- We do not store the content of your API requests nor do we use it to train models.
- We do log usage metadata (timestamp, token counts, request counts) to enforce rate limits, display your metrics, and protect the cluster.
- Model inference executes strictly in European Union data centers.
- We never sell your data. You can exercise your rights at compliance@wearevera.com.
Data Controller
NodeClub is a service operated by Vera & Company Technologies SLU, which acts as the Data Controller for your personal data.
What Data We Process
We only process data necessary to provide you with the service. Here are the categories and their origins:
| Category | Includes | Source |
|---|---|---|
| Contact | Email address and your name if provided. | You, when signing up or writing to us. |
| Account & Subscription | Plan, activation date, subscription status, and community votes. | Your platform usage. |
| Billing | Tax details and payment history. Card numbers are handled securely by our payment processor; we do not see or store them. | You and payment processor. |
| API Usage Metadata | Timestamps, request counts, tokens consumed, model used, and API key ID. Never the content. | Generated automatically upon API calls. |
| Technical Data | IP address, browser, device, and access logs. | Generated automatically when browsing. |
| Community | Your Discord handle and membership link if you join the server. | You, when joining. |
| Communications | Messages you send through the contact form or support. | You. |
The Content of Your Requests
Prompts sent to the API and responses generated by models are processed in volatile memory (RAM) only for the duration needed to stream the response. We do not store them, do not log them, and never use them to train or improve AI models.
We only retain the operational metadata described earlier (such as tokens processed) needed to enforce fair use limits and compute metrics on your dashboard.
You are responsible for the data sent in your requests. If you process third-party personal data, you must have a legal basis to do so.
Purposes and Legal Basis
| Purpose | Legal Basis |
|---|---|
| Managing the waitlist, sending access links, and activating 24h trials. | Consent, upon joining. |
| Providing the service: account, API key, usage dashboard, and GPU cluster. | Performance of membership contract. |
| Enforcing fair use limits and protecting the cluster against abuse. | Legitimate interest in ensuring reliable cluster operation for all members. |
| Collecting subscriptions and fulfilling fiscal/accounting obligations. | Contractual performance and legal obligation. |
| Handling your inquiries and providing support. | Contract performance or consent when writing to us. |
| Managing the private member Discord community. | Contract performance (membership perk). Joining is voluntary. |
| Notifying you of service updates, maintenance, or model additions. | Performance of contract. |
| Improving the website and service via aggregated technical telemetry. | Legitimate interest. |
We do not engage in automated profiling producing legal effects. Technical rate limits are applied identically and algorithmically to all members.
How Long We Keep Your Data
| Data | Retention period |
|---|---|
| Waitlist | Until you get access, unsubscribe, or after prolonged inactivity. |
| Account and subscription | For the duration of active membership and applicable statutory liability periods. |
| Billing records | Statutory tax and commercial periods (generally six years). |
| API usage metadata | 12 months for metrics and audit trails. |
| Technical access logs | Up to 90 days for network security. |
| Inquiries and support | Time needed to resolve your inquiry and subsequent statutory periods. |
| Content of prompt requests | Never retained. |
Who We Share Data With
We never sell your data or transfer it for commercial marketing. We only share data with:
- Service providers operating under GDPR Data Processing Agreements: EU hosting and GPU infrastructure, payment processing, and transactional email dispatch.
- Discord, if you choose to join the member community.
- Judicial authorities and public administrations when required by applicable law.
Where Your Data is Processed
Model inference and core cluster infrastructure reside exclusively in data centers within the European Union.
Where auxiliary vendors (e.g. payment processors or Discord) process data internationally, transfers are secured via European Commission Standard Contractual Clauses (SCCs) or adequacy decisions.
Your Rights
You may exercise your GDPR data protection rights at any time:
How to Exercise Them
Write to compliance@wearevera.com from the email associated with your account, stating the right you wish to exercise. We reply within one month as prescribed by law.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) or your local European supervisory authority.
Security
We employ state-of-the-art technical and organizational measures: end-to-end encryption in transit (HTTPS/TLS), least-privilege role separation, network isolation, and continuous cluster monitoring.
Your API key is personal and confidential: keep it secure and do not commit it to public repositories.
Minors
NodeClub is directed exclusively at individuals aged 18 and older. We do not knowingly collect personal data from minors.
Changes to this Policy
We may update this policy to reflect enhancements to our service or regulatory updates. We will always display the effective date and notify members via email of any material changes before they take effect.
Questions? Write to us at compliance@wearevera.com or visit the contact page.