How We Process Your Data

This notice applies when you visit oakvm.com, use the OakVM console, create or manage an account, choose a cloud Mac plan, place an order, receive a dedicated Apple Silicon physical node, or contact us through support email or a console ticket.

Project files, build caches, certificates, provisioning profiles, keys, and build artifacts on your node are organized and managed by you. Renting a node does not give us ownership of this content; we process related data only when necessary to deliver the service, handle support materials you explicitly submit, protect service security, or meet legal obligations, and only within a limited scope.

Current version:This notice takes effect on August 22, 2026, and replaces the previous notice covering the same processing scope. The effective date at the top of the page identifies the version you are reading.

We collect only the minimum data needed to complete specific service steps. Because users access different features, not every category below will be generated for every user.

Account information

Email address used for registration, sign-in, and contact; account identifier, verification status, security settings, and account activity records. We do not ask you to submit node credentials on public pages.

Order records

The selected OakVM M4 or OakVM M4 Pro, rental term, node region, additional storage, Thunderbolt 5 parallel-connection option, order status, amount, creation time, and task ID.

Payment status

Payment method category, currency, amount due, payment status, transaction identifier, and limited information needed for reconciliation. OakVM does not store full card numbers or security codes.

Device and access logs

IP address, browser and device type, request time, page or API path, session identifier, sign-in result, error code, and request context needed for security analysis.

Node activity records

Node region, device identifier, delivery and return status, credential-generation status, connection events, resource anomalies, and technical records related to task isolation.

Support requests

Issue description, time of occurrence, task ID, node region, sanitized logs or screenshots you provide, and reply, escalation, resolution, and closure records.

Information you choose to submit

Team size, target systems, concurrent tasks, Xcode requirements, preferred region, and other context you choose to provide during purchasing or migration consultations.

We do not arbitrarily extend the use of collected data to purposes unrelated to the original context. Every processing activity must address a specific need connected with service delivery, security, a user request, or a legal obligation.

When processing is necessary to fulfill an order, protect account and node security, respond to a user request, or comply with the laws of the jurisdiction where the platform operator is based, we limit data to what is needed for that purpose. If a materially different new purpose arises, we will provide appropriate notice before beginning the relevant processing.

OakVM orders are settled exclusively in USD. Available payment methods are limited to USDT-TRC20 and Visa / Mastercard / Amex (via Stripe). Actual gateway availability is determined by the result returned by the console at checkout.

Payment service providers receive the data necessary for the payment-processing responsibilities they perform. We share only the fields needed to initiate the transaction, return results, perform risk controls, and reconcile payments; payment processing does not give them access to project content on nodes.

There is no single fixed retention period for all data. We assess retention separately based on whether an account remains active, obligations for orders and transactions, security risks, support-request status, and dispute-handling needs, then delete, anonymize, or restrictively archive data when its purpose is complete.

How safeguards work in practice

• Least privilege:Internal access is assigned by role; the ability to access a system does not automatically grant permission to view every account or support material.
• Transmission protection:The website, console, and service interfaces transmit data over encrypted connections, reducing the risk of interception or tampering in transit.
• Task isolation:Orders, nodes, and support records are linked by identifiers; troubleshooting personnel should access only the data needed to complete the current task.
• Log controls:Security logs are used to identify anomalies and reconstruct incidents, not to publicly display user activity.
• End-of-life handling:Deletion workflows cover online records, attachments, and logs entering the rotation cycle; records that must be retained by law are subject to restricted use and access.

Every safeguard also depends on your cooperation. Keep console and node credentials secure, limit team-member access, and maintain separate backup and offboarding-cleanup procedures for code, certificates, provisioning profiles, keys, and build artifacts.

To operate the website, verify accounts, host physical nodes, settle orders, and respond to support requests, OakVM may use service providers that perform specific functions. These providers may process data only as needed for their assigned duties and must be bound by contractual, confidentiality, security, and purpose limitations.

When you choose a node in Singapore, Japan (Tokyo), South Korea (Seoul), Hong Kong, the US East, or the US West, necessary data related to node assignment, connection, and support may be processed in the relevant region or in the region where support collaboration takes place. Cross-regional processing does not change the purpose of the data, and selecting a node does not automatically mean you consent to unrelated uses.

When cross-regional transfers are required, we apply appropriate safeguards based on the data category, the recipient’s role, and applicable requirements, including access restrictions, encrypted transmission, contractual controls, record reviews, and other suitable measures. If a service provider no longer performs the relevant function, we stop providing data needed for further processing and handle the materials it holds as agreed.

To the extent permitted by applicable rules, you may ask us to confirm whether we process data about you and request an access copy, correction of inaccurate information, deletion of data no longer needed, restriction of specific processing, or export of available account and order data.

1. 01

   Choose a request channel

   Email support@oakvm.com from the email address associated with your account, or sign in to the console and submit a ticket. If you have an account, a console ticket is usually easier for verifying its connection to your account and orders.

2. 02

   Describe the scope

   State the request type, associated account email, order or task ID, data involved, and desired outcome. Do not include passwords, private keys, or complete payment credentials in an email or ticket.

3. 03

   Complete identity verification

   To prevent impersonation, we may verify your identity using account status, email verification, order information, or another method proportionate to the risk. We collect only the information needed for the current request.

4. 04

   Receive the result

   We will explain the actions taken, the data we can provide, and any information that cannot be immediately deleted or disclosed because of order-record obligations, security incidents, other people’s rights, or legal obligations.

A deletion request does not necessarily remove every record immediately. Data still needed to fulfill an incomplete order, resolve a payment dispute, protect account security, or meet a legal obligation may be retained with restricted use; deletion or de-identification will occur when the relevant basis ends.

We may update this notice when the service scope, data categories, processing purposes, service-provider responsibilities, or applicable requirements change. New versions will show an effective date on this page. If a change materially affects user rights or how data is used, we will provide prominent notice through an in-account message, contact details associated with the account, or another appropriate method.

An update does not automatically extend the use of collected data to purposes unrelated to the original purpose. If new processing requires additional notice or a user choice, we will complete the relevant steps before starting it.

Questions about this notice, privacy-rights requests, or formal communications may be submitted through either channel above. Disputes concerning privacy processing are governed by the laws of the jurisdiction where the platform operator is based and will be handled by courts with jurisdiction in that jurisdiction.