Privacy Policy

Machine telemetry. Managed machines send periodic heartbeats containing operational data: hardware inventory (GPU/CPU/RAM), runtime status, model availability, utilization, latency, and approximate region derived from the connecting IP. We use this information to operate your machines and show their status in your account.

Account and transaction records. We retain the account, purchase, hosting, usage and payout records needed to provide the service and maintain financial evidence. If you pay using a public blockchain, the transaction and associated addresses are public and outside our control.

Site usage. When you visit b3iq.org we may process standard technical information (browser type, device, pages viewed) to operate and secure the site and understand aggregate usage.

We do not train on your prompts or completions, and we do not sell them. Inference requests are dispatched in memory to a serving machine and the payload is discarded when the request completes: we do not write request or response bodies to storage, and no human reviews them. Managed serving machines are contractually barred from retaining or reusing prompt or completion content.

Request metadata. We record per-request metadata to route requests, measure usage and prevent abuse: a request identifier, timestamp, model, serving machine, token counts, latency, and response status. This metadata contains no prompt or completion text. Signed usage receipts carry the same fields. Inference on your own machines is free and produces no per-request payout.

Features you explicitly opt into may store more, and say so where you turn them on. For example, playground conversations you save are stored so you can return to them, and are deleted when you delete the session. Encrypted private jobs are held as ciphertext we cannot decrypt and purged after about 30 days.

• Operate and improve the B3IQ site, customer accounts and managed machines.
• Show machine health, model availability and usage in your account.
• Maintain reliability, prevent abuse, and secure the service.
• Communicate with customers about their machines and services.

We use the cookies and local storage needed to run the site (for example, keeping you signed in and remembering UI preferences), and we use two analytics services to understand how people find and use b3iq.org: Google Analytics 4, provided by Google LLC, and PostHog, provided by PostHog Inc. Both set an identifier in your browser that distinguishes one visitor and session from another. Analytics requests to PostHog are served from b3iq.org rather than PostHog’s own domain, so you may see them as first-party requests.

Marketing attribution. When you arrive from an advertisement, an email, or another website, we record the campaign parameters in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), any advertising click identifier the link carries (for example gclid, fbclid, msclkid), any partner or referral code, the website that referred you, and the page you landed on. This is stored in your browser and kept until you clear your site data, so that a purchase weeks later can be attributed to the source that originally brought you here. If you create an account or place an order, it is attached to those records and retained for as long as they are.

When you sign in, we associate your analytics record with your B3IQ account identifier and email address, so we can understand how accounts move from a first visit through to a purchase. Before you sign in, the record is tied only to the browser identifier described above.

Some events are sent from our servers, not your browser: specifically confirmations of completed machine purchases and of new account creation. These are sent after the transaction has settled and include the order or account identifier, the amount and currency where applicable, and the attribution described above.

Advertising. We advertise through Google Ads, and the site carries Google’s conversion tag so we can tell which advertisements lead to a purchase or a scheduled call. We use it for measurement only: we do not enable advertising personalization, remarketing, or Google Signals, and we do not share analytics data for cross-context behavioral advertising. We do not sell personal information.

What we deliberately do not do. We do not use session recording or heatmaps: we do not record your screen, your keystrokes, or the contents of forms. We do not send the text you type into the “Book a call” form to our analytics providers: only the domain portion of your email address and the length of your message. The full details go to our calendar and email systems, as described below.

Your choices. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as an opt-out and collect no analytics. In the EEA, the UK, and Switzerland we run analytics without cookies or persistent browser storage unless you tell us otherwise. You can also opt out here, on any device, at any time:

Google also publishes a browser add-on that opts you out of Google Analytics across every site: tools.google.com/dlpage/gaoptout. Browser tracking protection and content blockers will also block both providers.

We share information with infrastructure providers that help us run the service (such as hosting and content delivery), with Google LLC (analytics and advertising measurement) and PostHog Inc. (product analytics) as described above, and as required by law.

Per-request routing logs are deleted automatically after 90 days. Per-request usage records contain no prompt or completion text; we keep them for your usage history, and they are not deleted on a schedule. Signed receipts are kept as settlement records. Aggregate counters computed from these records (request counts, tokens served, uptime) identify no individual request. Ordinary inference payloads are not retained. The explicitly enabled storage features described above have their own deletion windows.

Operational telemetry is retained for a rolling window sufficient to compute machine health and history. Financial records are retained as described under Your privacy rights below. Transactions written to a public blockchain cannot be deleted by us.

Analytics data is retained by Google for 14 months and by PostHog for 12 months. The marketing-attribution record described above lives in your browser until you clear your site data; a copy attached to an account or an order is retained for as long as that record is. A deletion request will also delete your PostHog profile and the attribution attached to your account.

You control your account and the workloads on your machines, subject to your purchase and hosting agreements. For requests about personal data we hold, contact us at contact@npclabs.org (see Contact below). Records previously published to public infrastructure cannot be withdrawn by us.

Depending on where you live you may have the right to access the personal data we hold about you, to receive it in a portable form, to correct it, to have it deleted, to restrict or object to how we use it, and to withdraw consent. We extend these to everyone who asks, rather than checking your jurisdiction first.

Access and portability are self-serve. If you have a B3IQ account, sign in and download a copy of your account data (profile, API key details, machines, your most recent 5,000 requests, orders, and support tickets) from your dashboard account settings. It arrives as a single machine-readable file.

For everything else, email contact@npclabs.org with the subject line PRIVACY. We will acknowledge within 5 business days and respond substantively within 30 days; if a request is complex we will tell you why we need longer before those 30 days are up. We will ask you to confirm control of the account or email address in question before we disclose or delete anything, and we will not ask for more identifying information than that requires. Exercising these rights costs nothing and we will not treat you differently for it.

Two honest limits on deletion. First, we are required to keep billing, receipt, and settlement records as financial evidence; on a deletion request we remove your personal data and purge stored content, but those financial records are retained in the minimum form that serves that purpose, and we will tell you so. Per-request usage records, which hold no prompt or completion text, are also kept after a deletion request. Second, records already published to public settlement infrastructure are permanent and outside our control; we cannot withdraw them.

If you are using B3IQ through your university, employer, or another organization, that organization decides what is collected and why. We will forward your request to them and help them answer it.

The service is not directed to children under 13, and we do not knowingly collect their personal information.

We may update this policy from time to time. Material changes will be reflected by the “last updated” date above, and continued use of the service constitutes acceptance of the revised policy.

The B3IQ site (b3iq.org) and services are operated by NPC Labs, Inc. Questions about this policy, or requests about personal data we hold, can be directed to the contact below.