1. Scope and effective date
This policy applies to the processing of personal data in connection with the ArmShell website, accounts and console, and rentals of dedicated Apple Silicon physical nodes. The service provides cloud Mac workstations, not virtual machines. This policy sets out the separate boundaries for platform business records and user data stored on nodes.
This version takes effect on the date it is published on this page. When you create an account, configure an order, make a payment, submit a support ticket or visit the website, we process relevant data for the purposes described in this policy. Reading this policy does not mean you consent to every optional use of data. Where separate consent is required, we will explain the relevant use and give you a choice when you take the relevant action.
This policy is governed by the laws of the jurisdiction in which the platform operator is established. Any dispute relating to this policy will be handled by the competent courts in that jurisdiction. Nothing in this policy limits any personal data rights you have under applicable law.
2. Data we collect
Account data: This includes the email address and account identifier you provide, records needed for verification and sign-in, and any contact details you choose to submit. Your password is used to verify your identity; do not include it in support tickets, emails or issue descriptions. We do not ask you to submit node access credentials on public pages.
Orders and billing: This includes your selected model, node, billing period, add-ons, order amount, settlement currency, payment status and renewal history. We use this data to provision your service, reconcile invoices and resolve transaction issues. See Section 4 for details on payment data.
Support tickets and access logs: This includes the issue descriptions, attachments, terminal output and correspondence you submit, as well as request times, source IP addresses, browser and device details, access paths, errors and security event records. Before uploading logs or screenshots, remove secrets, access tokens, private keys and unrelated personal data. Collecting logs does not mean we read project files on your node.
3. Data on your node
You manage the source code, build artefacts, model files, test data and other workloads on your dedicated physical machine. We do not collect this content as website analytics data, nor do we proactively browse your project directories or read file contents to analyse how you use the product.
If resolving a technical issue requires us to inspect data on your node, you must first authorise the specific person or team, scope and purpose through a support ticket. Access should be limited to the directories, logs or actions needed to troubleshoot the issue; access to your entire workspace is never assumed. You can provide a redacted error report first to avoid sharing raw business data.
Infrastructure operations, network security incident response and compliance with legal obligations may require necessary technical processing. Such processing must follow the data minimisation principle, with staff access and the scope of operations restricted accordingly. A dedicated node does not include automatic backups. You are responsible for managing system accounts, public keys, file permissions and backups, and should avoid sharing high-privilege credentials when collaborating with others.
4. Payment data
Services are billed in US dollars (USD). We accept USDT-TRC20 and Visa / Mastercard / Amex processed by Stripe. The payment gateways actually available are determined by the response from our backend. The platform stores the amount, currency, payment status, transaction reference and billing records needed to reconcile orders. We do not store full card numbers or card security codes.
When you pay by card, Stripe’s payment flow handles your card details. To match payments with orders, we may receive the payment result, transaction reference and necessary card summary. Do not send full card details by email or support ticket. Your order number is enough for us to start looking into a billing issue.
For USDT-TRC20, we record only the on-chain transaction hash to verify that the relevant order has been paid. We do not collect wallet private keys or seed phrases. On-chain records are publicly searchable and are not deleted when you delete your platform account. Never submit secrets that could be used to control a wallet in a support ticket.
5. Purposes and legal bases
Providing the rental service: Account verification, order configuration, physical node provisioning, expiry reminders, renewals and support ticket replies require us to process account and transaction data. We process this data as necessary to fulfil our service agreement with you; we do not combine processing required to provide the service with optional uses.
Protecting accounts and the service: We use access logs and security event records to identify unusual sign-ins, troubleshoot faults, prevent abuse and protect transactions. Where permitted by applicable law, this processing is based on our legitimate interest in protecting the platform and its users, and must be proportionate to the risks. We retain billing or transaction records when required by law to meet our legal obligations.
Optional processing: If we introduce a use that requires consent, we will first explain the data involved, the purpose and how to make your choice. Withdrawing consent does not affect processing lawfully carried out before withdrawal, or processing required to fulfil an existing order or meet a legal retention obligation. We will not use a privacy request as an opportunity to contact you for marketing purposes.
6. Retention and node erasure
We retain different types of data for different purposes; a single retention period does not apply to everything. Account data is kept while your account relationship continues and for any necessary billing processes. Order and billing records are retained as required for transactions, tax and dispute handling under applicable rules. Support ticket content is kept while an issue is being resolved and for any necessary follow-up. Access and security logs are retained only as needed for troubleshooting, security investigations and legal requirements.
