Privacy Policy

Effective 21 October 2026 · see also Terms of Service
Datura AI Corp, a company incorporated in Saint Kitts and Nevis ("Lium", "we"), is the controller of the personal data collected through lium.io, the Provider Portal, the API, the CLI and SDK (the "Service"). Contact: support@lium.io.

1. What we collect and why

We collect what the Service needs to run, be paid, stay secure and be measured. Account and payment data are needed to open an account and rent; without them we cannot provide the Service.
  • Account: e-mail address, name and hashed password, or the identifier your GitHub, Google or Discord account shares when you sign in or connect it; API and SSH keys; notification settings, used to create and secure your account and to contact you about it.
  • Payments: card payments are processed by Stripe, which gives us a token, the card brand, type, issuing country, last four digits and fingerprint (to tell whether a card is used on another account) and the billing country (never the full card number); cryptocurrency top-ups are processed by our crypto payment processors, and we record the wallet address, network, transaction identifier and amount, used to take payment, keep the records the law requires and prevent fraud.
  • Usage and telemetry: what you rent, when pods start and stop, resource usage, API and CLI requests, balance and billing history, and, for providers, node hardware, network address, location and verification history, used to run, bill and verify the Service and to detect fraud and abuse. We do not read the contents of your pods or volumes.
  • Technical data: IP address and the country and network provider derived from it, browser, device type, language and time zone, a device identifier computed from browser characteristics and kept in your browser’s local storage, a one-way hash of your browser’s screen, graphics, time zone and drawing characteristics sent when you sign up or sign in, the sign-up route (browser, CLI, SDK, Google or GitHub), pages visited, referring page and campaign parameters, used to secure the Service, detect fraud, sign-up abuse and linked accounts, and measure where sign-ups come from.
  • Cookies and advertising identifiers: with your consent where the law requires it, Google Analytics 4 and Google Ads cookies and identifiers, used to measure how the site and our advertising perform (section 5).
  • Marketing: only if you turn on the Marketing choice in the cookie bar, RB2B identifies which companies visit our website and, for visitors in the United States, which people, for our sales team (section 5).

2. Legal bases, retention and sharing

Where the GDPR or UK GDPR applies, we process account, payment and usage data to perform our contract with you, technical and fraud data on our legitimate interest in keeping the Service secure, marketing cookies on your consent everywhere, analytics and advertising cookies on your consent in the European Economic Area, the United Kingdom and Switzerland and elsewhere on our legitimate interest in measuring the site and our advertising (section 5), and billing records to meet legal obligations.
We keep account data while your account exists and delete or anonymise it afterwards, billing and transaction records for as long as tax and accounting law requires, and technical data and telemetry only as long as needed to operate and secure the Service.
With your marketing consent, RB2B identifies visiting companies (and in the United States, people) for our sales team; you can withdraw that consent at any time. We share personal data with processors acting on our instructions: payment processors (Stripe and our crypto payment processors), hosting and infrastructure (Amazon Web Services), analytics and advertising (Google), sales (RB2B, with your marketing consent), transactional e-mail, error monitoring, and Discord where you connect it; with the provider of a node you rent to the limited extent needed to run your pod (never your identity), and with authorities where the law requires. Processors may be outside your country; where the GDPR requires it, transfers rest on standard contractual clauses.

3. Your rights

Depending on where you live, you may access, correct, delete, restrict or port your personal data, object to its processing, withdraw consent and complain to a data-protection authority. To exercise a right, e-mail support@lium.io from the address on your account; we answer within 30 days and may ask you to confirm your identity.

4. Children

The Service is not for anyone under 18; we do not knowingly collect children’s data.

5. Cookies and advertising

The Service sets a strictly necessary cookie that keeps you signed in, strictly necessary browser-storage entries (lium_partner_ref_v1 and lium_personal_ref_v1, up to 90 days) crediting the partner or person whose link brought you, a strictly necessary browser-storage entry (lium_device_id_v1, until you clear it) holding the fraud-prevention device identifier, Stripe’s fraud-prevention cookies when its payment script loads, and a first-party cookie (lium_consent) that remembers your cookie-bar choice for up to 180 days (seven on Safari). Google Analytics 4 (cookies such as _ga; Google’s policy: policies.google.com/privacy) measures which pages work and which Google Ads campaigns bring visitors; sign-up conversions go to Google Ads, never for personalized ads. Where the law requires consent (the European Economic Area, the United Kingdom and Switzerland) no analytics or advertising cookie is set until you accept in the cookie bar; elsewhere they are set unless you opt out. Change your choice at any time with the footer’s "Cookie settings" link or at lium.io/#cookie-settings, block cookies in your browser or install the Google Analytics opt-out add-on (tools.google.com/dlpage/gaoptout); declining has no effect on the Service.
Marketing is off unless you turn it on in the cookie bar, wherever you are. With it on, RB2B identifies which companies visit our website from data such as IP address, using cookies such as _reb2buid (up to 360 days), and for visitors in the United States it may also identify the individual visitor; it passes this to our sales team. Turn it off at any time with "Cookie settings", or opt out at app.retention.com/optout.

6. AI assistants and MCP connectors

Our MCP server at docs.lium.io/mcp lets AI assistants search our documentation and GPU prices without signing in; used without an API key, it receives no account data. If an assistant sends a valid API key, at docs.lium.io/mcp or docs.lium.io/mcp/account, the server also returns data from that key’s account, such as its balance, as described below.
When you connect an assistant such as ChatGPT or Claude at docs.lium.io/mcp/account and approve "Sign in with Lium" on lium.io, or give it an API key yourself at either address, the assistant uses an API key on your account; a sign-in key is named after the assistant and expires, and has the same access as a lium CLI login across your whole account: it can see and manage all your pods, rent new ones (which spends your balance), read your templates, volumes, SSH keys, spending and account activity, and change your templates, volumes, SSH keys and backup schedules. It can also start a crypto top-up request (a TAO transfer or TMC Pay invoice), which still has to be paid from your own wallet, but it cannot charge your card, change auto top-up or transfer credits. The MCP server receives the requests and inputs the assistant sends, and returns the account and pod data needed to answer, such as your balance, pods and templates. With "Sign in with Lium", the assistant receives the key itself so it can authenticate, and can use it directly; the MCP server does not log the key or include it in tool results. Actions such as renting or removing a pod appear in your Activity log with the source MCP. To disconnect, delete the key at lium.io/api-keys; to cap spending, give it a spend budget. What you share with the assistant is governed by its provider’s privacy policy.

7. Governing law, changes and contact

This Policy is governed by the laws of Saint Kitts and Nevis, without prejudice to the rights the data-protection law of your country gives you. We may update it; the current version and its date are on this page, and material changes are announced to account holders before they take effect. Contact: support@lium.io.
For AI agents (CLI install, agent skill, headless signup): llms-full.txt