Data Privacy Policy

1. Introduction

These data protection conditions apply to the services offered by SolverCloud, in particular to those provided with the online platform https://sandbox.numericalai.net and all sub-pages accessible under this domain, together with the cloud sandbox virtual machines provisioned through it.

We take the protection of your personal data very seriously. Data protection is a matter of trust. When processing your personal data, we carefully observe the legal provisions.

We would like you to know which personal data we collect, process, store and use (hereinafter: "processed") for which purpose and, if necessary, pass them on.

SolverCloud will process your data exclusively according to the following regulations. If you agree to the transfer of your data, different provisions may apply to the use of your data by the recipient than those contained in these data protection provisions.

2. Responsible party

The party responsible for the collection, processing and use of your personal data within the meaning of applicable data protection law is Empirisch Tech GmbH (limited liability), Managing Director, Dr. Wasif Masood, Rennweg 88, 1030 Vienna, Austria.
Contact Form.

3. Collection, processing and use of personal data

3.1 According to applicable data protection laws, personal data are details about personal or factual circumstances of a certain or determinable natural person, for example name, address, telephone number including all data, which you disclose during the registration for the participation in the services offered by SolverCloud. Anonymous information, on the other hand, is not personal data.

For the provision and individualization of our services to your needs, it is necessary that we process certain personal data for the following purposes.

3.2 Within the scope of your registration we will process certain personal data (mandatory data). These are first name, surname, email address, password, affiliated company name and your role in the company.

The e-mail address is also used as an alternative to the user name for your identification in the login area.

In the course of your registration, we set up direct access to your stored data (user account) for each user. This access is password protected.

In the user account you can view and manage the sandbox virtual machines you have created, their status and connection details, your credit balance and consumption, your purchase history, and your personal data.

The access data must be treated confidentially and may not be made accessible to unauthorized third parties. We cannot accept any liability for improperly used access data.

We collect, store and process your data for the administration and provision of your participation in the SolverCloud services, to improve the services offered by SolverCloud based on the information and feedback of the participants, to effectively answer your questions and to provide services, technical administration and for our own marketing purposes including e.g. surveys, competitions and contests as well as to send e-mails. The personal data will also be used to send you information regarding the services offered, the company, product information as well as for updates etc. SolverCloud is entitled to use the e-mail address provided by you during registration.

Your data will only be passed on to third parties if this is necessary for the purpose of participation in the services or the billing of fee-based services, if applicable, for any other purpose with your consent, or as required by law.

Within the scope of order processing of chargeable services, for example, the service providers used by us (for example banks, payment services, credit card institutions) receive the necessary data for order and order processing. The data passed on in this way may only be used by our service providers for the fulfillment of their tasks. Any other use of the information is not permitted and will not be made by any of the service providers entrusted by us.

If you use our website for information purposes only, i.e. do not log in, register or otherwise provide us with information, we do not collect any personal data, with the exception of the data transmitted by your browser to enable you to visit the website.

3.3 Email Communications All official emails from SolverCloud are sent from the domain @sandbox.numericalai.net. SolverCloud is a platform operated by Empirisch Tech GmbH under the sandbox.numericalai.net domain. To ensure you receive important account notifications, please add our email address to your contacts or safe sender list.

4. Your sandbox virtual machines and their contents

4.1 The core of our service is a virtual machine ("sandbox") that you control. We build the machine image and call Microsoft Azure's APIs to create a virtual machine from it on your instruction; the machine and its disk then run on Azure's infrastructure, not ours. You decide what to place on it — simulation case files, meshes, scripts, results and any other content you upload or generate. We refer to this collectively as "VM content".

4.2 Each sandbox is a single-tenant machine. Its disk is not shared with other customers, and other customers have no access to it.

4.3 We have no access to VM content. You hold the administrator credentials for your sandbox, and we do not log in to it. We do not read, inspect, index, copy or analyse the files you place on a sandbox, we do not use them to train models or to improve our services, and we are not able to retrieve them for you. Support is provided on the basis of what you tell us and what our own provisioning records show, not by looking inside your machine.

4.4 Retention. A sandbox's disk persists for as long as the machine exists, including while it is stopped. When you delete a sandbox, its disk and the VM content on it are destroyed and cannot be recovered by us or by you. We do not maintain backups of VM content, so you are responsible for keeping your own copies of anything you wish to retain.

4.5 Automatic deletion when your credits run out. A sandbox consumes credits for as long as it exists, because even a stopped machine continues to hold a disk, a public IP address and other billable infrastructure. We send warning emails to your registered address as your balance runs low, and when only €1 remains your running sandboxes are stopped automatically to slow the consumption of what is left. If you do not top up and the balance then reaches zero — whether because you have used the credits up or because unused credits have expired — every sandbox on your account is deleted automatically, stopped machines included, together with its disk and all VM content on it. The deletion is irreversible, we hold no backup, and buying further credits afterwards does not bring a deleted sandbox back. Act on the warning emails and copy anything you need off your sandboxes in good time.