Once an order expires, a node should not be treated as long-term storage that remains accessible. The specific expiry process and available actions are set out in the order details, shown in the console or provided in relevant notices. This policy does not include a default data recovery option or free retention period. Back up your data before expiry, check that your backups can be read and export any build artefacts you still need.
After a node is reclaimed, user data should be erased and the node checked before it is assigned to another user. Data that has entered the erasure process may not be recoverable. Deleting your account does not immediately delete business records that must be retained by law. We restrict access to data that remains within its retention period and stop using it for purposes unrelated to retention. When the purpose ends, we delete the data or irreversibly anonymise it.
7. Sharing and cross-border transfers
We share only the data necessary to provide the service with recipients who need it, such as infrastructure and network service providers, email delivery providers and Stripe for card payments. Sharing is limited to data needed for provisioning, verification, payment or troubleshooting. Service providers must not use this data for unrelated purposes. We do not sell personal data.
Cloud Mac services are available at five node locations: Singapore, Tokyo, Seoul, Hong Kong and the eastern United States. Files you upload are processed at the node you select. Connecting from another location, or syncing or downloading files, may involve a cross-border transfer. Choosing a node determines where your workload is deployed; it does not mean that all account, billing and support ticket records are stored only at that node.
When cross-border processing of personal data is necessary, we assess recipients, access permissions and appropriate safeguards in line with applicable requirements. Where separate consent or another lawful mechanism is required, we will follow the relevant requirements. If we provide data to a competent authority as required by law, we will also verify the basis and scope of the request. You can use the contact details in Section 10 to ask how data relating to your order is processed.
8. Cookies and analytics
The website and console use essential cookies or browser local storage to maintain sign-in sessions, secure requests and save interface preferences you choose. If you disable essential storage, sign-in or checkout may not work properly. If you use the console on a shared device, sign out when you are done; simply closing the browser tab is not enough.
Website analytics help us understand page visits, clicks on order links and common user journeys so we can improve our content and processes. Analytics should not include passwords, verification codes, payment secrets or file contents from your node, nor should the text of a support ticket be uploaded as a page interaction event. Access to analytics records and their retention must be limited to their intended purpose.
You can clear or restrict cookies and site storage in your browser settings. If you do, you may need to sign in again or reselect your preferences. Where the law requires prior consent for non-essential storage or analytics, we must offer you a choice first; continuing to browse is not a substitute for consent. You can email us directly with privacy questions without purchasing a service.
9. Access, correction, deletion and export
To the extent provided by applicable law, you can request access to your personal data, correction of inaccurate data, deletion of data that is no longer needed, and export of available account and business records relating to you. You can also ask us to restrict or object to specific processing, or withdraw your consent. To export project files from your node, use your own connection and backup process; an export of personal data is not a substitute for backing up the entire machine.
If you have an account, sign in to the console and submit a support ticket. If you cannot sign in or do not have an account, email us at support@armshell.com. State the type of request, the account email address and any necessary order reference. Do not include passwords, verification codes, private keys or full payment details. To avoid disclosing data to someone else, we may ask you to complete identity checks proportionate to the risk.
We will handle your request and explain the outcome as required by applicable law. Requests to delete or export data may be affected by open orders, transaction disputes, other people’s data or legal retention requirements. If we cannot fulfil a request in full, we will explain which parts are restricted and why rather than refuse without an explanation. Before requesting account deletion, back up your node files and confirm what will happen to any active orders and tasks.
10. Contact and policy updates
For privacy questions, data rights requests, security reports or other questions about data processing, email us at support@armshell.com or sign in to the console and submit a support ticket. Either channel can be used to make a request. If it concerns specific account data, we will verify your identity before proceeding.
We recommend using “Privacy request” and the request type as your email subject. In the message, identify the affected account, order or page and tell us what you would like us to do. Include only the information needed to verify the issue. Before sharing logs or screenshots, redact unrelated personal data and credentials. Do not send full identity documents or payment details to prove who you are; if verification is necessary, we will give you clear instructions on what information to provide.
We will update this page’s version and effective date if the service scope or data processing practices change. We will provide any necessary notice of significant changes to processing purposes, data categories, sharing or user rights through the website, console or account email. Where renewed consent is required by law, updating this policy does not replace that consent. You can review this page before making a new rental decision.