1. Policy scope and data roles
This policy applies to the ArmMesh website, account and order processes, service management in the console, support requests submitted by email or through the console, and ArmMesh cloud Mac services on dedicated physical nodes. Data handling on independently operated third-party services is governed separately by their providers.
For account details, order records, transaction status, service delivery records, website access logs, and support content, ArmMesh determines the purposes and methods of processing to the extent needed to provide services, verify security, process billing, and meet legal obligations.
Customers determine the content, purpose, authorized users, and retention period for source code, project files, models, build artifacts, access keys, and business data stored on their dedicated physical machines. ArmMesh accesses this information only as necessary to provision a node, carry out support actions explicitly requested by the customer, respond to security incidents, or meet legal obligations.
2. Data we collect
Account and contact information may include email addresses, account identifiers, verification status, preferred contact language, and organization or project details customers choose to provide. You do not need an account to browse public pages.
Order and transaction records may include the selected model, region, rental term, storage or Thunderbolt 5 add-ons, amount charged in USD, payment method category, payment status, order number, billing records, and renewal activity. Payment providers handle payment credentials as part of their services. ArmMesh retains only the records needed for reconciliation, service delivery, and dispute handling.
Device and access logs may include access times, network addresses, browser and device types, login results, session identifiers, security events, console activity, and technical diagnostics needed to connect to a node. We use these records to detect unusual access, troubleshoot issues, and protect accounts.
Support content may include order numbers, node regions, macOS versions, when an issue occurred, steps to reproduce it, its impact, and redacted logs or attachments customers choose to provide. Do not include unrelated keys, full credentials, unredacted project files, or other sensitive information in support requests.
3. How we use data
We use necessary data to create and verify accounts, confirm orders and payment status, assign dedicated physical nodes, provide connection details, process renewals or expirations, and show customers their service and billing records.
To protect accounts and nodes, we process login results, session records, and necessary access logs for authentication, anomaly detection, permission checks, abuse prevention, and security investigations. Security checks do not change the customer's responsibility for managing project data on their node.
When customers request technical support, we use order, region, system version, time frame, reproduction steps, and redacted diagnostic materials to troubleshoot connection, build, storage, or inference issues. Support staff access relevant information only as needed to resolve the specific request.
We also use aggregated or de-identified information to assess page availability, service delivery, issue types, and product needs. This analysis helps us improve our services and is not used to infer business information unrelated to service delivery from customer node contents.
4. Customer data on nodes
Each ArmMesh service uses a dedicated physical machine, not a virtual machine. Customers decide where to store project files, code repository copies, signing materials, model files, caches, logs, and build artifacts on their node, and manage access permissions, backups, and deletion.
We recommend storing only data needed for your current workflow and avoiding unnecessary long-term copies. Keep projects in directories with clear permissions, use least-privilege keys, redact diagnostic logs, revoke access when team members change, and migrate any work you need to keep before your rental ends. Verify your backups.
When requesting help, start with a description of the issue, the relevant time frame, and the minimum information needed to reproduce it. Support staff will handle additional materials only if general troubleshooting is insufficient and you explicitly authorize access. Authorization does not transfer your responsibility for classifying, lawfully handling, or backing up data on your node.
When a node is released, access ends and the device enters the provisioning process for a new customer. Migrate your data and verify it locally before release; do not use the node as your only backup.
5. Data sharing and processors
ArmMesh shares data with processors only to the extent necessary for a defined business purpose. Service delivery and infrastructure operations may require processing order identifiers, node regions, device status, and necessary diagnostic records, but this does not grant access to customer project content unrelated to those tasks.
Payment processing uses only information needed to settle transactions in USD, confirm payment status, and handle refunds or disputes. ArmMesh supports USDT-TRC20 and Visa, Mastercard, and Amex processed through Stripe. Available payment gateways are determined by the options shown in the order system.
Processors responsible for hosting, email delivery, security monitoring, or technical operations may handle necessary data only for the agreed purposes. They must apply access controls, confidentiality, and security measures appropriate to their tasks and risks. We do not disclose information to third parties to sell personal data.
We may disclose limited information when necessary to meet legal obligations, respond to valid legal process, protect users or service security, or resolve disputes over rights. Such processing is subject to the laws applicable to the platform operator, and disputes will be handled by courts with jurisdiction under those laws.
6. Retention and deletion
We retain account information while an account is active. After closure, we assess what must be retained for pending orders, billing reconciliation, security investigations, rights requests, and legal obligations. Data no longer needed is deleted, anonymized, or restricted from further processing.
We retain order, transaction status, and billing records for as long as needed to perform contracts, reconcile accounts, resolve disputes, and meet legal obligations. ArmMesh does not store full sensitive payment credentials as ordinary order fields.
We retain access and security logs based on risk, troubleshooting needs, and audit purposes, with access restrictions in place. If logs relate to an ongoing security incident, account dispute, or valid rights request, relevant records may be kept until the matter is resolved.
We retain support tickets and attachments for as long as needed to resolve issues, review incidents, and maintain service records. After a node is released, customer data enters the cleanup process. Customers must migrate and verify any files they need before release, as released nodes are not intended for long-term storage.
7. Security measures
We use role-based access controls, authentication, credential safeguards, activity records, and log audits to limit access to account, order, and operational data. Employees and contractors should access relevant information only when carrying out assigned duties.
Security incident response may involve detecting unusual activity, limiting its impact, reviewing activity records, addressing risks, restoring necessary services, and assessing notification requirements. Information gathered during an investigation is used only for security response, fact-finding, and related obligations.
Customers should protect their account email, login credentials, connection keys, signing certificates, project keys, and team permissions. Update access credentials after the first connection, limit shared accounts, review team members regularly, and revoke unneeded access when people or projects change.
Technical safeguards also depend on customer practices. Keep independent backups, verify uploaded content, avoid sending unredacted sensitive information in tickets, and submit a support ticket through the console immediately if you detect unusual access or signs that credentials have been exposed.
8. Your rights and contact
Where applicable rules allow, you may request access to, correction of, or deletion of relevant personal data. You may also request restrictions on certain processing, ask for relevant information, or object to data processing. Some requests may be limited by order fulfillment, billing records, security investigations, and legal obligations.
To submit a request, email us from your account address at support@armmesh.comor sign in to the console and submit a support ticket. To prevent unauthorized disclosure, we may ask you to verify your account, order, or other necessary identity information, but we will not ask for full node credentials unrelated to verification.
Please specify the data involved, what action you are requesting, and any relevant order or ticket identifiers. We will confirm the scope, then review the systems where the data is held, the results of identity verification, and applicable requirements. If we need more information, we will contact you through the original channel.
We may update this policy as our service processes, processors, security measures, or applicable requirements change. The effective date of the latest version will appear on this page. We will provide details through an appropriate channel when changes materially affect processing purposes or user rights.