4.6 Because a sandbox is under your control and we have no access to what is on it, you alone determine what is placed there. If you put personal data relating to other individuals on a sandbox, you remain responsible for it and for having a lawful basis to do so. Our role is limited to providing and running the machine.

5. Sandbox access credentials and connection data

5.1 Each sandbox is created with an administrator account. You may set its password yourself, or leave the field blank so that one is generated for you. In either case we store that credential so that it can be displayed to you in your account, and so that the machine can be provisioned. It is shown only to you, in your authenticated session, and only when you choose to reveal it.

5.2 Each running sandbox is assigned a public IP address and accepts remote connections, by default over SSH (port 22) and Remote Desktop (port 3389). The content of those sessions is not recorded by us. Connection metadata may be logged at the infrastructure layer by our hosting provider for security and abuse-prevention purposes.

5.3 Provisioning logs. Creating, starting, stopping and deleting a sandbox runs as a job whose output we retain and display to you in your account. These logs record the machine's configuration and the outcome of the operation. They are operational records and are deleted with your account.

6. Hosting and international data transfers

Sandboxes and the data associated with them are hosted on Microsoft Azure, operated by Microsoft Corporation and its affiliates, acting as our processor. We do not operate data-centre infrastructure of our own: our role is to build the sandbox image and to instruct Azure, through its APIs, to create and manage machines on your behalf.

You choose the region in which each sandbox is created. Regions currently offered are Germany West Central, located within the European Union, and East US, located in the United States. If you create a sandbox in East US, the VM content and associated data for that machine are stored and processed in the United States.

Transfers to the United States are made on the basis of the European Commission's Standard Contractual Clauses and the additional safeguards contained in our agreement with the hosting provider. If you would prefer your data to remain within the European Union, choose a European region when creating a sandbox.

7. Service providers we rely on

We use the following processors to deliver the service. Each is bound by a data processing agreement and may use the data only to perform its task for us.

• Microsoft Azure — provisioning, hosting and storage of sandbox virtual machines and their disks, and our platform infrastructure (European Union and United States, see section 6).

• Stripe, Inc. — payment processing and billing records (see section 10).

• Cloudflare, Inc. — bot protection on our forms (see section 9).

8. Cookies

Cookies are small text files that are stored on your computer. Cookies cannot run programs or transmit viruses to your computer. They serve to make the Internet offering as a whole more user-friendly and effective.

In some areas of our website, we use such cookies, for example to recognize the preferences of visits to the website and to be able to design the website accordingly. In particular, this will facilitate navigation and improve the user-friendliness of the website. In addition, cookies help us to identify particularly popular areas of our services.

Session cookies (also called transient cookies) are automatically deleted when you close your browser. These store a so-called session ID, with which different requests of your browser can be assigned to the common session. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete cookies at any time in the security settings of your browser.

Cookies that are strictly necessary for the website to function are set without consent. Any analytics or marketing cookies are set only if you accept the corresponding category in our cookie banner, and you may change or withdraw that choice at any time.

You can configure your browser settings according to your wishes and, for example, refuse the acceptance of third party cookies. However, we would like to point out that you may not be able to use all the functions of our website.

9. Cloudflare Turnstile

We use Cloudflare Turnstile to protect our website from automated abuse and bots. When you access pages with forms (such as sign-in or registration), Turnstile may collect technical information including your IP address, browser type, and interaction patterns to verify you are a human user.

This data is processed by Cloudflare, Inc. For more information, see Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/.

10. Payment Processing (Stripe)

We use Stripe, Inc. to process payments for our services. When you make a purchase, Stripe collects your payment information (credit card number, billing address, email) directly. We do not store your complete payment card details on our servers.

Stripe may use this information to process transactions, prevent fraud, and comply with legal obligations. For more information, see Stripe's privacy policy at https://stripe.com/privacy.

11. Optional analytics and advertising technologies

The technologies described in this section are optional. They are activated only if you accept the corresponding category in our cookie banner, and a service that we have not enabled collects nothing regardless of your choice. You can withdraw consent at any time through the cookie settings, after which no further data is collected by them.

Google Analytics

Where enabled with your consent, this website may use Google Analytics, a web analysis service of Google Inc. ("Google"). Google Analytics uses cookies which enable an analysis of the use of the website, for the purpose of statistical evaluation and improvement of the website. IP anonymisation is activated, so Google will reduce your IP address within the Member States of the European Union or other states party to the Agreement on the European Economic Area before transmission. You can prevent the collection and processing of this data by installing the browser plugin available at https://tools.google.com/dlpage/gaoptout.

