Privacy policy

Last updated: 22 October 2026. Version 1.3.2.

This policy explains what personal data Peryn collects, why, who we share it with, how long we keep it and what your rights are. It covers the websites at app.peryn.ai (the developer console and the miner portal), chat.peryn.ai (the web chat) and docs.peryn.ai (the documentation), the API at api.peryn.ai, our mining pool at pool.peryn.ai and our node service at node.peryn.ai. It also covers the same services at their earlier addresses, which still answer: ai.pearlsafe.xyz, chat.pearlsafe.xyz, api.ai.pearlsafe.xyz, pool.ai.pearlsafe.xyz and node.ai.pearlsafe.xyz.

It does not cover the Pearl Safe wallet at pearlsafe.xyz. Pearl Safe has its own privacy policy, at pearlsafe.xyz/privacy.

In short

• We do not log or store the content of your prompts or completions, and we never train on them. The one exception is a batch file you send us to run later: we keep it, encrypted, until 7 days after the batch ends (section 4, "Batch files").
• We keep account data and request metadata (counts, times, costs, no content) for billing and reliability.
• GPU nodes may be in any country. By default a request runs on any healthy node. You can limit this with region rules (section 6).
• We set only strictly necessary cookies: a session cookie to keep you signed in and, on staff admin pages, a short-lived passkey sign-in cookie. Our network provider may add a security cookie. No analytics, advertising or tracking cookies.

1. Who we are

Peryn is a service of Extra Watts B.V.

• Legal name and legal form: Extra Watts B.V. (besloten vennootschap)
• Registered in the Netherlands. Chamber of Commerce (KvK) number: 75938650
• VAT number: NL860448769B01
• Address: Herengracht 420, 1017 BZ Amsterdam, Netherlands
• Privacy contact: privacy@peryn.ai
• Legal notices: legal@peryn.ai
• General contact: hello@peryn.ai
• Security contact: security@peryn.ai
• Data protection officer: we have not appointed one. The law does not require one for our activities. Send privacy questions to privacy@peryn.ai.

Extra Watts B.V. is the controller of the personal data described in this policy.

If you send other people's personal data through the API. If you are a business and your requests contain personal data about other people (for example your own customers), we process that content only to answer your request, on your behalf. In that case you are the controller of that content and we are your processor. We offer business customers a data processing agreement (DPA). Email privacy@peryn.ai to get it.

2. Data policy

This is the data policy we submitted to OpenRouter. It applies to every request we serve.

The rest of this page explains this in more detail.

3. What we collect

Account and sign-in

• Your email address. You sign in with a link we email to you (a "magic link"). There is no password. Your account is created the first time you use a link.
• Account details: an account ID, your role (customer, miner or both), when you signed up and when you last signed in.
• Sign-in link records: the email address the link was sent to, a one-way hash of the link's token, when it expires (15 minutes after it is sent) and when it was used. Each link works once.
• Sign-in rate limiting: when someone asks for a sign-in link, we record a keyed one-way hash of the IP address (not the address itself) and the time. We use it only to limit how many links can be requested.
• Sessions: a one-way hash of your session token, when the session started, when it expires and when it was last used.

