (Art. 6(1)(f)).
How long: up to 2 years after our last exchange, unless we need a message for longer for a legal claim or for tax records.

We do not send newsletters or marketing emails.

3.4 Access to your Mac and rental records

What: the macOS username and password, remote-desktop details and SSH details we create for you, which we keep encrypted so that My account can show them to you; the SSH public key you add in My account; which Mac you rent; the start and end time of each rental; for a plan, the code and renewal status of your Stripe subscription (active, renewal failed, cancellation date and current period); and the technical status of the Mac, checked automatically every minute. The status includes: whether the Mac is on, when it last restarted and when macOS was last set up; its macOS version and any pending macOS updates; free disk space and free memory; processor load, temperature level and estimated power use; whether remote access is set up and running (the remote-desktop app is running, and SSH accepts only keys and only the accounts we expect); whether Activation Lock, FileVault, a firewall that blocks all connections or Wi-Fi is on; which customer account is on the Mac, whether it signs in automatically and whether any other user account exists; whether the Mac’s internet traffic leaves from the network address we expect (we keep only the yes or no, never the address); and whether a remote session is open and for how long the keyboard and mouse have been idle. We never record what you do on the Mac: no screens, app or window names, files, websites or keys pressed.
Why: to give you access, keep the Mac reachable and manageable, follow Apple’s licence, which requires every rental to last at least 24 consecutive hours, and calculate refunds. The status also lets us see how many hours each Mac is in use, estimate its electricity cost, and get a warning when someone is connected to a Mac that has no rental or when the account on a Mac does not match its rental.
Legal basis: the contract (Art. 6(1)(b)), and our legitimate interest in keeping the Mac secure and complying with Apple’s licence (Art. 6(1)(f)).
How long: access details until your rental ends: we delete them when we lock your access. If you change your macOS password on the Mac, we no longer know it. An SSH public key you add is kept with the record of your request for 90 days. Rental start and end times and the code of your Stripe subscription are kept with the billing records; of its renewal status we keep only the latest one we read. The technical status is kept for 30 days.

For a GPU slice, this is the list instead:

What: the size of the slice, when it was created and when it ended; the public SSH key you give when you create it; and your credit ledger: each top-up, each amount used, each refund and each correction, with its date. Every minute, our system reads from outside the slice the technical status of the machine the slices run on and a few figures for each slice. For the machine: when it last started; processor load and memory in use; free disk space; processor and GPU temperature; GPU load and GPU memory in use; estimated power use; total network traffic; and whether its connection to our server works. For each slice: whether it exists and is running; how much processor, memory, GPU memory and disk it is using; its total network traffic; and, after a deletion, that the deletion has finished. From these figures we keep, for each slice, the minutes running, the minutes stopped, the credit used and the total traffic. These are amounts only. We never record what you do on a slice: no files or file names, screens, websites or destinations of your connections, and no programs, except the name of a program stopped for using too much memory, which the system log of the machine can hold (section 3.7). We keep no record of your connections. If we receive an abuse report about traffic that is still going on, we look at the connections open at that moment on the machine, to find the slice they come from.
Why: to give you access, count your minutes and take them from your credit, stop a slice when your credit runs out, keep the machine safe and within its limits, and see how much slices are used and what they cost us in electricity and traffic.
Legal basis: the contract (Art. 6(1)(b)); our legal duties under tax and accounting law for the credit ledger (Art. 6(1)(c)); our legitimate interest in keeping the machine secure and dealing with abuse (Art. 6(1)(f)).
How long: the public SSH key until the slice is deleted. The technical status of the machine and the figures for each slice are kept for 30 days, as for the Macs. The dates and totals of each slice and the credit ledger are kept with the billing records.

3.5 Remote-desktop connections

When you use the remote-desktop app, its provider processes connection data, such as IP addresses, device IDs and session times. It may relay the screen image through its own servers, which can be outside the EU (section 5).
SSH connections go straight to the Mac. When we use macOS Screen Sharing for maintenance, that connection also goes straight to the Mac.
SSH connections to a GPU slice, and its internet traffic, pass through our own server.
Legal basis: the contract (Art. 6(1)(b)).

3.6 Your files on the rented Mac

What: whatever you store on the Mac. It may include personal data, for example in your code, test data or signing certificates.
Why: only to provide the service. We do not open your files or watch your screen, except when you ask us for help, or to deal with serious abuse or a legal obligation as our Acceptable use policy explains.
Legal basis: the contract (Art. 6(1)(b)).
Business customers: when your files contain personal data your company is responsible for, we process that data on your behalf, as a processor. A data processing agreement (GDPR Art. 28) is available on request.
GPU slices: this section also applies to what you store on a slice.

