1. Who we are
Lounge Fleet, LLC d/b/a Fillrate operates fillrate.net and the host console. We run managed marketplace operations for Vast.ai GPU hosts. Contact: [email protected]
2. Who this covers
This policy covers the console, the desk, and the marketing site. Fillrate is a business service for GPU host operators. The service is currently available to customers in the United States only, and we do not knowingly offer it elsewhere.
3. What we collect
Account data. Email, password hash, optional display name, verification and reset tokens, and your Terms of Service acceptance timestamp and version.
Vast keys. If you paste a Vast.ai API key in Settings, we encrypt it before it is stored. Only the last four characters display after saving.
Host access secrets. SSH private keys and similar credentials are encrypted at rest. We store host, port, username, optional notes, and key fingerprints — not raw keys in readable form.
Ops data. Fleet state, machine occupancy, listing fields, earnings, floors, managed-machine flags, and commercial terms.
Billing data. Payment method and billing identifiers that Stripe, Inc., our payment processor, associates with your account — including Stripe customer and subscription identifiers, billing contact details, the brand and last four digits of a card or the last four digits of a bank account, charge history, amounts, and tax information. Full card and bank account numbers go to Stripe, Inc. and are never stored by Fillrate.
Review requests. If you submit the fleet review form on our site, we collect the name, email, company, marketplace, fleet description, and notes you enter. We use this to reply to you and assess fit. You do not need an account to submit one, and submitting does not grant us access to anything.
Support and correspondence. Emails and messages you send us.
Session and site basics. HttpOnly session cookies for sign-in, and basic security and error logs including IP address. The marketing site does not run an advertising pixel or a cross-site tracker.
4. How we use it
We use this information to:
- Create and secure your account, and run the console and the desk.
- Operate your managed listings and report on fleet earnings and occupancy.
- Send transactional email — service notices, trial-expiry notices, charge receipts, and security alerts.
- Charge your subscription and handle billing questions.
- Detect, investigate, and prevent abuse, fraud, and security incidents.
- Meet legal, tax, and accounting obligations.
- Improve the service, and produce the aggregated benchmarks described in Section 5.
We do not use your fleet data to create testimonials or to publish your individual earnings.
5. Aggregated benchmarks
Running a pricing desk requires knowing what the market is doing. We combine operational data across hosts to produce aggregated, de-identified benchmarks and market statistics — for example, median earnings per GPU-day by GPU model, occupancy ranges, and time-to-fill distributions. We use these to run the desk for all customers and to price listings against current market conditions, and we may publish or share them.
Our commitments on this:
- Aggregated output does not identify you, your account, your machines, or your fleet.
- We do not publish a data point unless it combines data from at least 5 distinct hosts.
- We do not attempt to re-identify any host from aggregated data, and we require the same of anyone we share it with.
- We do not publish or share your individual, host-level numbers.
6. Where it is stored and who sees it
Data is stored in Cloudflare D1. Transactional email is sent through Resend. Payments are processed by Stripe, Inc., our payment processor and a subprocessor. Stripe receives your payment method and billing identifiers and handles them under its own terms and privacy policy. Vast.ai processes API requests independently under its own terms and privacy policy.
Inside Fillrate, desk staff access account, credential, and operations data only as needed to do the work, to respond to a security incident, or as you direct. Access to stored credentials is restricted and logged.
Subprocessors that process personal information for this service are named in this policy. Stripe, Inc. is the payment processor. Other subprocessors (including Cloudflare for storage and Resend for email) are listed here. We will also provide the current list on request at [email protected], and we will give notice in the console before adding a new subprocessor that processes your data.
7. How we protect it
We encrypt Vast API keys and host secrets at rest, use encrypted transport, restrict and log access to credentials, and use HttpOnly session cookies. No system is perfectly secure, and we do not promise that ours is.
Breach notification. If we become aware of a breach affecting your credentials or personal information, we will notify you by email without undue delay and in any case within 72 hours of confirming it, and tell you what we know and what we are doing about it.
8. We do not sell personal information
Lounge Fleet, LLC d/b/a Fillrate does not sell your personal information, and does not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months. Aggregated, de-identified benchmark data under Section 5 is not personal information and is not covered by this statement.
9. How long we keep it
- Account and billing records: for the life of the account and for 7 years afterward, for tax, accounting, and legal purposes.
- Vast API keys and host secrets: until you revoke or delete them, and in any case deleted within 30 days of the account closing.
- Ops data: for the life of the account and up to 24 months afterward, for billing verification and dispute resolution.
- Security and error logs: up to 12 months.
- Session cookies: expire after approximately seven days of inactivity.
- Aggregated benchmark data: kept indefinitely, since it no longer identifies you.
10. Your choices and rights
You can revoke credentials and change your password in the console. Payment methods are managed in the console, or through Stripe, Inc.’s customer portal when that portal is available. To export ops data or close your account, email [email protected].
As a U.S. customer, you may ask us to:
- Know what personal information we hold about you and how we use it.
- Access a copy of it.
- Correct it if it is wrong.
- Delete it, subject to records we must keep for billing, tax, security, or legal reasons.
We will not discriminate against you for exercising these rights. We respond within 45 days and will tell you if we need longer. We may need to verify your identity against your account email before acting.
California residents have these rights under the CCPA/CPRA, including the right to know the categories of personal information collected, the purposes, and the categories of third parties we disclose to — all set out in Sections 3, 4, and 6 above. You may use an authorized agent; we will ask for proof of authority.
11. Children
The console is for operators of GPU hosts. The service requires you to be at least 18, and we do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it.
12. Changes
We post policy updates with a version date. For material changes, we will notify you by email and in the console at least 30 days before they take effect.
13. Contact
Lounge Fleet, LLC d/b/a Fillrate
[email protected]
fillrate.net