Cookies and browser storage

• Our session cookie (__Host-pc_session), set only when you sign in. It is sent only to the address where you signed in (host-only): app.peryn.ai, or ai.pearlsafe.xyz while that earlier address still answers. It is sent only over encrypted connections, and cannot be read by scripts on the page. It expires after 30 days, or when you sign out. It is strictly necessary to keep you signed in, so it does not need your consent.
• The web chat's session cookie. The web chat at chat.peryn.ai has its own sign-in. When you sign in there, it sets its own session cookie of the same kind (__Host-pc_session), sent only to the address where you signed in there (host-only): chat.peryn.ai, or chat.pearlsafe.xyz while that earlier address still answers. It has the same protections and expiry. Signing in on one site does not sign you in on the other.
• Our sign-in link cookie (__Host-pc_signin), set when you ask for a sign-in link. It holds a random value that lets the link sign you in straight away in the browser that asked for it; opened anywhere else, the link first shows which account it signs in to and asks you to confirm. It protects you from being signed in to someone else's account by a link they send you. It has the same protections as the session cookie, expires after 15 minutes and is removed once you are signed in. It is strictly necessary.
• Our passkey sign-in cookie (staff only). When a member of our staff signs in to our admin pages with a passkey, we set a short-lived cookie (__Host-pc_webauthn) that holds a one-time sign-in challenge. It has the same protections as the session cookie and expires after 5 minutes. Other visitors never get it. It is strictly necessary.
• Security cookies from our network provider. Our website runs behind a network provider that protects it against attacks. When it checks whether a visitor is a bot, it may set its own strictly necessary security cookies (for example a bot-management cookie that expires after 30 minutes). They are not used for analytics, advertising or tracking.
• No analytics, advertising or tracking cookies, and no third-party analytics or tracking scripts on the site.
• Chat history is kept in your browser's own storage (IndexedDB), not in a cookie, and only if you turn on saving. Your choice to save or not is remembered in the browser's local storage; it holds no chat content. See section 4.
• Payments. When you buy credits you are sent to our payment provider's checkout page. That page is run by the payment provider, which sets its own cookies under its own policy.
• No cookie banner. We use only cookies and browser storage that are strictly necessary for the service you ask for, so we do not need your consent and do not show a cookie banner. If we ever want to use a cookie that is not strictly necessary, we will ask for your consent first.

API keys

• A one-way hash of each key (never the key itself; we show you the key once, when you create it).
• The first few characters of the key, so you can tell keys apart.
• The key's name, its privacy tier, its rate limits, and when it was created, last used and revoked.

Request metadata

For each request we keep metadata only, never the content:

• request ID, account, API key, timestamps;
• model, endpoint, whether it was streamed, privacy tier, which GPU node served it and that node's country;
• token counts, cost, what the GPU operator earned for it;
• status, error code, number of attempts, time to first token and duration;
• a usage receipt signed by the GPU node. The receipt holds the request ID, node, model, token counts and finish time. It contains no content and no hash of the content.

We use this for billing, your usage page, abuse prevention and keeping the service reliable.

Payments

• What we keep: the amount, the status, the time, and our payment provider's reference for the payment. Our credit ledger records each purchase and each charge.
• What our payment provider gets: we pass your account email address and account ID to the provider's checkout page. You enter your payment details (for example your card) on the provider's page. We never see or store your full card number.
• Our payment provider processes payment data to handle your payment. For some purposes, such as preventing fraud and meeting its own legal duties, it acts as an independent controller, under its own privacy policy.
• Stablecoin deposits. Your account's deposit address, and for each deposit: the network, the transaction ID, the sending address, the amount, the block, the time and its status (confirming, credited, held and why, sent back). This comes from the public blockchain. We check each sending address against the sanctions list of digital currency addresses published by the US Treasury (OFAC), using a copy we keep ourselves: no screening company gets your data. We record the result.
• Deposits through Relay. If you pay with another token through Relay: the token and network you chose, the refund address you entered and the result of its sanctions check, your account's Relay deposit address, and for each deposit what Relay reports: its request ID, the network, the transaction ID and the sending address there, the amounts and fees, the status, and the transaction on Base that delivered the USDC. We check the sending address and your refund address against the same sanctions list, and a Tron refund address against Tether's public list of frozen USDT addresses. We also record what has arrived at your Relay deposit address on its network, to follow up a deposit Relay has not processed. Relay (Uneven Labs, Inc.) handles the conversion as an independent controller, under its own terms and privacy policy.
• Terms acceptance. Which version of our terms you accepted, and when. We do not record your IP address for this.
• Accounts billed monthly. The legal name, VAT number and invoice email address of the business, its credit limit and payment term, its invoices, and the payment reference (a transaction ID or a bank reference) of each paid invoice. Before we open such an account, we check the business's name against the EU, Dutch and US sanctions lists and record that we did.
• Billing emails. Receipts for deposits, low-balance alerts (at the amount you set, which you can turn off in your settings) and invoices. We record that each email was sent, so it is sent once.

