VastPilot
|

Privacy Policy

VastPilot (the "Service") is operated by Commodity Systems Inc. (the "Company"). The Company considers the protection of personal information an important responsibility and complies with the Act on the Protection of Personal Information and other related laws.


This Privacy Policy (the "Policy") explains the types of information collected by the Service, the purposes of its use, and how the information is protected.


This Policy applies to all users of the Service. By using the Service, you agree to this Policy.

1. Information We Collect

We collect the following information:

  • Account information: Email address, name, and organization name (for account authentication and communication)
  • Authentication data: Hashed passwords and session tokens
  • Vast.ai API keys: Encrypted at rest with AES-256-GCM and used solely for communicating with the Vast.ai API on your behalf
  • Machine and market data: GPU machine configurations, marketplace pricing data, and pricing recommendations collected via the Vast.ai API
  • Usage data: Log data, access timestamps, and feature usage for service improvement

    • 2. Purpose of Use

    We use your information for the following purposes:

  • Service delivery: Syncing machines, collecting market data, and generating pricing recommendations
  • Support: Responding to inquiries and providing technical support
  • Service improvement: Analyzing usage patterns to improve functionality
  • Notifications: Sending machine event notifications via Discord webhooks you configure
  • Statistics: Creating anonymized aggregate statistics
  • Legal compliance: Complying with applicable laws and regulations

    • 3. Information Sharing

    We may share your personal information with third parties only in the following cases:

  • With your consent
  • To service providers under confidentiality agreements as necessary for service delivery
  • Anonymized or aggregated data that cannot identify individuals
  • In connection with a business transfer by the Company
  • When required by law
  • When necessary to protect the life, body, or property of a user

    • Vast.ai API: Your API keys are transmitted to Vast.ai to perform operations on your behalf.

    Discord: Notification messages are sent to webhook URLs you configure.

    Cloudflare, Inc. (USA): Provides the service infrastructure (Workers, D1, KV, storage); data is processed and stored in the United States.

    Functional Software, Inc. (Sentry, USA): Receives exception and error events for error monitoring and incident detection.


    Cloudflare, Sentry, and Google (Analytics) are located in the United States, constituting provision of personal data to third parties in a foreign country. In accordance with Article 28 of the Act on the Protection of Personal Information, the Company confirms that these recipients maintain standards-compliant safeguards before providing data. Further details about the recipient country (USA) and its regime are available upon request.

    4. Security Measures

    We implement the following measures to protect your information:

  • Encryption: All communications are encrypted via SSL/TLS. Vast.ai API keys are encrypted at rest with AES-256-GCM. Passwords are hashed.
  • Access control: Access to personal information is limited to the minimum necessary personnel.
  • Multi-tenant isolation: All database queries are filtered by organization to prevent cross-tenant data access.
  • Regular security review: We conduct periodic vulnerability assessments and security audits.

    • 5. Cookies and Analytics Tools

    The Service uses cookies for the following purposes:

  • Session management (maintaining login state)
  • Authentication token storage
  • Language preference storage

    • You may disable cookies through your browser settings, but some features of the Service may not function properly.


    Google Analytics: The Service uses Google Analytics 4, an analytics service provided by Google LLC, to understand usage patterns and improve the Service. Google Analytics uses cookies to collect traffic data, but the information collected is anonymized and does not identify individuals. Collected data is managed in accordance with Google's privacy policy.

  • Google Analytics opt-out add-on: https://tools.google.com/dlpage/gaoptout
  • Google Privacy Policy: https://policies.google.com/privacy

    • 6. User Rights

    You have the following rights regarding your personal information:

  • Right of access: Request disclosure of your personal information held by us
  • Right to correction: Request correction of inaccurate or incomplete personal information
  • Right to deletion: Request deletion of your personal information by deleting your account
  • Data portability: Receive your data in a structured, machine-readable format

    • To exercise these rights, please contact us through the contact information at the end of this Policy.

    7. Data Retention

  • Account information: Deleted within 30 days after account deletion
  • Audit logs: Retained for up to 1 year for security audit purposes
  • Market data: Retained for service operation; anonymized data may be retained for statistical purposes

    • 8. Children's Privacy

    The Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that personal information has been collected from a child under 13, we will take steps to delete such information promptly.

    9. Changes to This Policy

    This Policy may be changed due to amendments in laws, changes to the Service, or other reasons. In the event of significant changes, we will notify users through notices on the Service or email to registered addresses. Continued use of the Service after changes constitutes acceptance of the revised Policy.

    10. Contact

    For inquiries regarding this Policy, please contact us using our contact form.

    Last updated: February 23, 2026