3.7 Deletion at the end of a rental

What: your macOS account on the Mac and all the files in your user folder. We make no backup and keep no copy of them.
Why: so that your files do not outlast your rental, and so that the next customer gets a clean Mac.
Legal basis: the contract (Art. 6(1)(b)).
How long: we delete them, usually within minutes of the end of the rental, and we cannot get them back after that, so download what you need before the end. Anything you stored elsewhere on the Mac goes when we erase the whole Mac, before anyone else uses it. If the Mac is off or we cannot reach it, the deletion happens as soon as we can. If Activation Lock is on, your account and files stay on the Mac until that is solved, and we then delete them.
What we keep: none of your files. We keep records: invoices, payments and rental dates, for accounting and as proof of the 24-hour minimum rental, and the other records in section 6, each for the time stated there.
GPU slices: everything on a slice is deleted when you delete it, when your credit has stayed at zero for 24 hours, or when we close it (section 22 of the Terms of service). We make no backup and keep no copy, and its files can no longer be found on the machine, even by reading the disk directly. We keep the records in section 3.4, and a few technical lines about the slice stay in the system log of the machine, which can include the name of a program stopped for using too much memory.

3.8 The waitlist (while orders are closed, when every Mac is rented, and on the GPU slices page)

What: the email address you enter, the language of the page and the time you signed up. To check that you are a person and not a bot, Cloudflare Turnstile reads technical signals from your browser, such as your IP address and browser characteristics. Turnstile tells us only whether the check passed.
Why: to send you one email when orders open or, if you signed up when every Mac was rented, when a Mac is free, or, if you signed up on the GPU slices page, when slices open. The bot check protects the form from spam and abuse.
Legal basis: your consent for the email (Art. 6(1)(a)). You can withdraw it at any time by writing to team@solorack.com, and we delete your address. Our legitimate interest in protecting the form from bots for the bot check (Art. 6(1)(f)).
How long: until we send you that email, then we delete your address. If we have not sent it after 12 months, the address is deleted automatically.

3.9 My account

What: the email address you enter to sign in; your customer code, which the sign-in link we email you and the cookie that keeps you signed in contain (see our Cookie policy); and what you ask for in My account, such as a restart, a new password, an SSH key or a withdrawal, with when it happened and how it went. To keep bots out, Cloudflare Turnstile checks the sign-in form, as on the waitlist form (section 3.8). To limit abuse, we count requests for each email address, each IP address, each Mac and each GPU slice.
Why: to let you, and only you, see and manage your rentals and GPU slices, and to protect My account from bots and abuse.
Legal basis: the contract (Art. 6(1)(b)), and our legitimate interest in protecting My account from abuse (Art. 6(1)(f)).
How long: we look up the email address you enter in Stripe and send the sign-in link to it; apart from the request counter, we do not keep it. A sign-in link works once, for 15 minutes; to make sure of that, we keep a random number from it for up to 15 minutes. The cookie lasts 30 days, or until you sign out. Request counters are deleted after one hour. The record of what you asked for is kept for 90 days, and a withdrawal as long as the billing records.

3.10 Usage statistics (only if you accept) and the support chat

What: for statistics, the pages you visit, the page you came from, the links and buttons you click, your browser, device and screen type, your approximate location worked out from your IP address, and a random identifier stored in your browser. With PostHog this includes session recordings: a replay of your visit, with the pages you open, your scrolling and your clicks. What you type is hidden in your browser before anything is sent, and the chat is left out. For the chat, what you write to us, any name or email address you give, your browser and your approximate location.
Why: to understand how the site is used and improve it, and to answer you in the chat.
Legal basis: for statistics, your consent (Art. 6(1)(a)), given in the banner. You can withdraw it at any time with Cookie settings, at the bottom of any page except My account. Withdrawing does not affect what happened before. For the chat, our legitimate interest in being reachable and in answering you (Art. 6(1)(f)). What you write in the chat is handled like an email to us (section 3.3).
How long: statistics for up to 14 months in Google Analytics and 1 year in PostHog, and session recordings for 30 days. Chat conversations for up to 2 years after our last exchange.

If you reject statistics, PostHog counts the pages you open, with your browser and device type, without cookies and without storing anything in your browser. Nothing records your visit or your clicks. To avoid counting you twice on the same day, PostHog works out a code from your IP address and browser details with a value that changes every day, then discards the IP address. Our legal basis is our legitimate interest in knowing how many people visit the site (Art. 6(1)(f)). These counts are kept for 1 year.

Statistics never run in My account. The chat opens in a frame from Crisp’s own website, only when you click it, and that frame cannot read the page. See our Cookie policy.

4. Who receives your data

We share personal data only with the providers below, who process it for us under contract, and with authorities or professional advisers when the law requires it.