Miners and node operators

If you run a GPU node or mine with our pool, we also collect:

• Node details: the node's name, its public key, its status and its trust tier.
• Node country: the country you declare for the node, and the country that the node's IP address points to. We look up the IP address each time the node connects and store only the resulting country, not the address. (Our server access logs do record IP addresses; see "Technical logs".) We keep each country a node connected from, with when it was first and last seen, because payouts are screened against embargoed countries over the last 90 days, not only the latest connection.
• Heartbeats: about every 10 seconds the node sends GPU model, memory use, utilisation and temperature, the models it serves, active requests, queue depth, tokens per second and miner health (including share counts). We keep the latest heartbeat and a short history.
• Hardware reports: the node reports, for each GPU, its model, memory, compute capability, clock speeds, power limit, PCIe link and position on the machine's PCI bus, plus the driver and CUDA versions, the operating system and processor type, the node software's uptime and connection counts and, only if you turn it on, a network speed test. Instead of each GPU's hardware ID it sends a one-way hash of that ID, which lets us recognise the same GPU behind two nodes. Serial numbers are never read. We keep the latest report while the node is registered and a record of each change for 12 months.
• Validation records: whether the node is on probation, validated, demoted or quarantined, each change of that state and why, and throughput measurements from test requests (timings only).
• Pool records: your mining workers, and for each share a one-way hash plus metadata (time, block height, difficulty, accepted or rejected and why, whether it found a block, the model, whether the weights check passed, and what the node was doing at the time: customer requests, filler or idle). We never store the share itself.
• Network pseudonym of each mining connection: a keyed one-way hash of the network you connect from (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address), so that our incentive programs can tell when many miners share one connection. We never store the address itself, and only our pool holds the key, so the hash cannot be turned back into a network. We delete it 30 days after the connection ends.
• Test results: we send nodes test requests to check that they serve the model they claim. We keep the results.
• Payout details: your payout addresses (PRL on the Pearl network; USDC or USDT on Base, Arbitrum, Ethereum or Tron), how each was set and when it applies, payout amounts and transaction IDs.
• Sanctions screening: before we send a payout, and again before we buy PRL from you for a payout in USD, we check your PRL address and the stablecoin address you are paid to against the sanctions list of digital currency addresses published by the US Treasury (OFAC), and the countries of your nodes or mining logins against the countries under sanctions. We keep the result of each check, and any proof of identity or location we ask you for.

Mining with a PRL address, and payouts in USD

If you mine with our pool using a PRL address as your username (with no account), or choose where your mining rewards are paid, we also collect:

• Mining countries. For each country your address is mined from with our pool, the country the miner's IP address points to (not the address itself) and when, once that connection's work is accepted. We also record the country of a login naming your address that we refused because it came from a country under sanctions. We use them only for the sanctions checks of your payouts.
• Signed messages. When you prove that you control your address with a signed message: the message, its signature and when we checked it. While a message is open, we also keep a keyed one-way pseudonym of the network you asked from, used only to limit how many open messages one network can have.
• Addresses linked to your account. If you link a PRL address to your account by signing a message with it: the address, your account, the signed message and when the link started and ended.
• Your bonus address. If you add a USD stablecoin (USDC) address to your mining login for an incentive program (usdc= and chain= in the password): that address and network for each connection, the bonus each address earned, and where it was paid. If you move a bonus with a signed message, that message as above.
• Your choice of payouts in USD. If you choose to be paid in USD for the PRL you mine: your legal name (or your company's) and your country of residence or incorporation, which version of our terms for payouts in USD you accepted, and for each block mined that way what it became (converted and at what rate, or paid in PRL and why). We use your name and country to check the payout against sanctions lists and keep them as the record of our purchase of your PRL.