Advertising and conversion measurement

Where enabled with your consent, we may use Google Ads conversion tracking and remarketing (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), the LinkedIn Insight Tag (LinkedIn Corporation, 1000 W. Maude Ave, Sunnyvale, CA 94085, USA), and the Meta Pixel (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland) to measure the effectiveness of our advertising and to build audiences for remarketing. These services may collect pages visited, actions taken, device and browser characteristics, and IP address, and data may be transferred to servers in the United States.

Further information and opt-out options are available from each provider: Google, LinkedIn, and Meta.

12. Information on the newsletter and consents

With the following information we inform you about the contents of our newsletter as well as the registration, dispatch and statistical evaluation procedure and your rights of objection. By subscribing to our newsletter, you agree to the receipt and the described procedure.

Contents of the newsletter

We only send newsletters, e-mails and other electronic notifications, including promotional information (hereinafter: "newsletters") with the consent of the recipients or a legal permission. If the contents of a newsletter are specifically described within the scope of a registration, they are decisive for the consent of the users. In addition, our newsletters contain information about our products and services, offers, updates and any activities related to our platform and our company.

The registration for our newsletter takes place in a so-called double opt-in procedure. This means that after registration you will receive an e-mail asking you to confirm your registration. This confirmation is necessary so that nobody can log in with other e-mail addresses. The registration for the newsletter is recorded in order to be able to prove the registration process according to the legal requirements. This includes the storage of the login and confirmation time, as well as the IP address.

Cancellation/Revocation Newsletter

You can cancel the receipt of our newsletter at any time, i.e. revoke your consent. You will find a link to cancel the newsletter at the end of each newsletter.

Legal basis Data Protection Regulation

In accordance with the provisions of applicable data protection regulations, we inform you that your consents to the sending of e-mail addresses are based on your explicit consent. The statistical surveys and analyses as well as the logging of the application procedure are carried out on the basis of our legitimate interests. We are interested in using a user-friendly and secure newsletter system that serves both our business interests and the expectations of users. We would also like to point out that you can object to the future processing of your personal data at any time in accordance with the statutory provisions. The objection may be lodged in particular against processing for direct marketing purposes.

13. Rights of the persons concerned

You have the right:

• To request information about your personal data processed by us. In particular, you may request information about the purpose of processing, the category of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to rectification, deletion, restriction of processing or objection, the existence of a right of appeal, the origin of your data, if these have not been collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information on their details;

• To demand without delay the correction of incorrect or complete personal data stored by us;

• To request the deletion of your personal data stored with us, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;

• To demand the restriction of the processing of your personal data if you dispute the accuracy of the data, if the processing is unlawful but you refuse to delete the data and if you no longer require the data for the purpose of asserting, exercising or defending legal claims, or if you have lodged an objection against the processing;

• To request your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where applicable;

• To revoke your consent to us at any time. As a result, we are no longer allowed to continue processing data based on this consent in the future and to complain to a supervisory authority. As a rule, you can contact the supervisory authority at your usual place of residence or workplace or at our company headquarters. Please note that revoking consent does not affect the lawfulness of processing carried out before the revocation. Some data, such as billing records, may still be retained where required by legal obligations (e.g., tax or accounting laws).

14. Deletion of data

Your personal data will be deleted if there are no legal storage obligations to the contrary and if you have asserted a claim for deletion, if the data is no longer required to fulfill the purpose for which it was stored or if its storage is inadmissible for other legal reasons. All personal, usage and operational data is deleted upon deletion of the user account. We keep the billing data for seven years after the last purchase.

VM content is deleted when you delete the sandbox it is stored on, as described in section 4.4, and when your credit balance reaches zero, which deletes all of your sandboxes automatically as described in section 4.5. Deletion of VM content is irreversible and we hold no backup from which it could be restored.

Deleting your account. You can delete your account yourself at any time from the Settings page. You are asked to type your own email address to confirm, and the request is refused if it does not match the account you are signed in to. Because an account that still holds sandboxes cannot be removed until those machines are released, deletion runs in two stages: we delete every sandbox on the account first, then remove the account. Tearing down a sandbox takes several minutes and the progress of each machine is shown to you while it runs.

Deleting your account permanently removes your sandboxes and everything stored on them, your user profile and account information, your job history, provisioning logs and preferences, and any credits still on the account. If you close the browser while machines are still being deleted, the machines are removed anyway but the account is not: sign in again and repeat the request to finish it.

The single exception to this deletion is billing data. Invoices and payment records are kept for seven years after your last purchase because Austrian tax and accounting law requires it, and are used for no other purpose. You will receive confirmation of the deletion at your registered email address.

15. Right of objection

If your personal data are processed on the basis of legitimate interests, you have the right to object to the processing of your personal data, provided that there are reasons for this which arise from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right of objection, which we will implement without specifying a particular situation.
Contact Form.