Legal · Privacy
Privacy Policy
Last updated: October 26, 2026
This Privacy Policy explains what personal data Lancekey Advising LLC ("ComputePrices", "we", "us", "our") collects when you use computeprices.com, its accounts, paid plans, email updates and API (the "Services"), why we collect it, who we share it with, and the choices and rights you have. Terms not defined here have the meaning given in our Terms of Service.
Most of what ComputePrices publishes is not personal data: it is prices, GPU and model specifications, and information about companies. This policy covers the personal data we do handle.
Who we are
Lancekey Advising LLC, a New York limited liability company, operates ComputePrices and is the controller of the personal data described in this policy. Contact us about privacy at hi@computeprices.com.
We have not appointed a data protection officer or an EU or UK representative. Our processing is not large-scale monitoring or special-category processing, so neither is currently required.
What we collect
When you browse the site
You can use the site without an account. When you do, we and our service providers collect:
- Usage events: pages viewed, links and buttons clicked (including clicks out to provider sites), searches typed into site search, the page section a click came from, time on page, and the referring page and campaign tags.
- Device and connection data: IP address, browser, operating system, device type, screen size, language, and approximate location (country and city) derived from the IP address.
- Performance and error data: page load and Core Web Vitals timings, and details of errors the site hits in your browser, which can include the page URL.
We collect this with PostHog (product analytics) and Vercel Web Analytics and Speed Insights. None of them set cookies or store anything in your browser. PostHog counts visitors by a hash of the date, IP address and browser that changes every day, so it cannot recognize your browser from one day to the next. Our hosting and rate-limiting providers also log IP addresses and request details to deliver and protect the site. We do not record sessions or keystrokes.
When you create an account
We use magic-link sign-in, so we collect your email address and the times you sign in. We do not ask for or store a password. When you sign in to manage API keys or a subscription, we link the analytics events from that page visit to your email address so we can understand how account holders use the product and help when something goes wrong.
When you use the API
We store a hash of your API key (never the key itself), its name, tier and expiry, and record request metadata for each call: key ID, endpoint, parameters, time, response status, IP address and user agent. We use it for authentication, rate limiting, abuse prevention, support and usage analytics.
When you buy a Paid Plan
Stripe collects your payment details and billing address directly. We receive and store your Stripe customer ID, email address, plan, billing interval, subscription status and dates. We never see or store your full card number.
When you subscribe to email updates
We store your email address, optionally your name, where you signed up, and your subscription status. We log the emails we send you (type, time, delivery status).
When you submit, claim or edit a provider listing
We collect the submitter's email address, the IP address the submission came from, and the information submitted: company name, website, pricing pages, pricing API URL, and company details such as legal name, headquarters, registration number and public contact address. For claims and profile edits we keep a log of which account changed which field and when.
Company details are published on the provider's page because they identify the business. Your own submitter email is never published. A public contact address is published only if you enter it in that field.
When you report a price, send feedback or ask for help sourcing GPUs
- Community reports: the report and the IP address it came from (used to limit abuse). Reports do not ask for your name or email.
- Feedback: your reaction, comments, the page, and your email address if you choose to give it.
- Sourcing requests: company, contact name, email address, the requirement you describe, and the IP address the request came from.
When you email us
Your email address, name, message and any attachments. Mail sent to our inbound addresses passes through Resend and is delivered to our Google Workspace inbox.
What we don't collect
We do not knowingly collect sensitive data such as health, biometric or government ID data, or data revealing racial or ethnic origin, political opinions, religious beliefs or trade union membership. Please do not send it to us.
How we use it and our legal bases
If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, data protection law requires a legal basis for each use. We rely on the following.
| Purpose | Data | Legal basis |
|---|---|---|
| Running the site and delivering pages | Device and connection data | Legitimate interests in providing the site you asked for |
| Accounts, API access and Paid Plans | Account, API, billing data | Performance of a contract with you |
| Rate limiting, security and abuse prevention | IP addresses, API metadata, submission and report IPs | Legitimate interests in keeping the Services, their data and users safe |
| Product analytics and improving the site | Usage events, device data, account email on signed-in pages | Legitimate interests in understanding how the site is used, with cookieless measurement that cannot follow you across days |
| Error monitoring and performance | Performance and error data | Legitimate interests in finding and fixing faults |
| Email updates | Newsletter data | Consent, which you can withdraw with the unsubscribe link in every email |
| Service emails (sign-in links, trial reminders, receipts, provider alerts you turned on) | Account and billing data | Performance of a contract |
| Reviewing and publishing provider listings | Submission and company data | Legitimate interests in running an accurate comparison service; contract, for providers who claim a listing |
| Answering reports, feedback, sourcing requests and email | What you sent us | Legitimate interests in responding to you; steps you asked us to take before a contract |
| Tax, accounting and legal compliance | Billing data | Legal obligation |
| Enforcing our Terms and defending claims | Any relevant data | Legitimate interests in protecting our rights |
We do not sell your personal data, share it for cross-context behavioral advertising, or use it to make decisions about you that have legal or similarly significant effects. We do not use your personal data to train AI models.