Your address's public pages. Anyone who knows a PRL address can open its pages on app.peryn.ai: its hashrate, shares, the worker names you chose, the PRL it earned and was paid, its Founding Miner status if you have one, and where its payouts go, including the full stablecoin address (so that you can check it exactly) and the history of those settings. Nothing on these pages names an account, an email address, an IP address, a legal name or a country, and they are not indexed by search engines. They show nothing that depends on a check of the owner: no pending change of how the address is paid, no USD amount or rate of a conversion, and one phrase for whatever a pending payout address waits for.

Technical logs

• Our web servers keep access logs: the time, the IP address, the path, the status, the response size and timings. We remove request headers (including cookies and API keys) and query strings (sign-in links carry tokens) before anything is logged. Request and response bodies are never logged.
• Our applications log IDs, error codes and counts. They are built never to log content or secrets. In rare error cases, a log line can contain an email address or a payout address.
• We keep an audit log of administrative and security events, such as admin changes, staff passkey sign-ins, node enrolments, payout steps and sign-in link requests. For sign-in link requests it holds only the keyed IP hash and the time (the rate-limiting records above).

When you contact us

If you email us, we keep the email and our reply. Emails to our contact addresses are forwarded to our company mailbox.

Enquiry and contact forms

The "Talk to us" forms on peryn.ai (on the GPU Clouds, Developers, Private AI, Pricing and Company pages) send your enquiry to us. This policy covers them.

• What we collect: the fields of the form you fill in and your message. Every form asks for your name (optional), your work email and your company; the GPU Clouds form also asks for your fleet size, GPU types and region. We also record which form and page the enquiry came from, and when. We do not store your IP address. To limit abuse, the number of enquiries from one IP address is counted for a short time and not stored.
• Why: to reply to you and to discuss working with you.
• Legal basis: steps you ask us to take before a possible contract (GDPR article 6(1)(b)) and our legitimate interest in answering business enquiries (6(1)(f)).
• Who receives it: we store the enquiry in our database (with our cloud hosting provider) and email it to our company mailbox through our email sending provider; our email hosting provider keeps that email (section 9).
• How long: the stored enquiry is deleted 12 months after its last update. The email and our reply are kept like support emails: 2 years after our last reply (section 11).

4. What we do not collect

• Prompt and completion content. We do not log or store it, and we never train on it. Content exists only in memory on the servers that handle the request, while they handle it. On GPU nodes, recent prompt data may stay in GPU memory for a short time, to speed up repeated prompts, until new requests overwrite it.
• Your chat history. The web chat keeps your conversations only in your browser, and only if you turn on "Save chats in this browser" (it is off by default). Saved chats are encrypted with a key created in your browser that cannot be read out of it, separately for each account: someone else who signs in on the same browser does not see them. Signing out of the chat (in its menu) offers to delete the chats saved in that browser. We do not receive a copy of your history. When you send a message, the conversation so far is sent with it so the model can answer. Like an API request, it is handled in memory and not stored. Turning saving off stops saving new chats; "Delete all history" deletes the chats already saved. If you clear your browser's data, your saved history is gone and we cannot recover it.
• Full card numbers. Our payment provider handles them.
• Tracking. No analytics, advertising cookies or tracking pixels.

We do not sell personal data.

Batch files

The Batch API (and Batches in the console) runs many requests from one file within 24 hours, at a lower price. To do that we have to keep what you send until it has run, and the answers until you have downloaded them. So, only for batches:

• What we store. The file you upload (your requests), the answers we produce and a file of the requests that failed, the file's name, and the labels you give a batch and its requests (metadata and custom ids). Nothing else: we keep no copy and no hash of a file's content anywhere else, and our logs hold only IDs, sizes and counts.
• How. Files and answers are encrypted (AES-256-GCM) with a key that only our API servers and the server that runs batches hold. Our website's servers never have it: they link you to the file, and the API checks a link that is signed for your account and expires after 10 minutes.
• How long. Until 7 days after the batch ends. A file you upload but never use: 7 days after the upload.
• Deleted automatically. When that time is up, the file, its answers, its name and the labels are deleted, even if you never downloaded them. You can delete a file yourself at any time, and cancel a batch at any time. If you delete your account, its batch files go at once and its unfinished batches are cancelled. After deletion we keep only the batch's ID, owner, times and request counts.
• Who can access them. You, signed in to your account or with your API key. Our staff cannot open them from the admin pages, which show only IDs, sizes, counts and costs. While a request from your batch runs, the GPU node that answers it sees it, as for any request (section 5).
• Not for training. Batch requests run on the Standard tier, are never used for training and are not available through OpenRouter. Everything else in this policy applies to them as to any other request.

5. Who can see your content while a request runs

Content is never stored, but some systems must handle it to answer you. This is the full list.

The companies that host these servers could technically access their memory. We rely on their contracts and their security. Node operators must run our unmodified software under our terms, and we test nodes, but we cannot technically stop an operator from changing their own machine. We do not offer any tier today in which the GPU node cannot see the content it processes.

6. Privacy tiers

Each API key has a privacy tier. Requests made with that key use that tier.

• Standard. Zero retention, as in the data policy above. Today no Standard request is mined. See "Mining and your data".
• Private. Zero retention, never used for mining, and routed only to vetted nodes. Vetted nodes are nodes we run, or nodes of operators we have approved for this tier. Before we approve an operator, we check who they are, where and how the node is hosted, and that they have signed our data processing terms. We offer this tier for a model only once we have measured that model's throughput.

Where your requests run

• GPU nodes may be operated anywhere in the world. Some are ours; others are run by independent operators, whose nodes we approve before they receive any customer request. All must run our unmodified software under our terms. Private-tier requests go only to vetted nodes.
• Every node is tagged with its country. The operator declares it, and we check it against the node's IP address. This check relies on the operator's word and on IP location, which a dishonest operator could fake, for example with a VPN. We remove nodes we catch doing this.
• By default, a request runs on any healthy node, in any country.
• You can set region rules for your whole account or for a single API key, for example "EU only" or "exclude these countries". We then send your requests only to nodes that match. If no matching node is available, the request fails straight away with a clear error. It never runs elsewhere instead.
• The country where each request ran is shown in your usage logs and in the x-pc-node-country header (a two-letter country code) on every API response that a GPU node served, including streamed responses.
• "EU only" is not the default. If your requests may contain personal data that must stay in the EU/EEA, set an "EU only" rule.

7. Mining and your data

GPU nodes in our network mine PRL, the Pearl network's coin. Today no request is mined. Here is what that means for your data.

• Mining uses synthetic data only. Our miners compute on numbers generated for mining, never on a request or its answer. While a node handles a request, the miner does not compute on that request, and any mining results that could touch it are thrown away.
• Nothing from your requests reaches our mining pool or the blockchain. The pool receives mining results made from synthetic data only, and a block holds a proof of that work. Neither contains anything from your request or from the answer.
• Private requests are never mined.
• Mining inside requests starts with Pearl's FP8 upgrade. When it does, your data never leaves the machine. Only a signed claim does, and for found blocks, a zero-knowledge proof that reveals nothing about the request. We will update this policy before it starts.

8. Why we use your data (legal bases)

We send service emails only: sign-in links, and important notices about your account, your credits, payments or these policies. We do not send marketing emails. If that changes, we will ask for your consent first.

9. Who we share data with

We use these kinds of service providers to run the service. They process data on our behalf, under contract, unless noted.

A list of subprocessors is available on request. Email privacy@peryn.ai.

If our API address is ever moved behind our network provider's proxy as well, the network provider would also handle API traffic in transit. We will update this page before that happens.

We do not send your requests to other AI providers.

