Privacy Policy

Effective September 1, 2026. Applies to the Tengsuan console, API and all compute services operated by Tengsuan ("we", "us").

Short version, which the homepage repeats: we keep an email address and a password hash, a ledger of what you used, and sign-in events for a limited time. We do not read what runs inside your hosts, we do not ask for identity documents, and we never sell or share usage data. The full detail follows.

What we collect

• Account data: the email address you sign up with (any address works; no name, phone or ID document is required), an optional display name, a workspace name, a bcrypt password hash, and API tokens stored as hashes.
• Billing data: ledger entries (GPU type, seconds, amount), invoice records, the deposit addresses generated for your payments and the transaction hashes that pay them. Crypto deposits carry no name. If you choose the card option, the card partner performs its own identity verification under its own policy; we receive only a payment reference, never card details.
• Security data: sign-in events with IP address and user agent, kept for twelve months solely to detect account takeover, then deleted.
• Workload data: none. We do not inspect, index or retain the contents of your hosts or volumes. Host filesystems are destroyed on termination, and run logs expire automatically after seven days.

How we use it

Only to run and secure the service, meter usage and invoice you, send transactional email (verification, password reset, invoice and balance notices), and meet legal obligations. We do not sell personal data, do not use it for advertising, and do not build profiles.

Sharing

Nothing is shared with third parties except the processors that physically run the service, each of which receives only what its role requires: the infrastructure provider that schedules containers (receives the container and its resource shape, never your account identity), the crypto payment processor (receives the payment amount and a reference), and the email delivery provider (receives the address and the message). None of them receive your usage history, and none may use the data for their own purposes.

Retention

Sign-in and security events: twelve months. Run logs: seven days. Account and workspace records: while the account exists, deleted on closure. Ledger and invoice lines: retained after closure only where financial record-keeping law requires it, for up to seven years, stripped of everything except the amounts, dates and payment references.

Your rights

You can export or delete your account data by contacting support@tengsuan.cloud. Where applicable law grants access, correction, portability or erasure rights, we honour them within 30 days.

Security

Passwords are hashed with bcrypt, sessions and tokens are stored hashed, transport is TLS-only, and SSH endpoints are unique per host and closed at termination.