1. Who we are
Distributive Corp. ("Distributive", "we") is a Canadian company that operates the Distributive Compute Platform ("DCP"): the DCP Scheduler, Bank, and Portal, the DCP Worker software, and this website. Our registered office is 303 Bagot Street, Suite 403, Kingston, Ontario, Canada K7K 5W7. Questions about this policy go to privacy@distributive.network.
2. What this policy covers
This policy explains what personal data Distributive collects when you use DCP or this website, why, who sees it, where it is kept, how long, and what your rights are.
Two things it does not cover:
- The content of Jobs. Whoever deploys a Job decides what is in it and is responsible for it. Section 5 explains how Distributive handles Job content without being responsible for it.
- Licensee platforms. Some organizations operate their own branded version of DCP under license from Distributive. If you use DCP through one of them, that organization's own privacy policy also applies to your relationship with it, and it is responsible for the data it collects from you. This policy covers what reaches Distributive.
3. What we collect
Account data. Name, email address, and DCP login identifier, held in Distributive's account system. The Portal itself holds your wallet address, login history, and the encrypted key material you create. We never hold your passphrase.
Authentication and usage records. Each login, Worker registration, and key creation records your IP address, browser user agent, and referring page. Our service logs record IP addresses, account and Worker identifiers, Job and slice identifiers, timings, data sizes, and Compute Credit amounts. They never record Job content.
Worker telemetry. A machine running a DCP Worker reports its hardware and performance (CPU, GPU, memory, cores, operating system, benchmarks, reliability), its hostname, the username the Worker runs under, its MAC address and local network address, and the account that receives its earnings. Where the machine is a person's own device, some of this identifies that person. You can set the hostname label to a non-identifying value.
Job metadata. The name, description, and link a deployer gives a Job, and its timing, slice counts, and data sizes. Free-text fields are set by the deployer and may contain whatever the deployer types.
Payment records. When you buy Compute Credits through the Portal, Braintree and PayPal process the payment and hold your card or account details. We receive transaction identifiers, amounts, and dates. We do not hold card numbers, bank account numbers, or security codes.
Website analytics. With your consent, given through the cookie banner, Google Analytics records pages viewed, visit duration, and the source of your visit. If you decline, no analytics cookie is set and only the essential cookies needed to run the site are used.
Correspondence. What you send us by email, support request, or form, and our replies.
4. Why we use it
- To provide DCP: to run your account, schedule and return Jobs, register and pay Workers, and bill you. Basis: our contract with you.
- To keep DCP secure and working: to authenticate you, detect abuse and fraud, investigate reports under our acceptable use policies, and diagnose faults. Basis: our legitimate interest in operating a secure platform, and in some cases our legal obligations.
- To meet legal obligations: tax and accounting records, responding to lawful requests, and reporting illegal content where the law requires it.
- To improve the site: analytics, only with your consent.
We do not sell personal data, use it for advertising, or use it to train models.
5. Job content
A Job's input data, code, arguments, and results are the deployer's. The deployer is the controller of any personal data in them and must comply with our Job Deployer Acceptable Use Policy and, where personal data is involved, a data processing agreement.
Distributive handles Job content in one of two ways, chosen by the deployer in its own code:
- Scheduler-routed: the content passes through and is stored on Distributive's Scheduler until it is executed and the results are retrieved. Distributive does not inspect it. Access to the underlying systems is restricted to named administrators and is not used to read Job content.
- Direct routing: the content moves directly between the deployer's own systems and the Workers and never reaches Distributive.
Scheduler-routed Job content is deleted once the deployer's purpose is complete: when results are retrieved or at the end of our published retention schedule, whichever comes first, and on request at any time. Automated deletion applies from 1 January 2027; until then deletion is performed on a monthly schedule and on request.
Workers execute Job content in a sandbox that isolates it from other Jobs and from the host machine's own data. The operator of a Worker machine can technically access what runs on it and is bound by our Worker Acceptable Use Policy not to.
6. Who we share it with
- eStruxture Data Centers, which houses the servers Distributive owns and operates in Toronto. eStruxture has physical custody of the equipment and no access to the data on it.
- Braintree and PayPal, for payments, under their own privacy policies: PayPal privacy statement, Braintree privacy policy.
- Google, for website analytics, only with your consent: Google privacy policy.
- Licensees, where you use DCP through their platform: they see the account, usage, and telemetry data relating to their own users and Workers.
- Authorities, where the law requires or permits disclosure, or where it is necessary to protect people or Distributive's rights.
- A successor, if Distributive is sold, merged, or reorganized, in which case this policy continues to apply to your data.
7. Where your data is kept
Distributive's systems run in Canada, at a colocation facility in Toronto, Ontario. If you are in the United Kingdom or the European Economic Area, your data is transferred to Canada under the adequacy decisions that cover Canadian commercial organizations. Workers run wherever their operators are; Job content sent to a Worker goes to that Worker's location, which the deployer chooses when it selects a Compute Group.
8. How long we keep it
- Account data: while your account exists and for 12 months after it is closed.
- Authentication and service logs: 12 months.
- Worker telemetry: while the Worker is registered and for 12 months after it is last seen.
- Job metadata: 12 months after the Job completes.
- Job content: as section 5 describes.
- Payment records: 7 years, as tax law requires.
- Correspondence: 3 years.
Backups are retained for 30 days and then overwritten.
9. How we protect it
- All traffic between you, your Workers, and Distributive is encrypted in transit with TLS.
- Our servers are our own, in a locked cage at a facility certified to ISO 27001 and SOC 2. Administrative access is limited to named staff using key-based authentication, and the databases are not reachable from the internet.
- Authentication is signature-based; we never store passwords.
- The Worker software and our platform are independently penetration tested, and security patches are released promptly.
- Access to Job content and personal data by staff is restricted to what is needed to operate and support the service.
No system is perfectly secure. If a breach affects your personal data, we will tell affected customers without undue delay and notify regulators where the law requires.
10. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, have it deleted, restrict or object to how we use it, receive a copy in a portable form, and withdraw consent for analytics at any time through the cookie banner. To exercise a right, email privacy@distributive.network. We may ask you to verify your identity. We respond within 30 days. If you are not satisfied, you may complain to the privacy regulator where you live; in Canada that is the Office of the Privacy Commissioner, in the United Kingdom the Information Commissioner's Office, and in the European Economic Area your national data protection authority.
11. Children
DCP accounts are for adults and organizations; we do not knowingly collect personal data from anyone under 16 through an account. Workers may run on devices in schools under the responsibility of the school or its technology provider; the telemetry those Workers report is about the device, not about the people who use it.
12. Changes
We may update this policy. Material changes are announced on this page and through the Portal 30 days before they take effect. The effective date at the top tells you which version applies.
13. Contact
- Privacy: privacy@distributive.network
- Abuse and policy violations: abuse@distributive.network
- Security: ops@distributive.network
- Mail: Distributive Corp., 303 Bagot Street, Suite 403, Kingston, Ontario, Canada K7K 5W7
This policy is governed by the laws of Ontario and Canada.