Other recipients

• OpenRouter. If you reach our models through OpenRouter, OpenRouter is our customer for that traffic. Its own privacy policy covers what it collects. We apply the same data policy to requests that come through OpenRouter.
• Public blockchains. PRL payouts are transactions on the Pearl blockchain and stablecoin payouts are transactions on Base, Arbitrum, Ethereum or Tron. Stablecoin deposits are transactions on Base, Arbitrum or Ethereum; a deposit through Relay is also a transaction on the network you send from. All are public and permanent. Blocks our pool finds are public too (see "Mining and your data").
• Authorities, when the law requires us to share data.
• A buyer or successor, if Extra Watts B.V. or the service is sold or merged. This policy would continue to apply to your data. We will tell you before your data becomes subject to a different privacy policy.

10. International transfers

Our main servers (website, API gateway, database, mining pool) and our backups are in the EU. Some data leaves the EU/EEA:

• Requests. Unless you set region rules, a request may run on a GPU node in any country, including countries outside the EU/EEA that do not have an EU "adequacy decision". Any personal data in that request then leaves the EU/EEA while it is processed. We treat this as an international transfer.
• Our own GPU nodes run on GPUs we rent from cloud providers in the US and the EU.
• Providers. Some of our service providers (for our network, sending email, our mailbox and payments) are based in the United States or process data there. So is Relay, if you pay with another token through it.

When personal data leaves the EU/EEA for a country without an adequacy decision, we use the EU Standard Contractual Clauses (SCCs) where applicable, in our contracts with service providers and node operators. For a provider in the United States that is certified under the EU-US Data Privacy Framework, we may rely on that framework instead. We assess the risks of each transfer. You can ask us for a copy of the relevant safeguards.

To keep your requests in the EU, set an "EU only" region rule (section 6). For the strongest assurance, combine it with the Private tier, which runs only on vetted nodes.

11. How long we keep data

12. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong;
• delete your data ("right to be forgotten");
• restrict how we use your data;
• object to uses based on our legitimate interests;
• data portability: get the data you gave us in a machine-readable format.

You can revoke API keys and sign out of all sessions yourself in the console. For anything else, email privacy@peryn.ai from the address on your account. We answer within one month. We may need to check that the request comes from you.

Some limits apply:

• We cannot give you or delete content we never stored, such as your prompts and completions.
• We cannot read or delete your chat history. It is in your browser.
• We must keep financial records for as long as the law requires, even after you delete your account.
• We cannot change or delete data on public blockchains.

You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in the EU country where you live or work.

Automated decisions. We do not make decisions about you based only on automated processing that have legal or similarly significant effects. Our systems do automatically limit request rates, and our pool automatically blocks a mining worker for a short time if too many of its shares are invalid. These are temporary safety measures. If you think one was applied to you wrongly, email us and a person will review it.

13. Security

What we do:

• Encrypted connections (TLS) to our website, API, mining pool and node service. GPU nodes connect to us over encrypted connections.
• API keys, session tokens and sign-in tokens are stored only as one-way hashes.
• Sign-in links work once and expire after 15 minutes.
• Our cookies are host-only, sent only over encrypted connections, and not readable by scripts.
• Logs contain no content. Access logs drop headers and query strings.
• Each GPU node proves its identity with its own key when it connects, and signs its usage receipts.
• Our mining pool keeps only a hash of each share.
• Our servers sit behind a firewall that allows only the ports we need, with key-only remote login and rate limits.
• A person approves every payout batch. Our systems never sign USDC payouts on their own.

No system is perfectly secure. If a personal data breach puts you at risk, we will tell you and the regulator as the law requires.

14. Children

Peryn is not meant for children. You must be at least 18 to create an account. We do not knowingly collect data from anyone under 18.

15. Changes to this policy

We will post changes on this page and update the date at the top. If a change is material, we will email account holders at least 30 days before it takes effect, unless the law requires us to make the change sooner.

16. Contact

Extra Watts B.V., Herengracht 420, 1017 BZ Amsterdam, Netherlands. Privacy: privacy@peryn.ai. Legal: legal@peryn.ai. General: hello@peryn.ai. Security: security@peryn.ai.