Stripe (Stripe Payments Europe, Limited, Ireland): payments, receipts, invoices, VAT and the customer portal. Sales go through Stripe’s Managed Payments, so Link, Stripe’s service, appears as the seller at checkout and on your receipts. Stripe also processes some data as an independent controller for its own purposes, such as fraud prevention and legal compliance. See Stripe’s privacy policy.
Cloudflare (Cloudflare, Inc., USA): website hosting, DNS, protection against attacks, the bot check on the sign-in and waitlist forms (Turnstile, see Cloudflare’s Turnstile privacy addendum), storage of waitlist addresses, the random numbers of sign-in links and request counters and, in the EU, of the technical status of the Macs, the rental start and end times, the code and renewal status of Stripe subscriptions, customer codes and Stripe customer IDs, your encrypted access details, the technical status of the machine that runs GPU slices, the records of GPU slices with their SSH keys, the credit ledger, and the records of payment pages and of what you ask for in My account.
Resend (USA, sending from its EU region): sending our service emails, such as sign-in links, the emails about your rental, receipts and the waitlist email. It receives your email address and the content of those emails. See Resend’s privacy policy.
PostHog (PostHog, Inc., USA, with data stored in the EU): usage statistics if you accept them, and the count of your visit if you reject them. See PostHog’s privacy policy.
Google (Google Ireland Limited, Ireland), only if you accept statistics: usage statistics with Google Analytics. See Google’s privacy policy.
Crisp (Crisp IM SAS, France): the support chat, when you open it. See Crisp’s privacy policy.
Our email provider: our support mailbox.
Our remote-desktop provider: the app you use to connect to your Mac.

We do not send your data to Apple. When you sign in to your Apple Account on the Mac, Apple processes your data under its own privacy policy.

5. Transfers outside the EU

Stripe and Cloudflare may process data in the USA. They rely on the EU-US Data Privacy Framework and on the European Commission’s standard contractual clauses.
Remote-desktop provider: it may relay connection and screen data through servers outside the EU.
Resend is based in the USA.
PostHog stores statistics in the EU, but it is a US company and may reach them from the USA. Google may process data in the USA.

You can ask us for a copy of the safeguards we rely on.

6. How long we keep data

Website logs: a short time, at Cloudflare.
Invoices, payment and accounting records: as long as tax law requires.
Rental start and end times, the Stripe subscription code, customer codes, Stripe customer IDs, withdrawals, the credit ledger, and the dates and totals of each GPU slice: as long as the billing records.
Support emails: up to 2 years after our last exchange.
Access details: encrypted, until your rental ends.
Records of payment pages and of what you ask for in My account, including an SSH public key you add: 90 days after they close.
The SSH public key of a GPU slice: until the slice is deleted.
Sign-in links: 15 minutes. Request counters: one hour. The cookie that keeps you signed in: 30 days, or until you sign out.
Technical status of the Macs and of the machine that runs GPU slices, with the figures for each slice: 30 days.
Your macOS account and files on the Mac: deleted, usually within minutes of the end of your rental, with no copy kept (section 3.7).
What is on a GPU slice: deleted with the slice, with no copy kept (section 3.7).
The few technical lines about a slice in the system log of the machine: until the log replaces them.
Waitlist addresses: until we email you that orders are open, that a Mac is free or that slices are open, and at most 12 months.
Usage statistics, only if you accept them: up to 14 months in Google Analytics, 1 year in PostHog. Session recordings: 30 days.
Counts of visits from people who reject statistics: 1 year in PostHog.
Support chat: up to 2 years after our last exchange.

7. Your rights

Under the GDPR you have the right to:

access your data and get a copy of it;
have wrong data corrected;
have your data deleted;
restrict how we process it;
receive the data you gave us in a portable format;
object to processing based on our legitimate interests.

Your files on the Mac are deleted when your rental ends, and those on a GPU slice when it is deleted (section 3.7), so after that we have no copy of them to give you.

Where we rely on your consent (the waitlist and statistics), you can withdraw it at any time, as sections 3.8 and 3.10 explain. This does not affect what happened before.

To use your rights, write to team@solorack.com. We answer within one month. We may ask you to confirm who you are, for example by writing from the email address you used at checkout.

You can also complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you think the breach happened.

8. Do you have to give us your data?

You don’t need to give us any data to read this website. To join the waitlist, we need your email address. To rent a Mac or top up credit, we need your email address, payment details and billing details. Without them we cannot make the contract. Tax law requires some of these details on invoices.

9. No profiling

We do not use automated decision-making or profiling.
Stripe runs automated fraud checks on payments under its own responsibility. If a payment is blocked, you can contact us.
Without your consent, this website runs no statistics: its one cookie keeps you signed in to My account, and the support chat sets its own cookies only if you open it. Usage statistics show us how the site is used as a whole; we do not use them to make decisions about you. The bot check on the sign-in and waitlist forms decides only whether a request is accepted, not anything about you as a customer. See our Cookie policy.

10. Security

We make no backups or copies of your files, and we delete them when your rental ends or your GPU slice is deleted (section 3.7).
We keep the access details our system creates encrypted, show them only in My account after you sign in with a link sent to your email address, and delete them when your rental ends. Our emails never contain passwords: if we set up a Mac for you by hand, we send its access details only to the email address you used at checkout, through a secret link that stops working after a few openings or days.
Only the team can use the maintenance account on your Mac.
Card data never reaches our systems.

11. Changes to this policy

If we change this policy, we publish the new version here. If a change affects customers with a running rental or a GPU slice, we tell them by email.