Who we share it with
We share personal data with the service providers below, who process it on our behalf under contracts that limit their use of it, and otherwise only as this section describes.
| Provider | What they do for us | Location |
|---|---|---|
| Vercel Inc. | Website hosting, CDN, web analytics, performance monitoring | United States, global edge |
| Supabase Inc. | Database and sign-in | United States |
| Stripe, Inc. | Payments, invoices and the billing portal | United States, Ireland |
| PostHog Inc. | Product analytics and error tracking | United States |
| Upstash Inc. | Rate limiting (IP addresses and API key IDs) | United States |
| Resend (Plus Five Five, Inc.) | Sending and receiving email | United States |
| Google LLC (Google Workspace) | Our email inbox | United States |
| Anthropic PBC | AI processing of provider listing submissions (company website and pricing pages) and of public pricing data | United States |
| Firecrawl and Browserless | Fetching public provider web pages, including a submitted website | United States |
| Discord Inc. | Internal notifications to our team about submissions, reports and feedback, which can include a submitter's or feedback sender's email | United States |
We also share personal data:
- With providers, only when you ask us to. We do not give a provider your sourcing request, report or contact details without your permission.
- For legal reasons, where the law, a court order or a valid government request requires it, or where it is needed to protect the rights, safety or property of our users, the public or us.
- In a business transfer, as part of a merger, acquisition, financing or sale of assets, subject to this policy.
Cookies and browser storage
| Name | Set by | Purpose | Type |
|---|---|---|---|
sb-* | Supabase | Keeps you signed in | Strictly necessary |
__stripe_* | Stripe, on checkout and billing pages | Fraud prevention for payments | Strictly necessary |
| Theme preference | ComputePrices, local storage | Remembers light or dark mode | Functional |
We use no analytics or advertising cookies, so we do not show a cookie banner. You can still block our analytics with a tracker blocker, and the site works without it. Blocking strictly necessary cookies stops sign-in from working. We do not currently respond to browser "Do Not Track" signals. Because we do not sell or share personal data for advertising, a Global Privacy Control signal changes nothing about how we process your data.
International transfers
We are based in the United States, and our service providers process data mainly in the United States. If you are in the EEA, UK or Switzerland, your data is transferred to the United States under the European Commission's standard contractual clauses (with the UK addendum and Swiss amendments) or, where the provider is certified, the EU-US Data Privacy Framework and its UK and Swiss extensions. Contact us for details of the safeguard for a particular transfer.
How long we keep it
| Data | Kept |
|---|---|
| Account data | While your account is open, and deleted on request after that |
| API keys and request metadata | While the key is active; revoked keys are kept as records of past access |
| Billing records | As long as tax and accounting law requires, generally seven years |
| Email update subscribers | Until you unsubscribe; we keep the address on a suppression list so we don't email you again |
| Listing submissions and edit logs | While the listing exists, and as long as needed afterward to resolve disputes |
| Community reports, feedback and sourcing requests | As long as needed to act on them, and deleted on request |
| Analytics events | Under PostHog's retention settings for our plan |
| Correspondence | As long as needed to deal with the matter |
When we no longer need personal data, we delete it or remove what identifies you. Copies can persist in backups until those backups expire.
Your rights
EEA, UK and Switzerland
Subject to the conditions in the law, you have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate or incomplete data;
- have your data erased;
- restrict how we process it;
- receive data you gave us in a portable format;
- object to processing based on legitimate interests, including analytics;
- withdraw consent at any time, without affecting processing before you withdrew;
- complain to a supervisory authority, in particular in the country where you live or work. In the UK that is the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner. Authorities in the EEA are listed by the European Data Protection Board.
United States
Depending on your state (including California, Colorado, Connecticut, Virginia, Texas and others with comprehensive privacy laws), you may have the right to know what personal data we collect, use and disclose; to access and get a copy of it; to correct it; to delete it; and to opt out of its sale, of targeted advertising and of profiling. We do not sell personal data or use it for targeted advertising or profiling, so there is nothing to opt out of. We will not discriminate against you for exercising your rights. You may use an authorized agent to make a request on your behalf.
For California residents, the categories of personal information we collected in the past 12 months are: identifiers (email, IP address, API key ID), commercial information (Paid Plans bought), internet activity (usage events), approximate geolocation, and professional information (company details in listing submissions and sourcing requests). The sources, purposes and recipients are described above. We disclosed these categories only to the service providers listed above, for business purposes.
Making a request
Email hi@computeprices.com from the address the request concerns. We may ask for more information to verify your identity. We answer within the time the law requires, normally one month (45 days under US state laws). If we decline a request, we will say why and how to appeal, and you may contact your state attorney general if you disagree with the appeal decision.
You can also unsubscribe from email updates with the link in any email, and delete API keys and manage subscriptions from your account.
Security
We protect personal data with measures suited to the risk, including encryption in transit, hashed API keys, passwordless sign-in, access controls that keep personal data (such as submitter emails and request IPs) out of public database reads, row-level security, and limited staff access. No service is completely secure, and we cannot guarantee that a breach will never happen. If one affects your personal data, we will notify you and the relevant authorities as the law requires.
Children
The Services are for adults working with cloud computing and are not directed at children. You must be at least 18 to create an account or submit information. We do not knowingly collect personal data from anyone under 18. If you think we have, email us and we will delete it.
Changes to this policy
We may update this policy as the Services change. For a material change, we will email account holders and post a notice on the site before it takes effect. The date at the top shows the latest version.
Contact
Lancekey Advising LLC, operator of ComputePrices. Email hi@computeprices.com.