Legal · Privacy

Privacy policy.

How Malibu collects, uses, and protects personal data across malibu.tech, the console, the provider app, and community channels.

Last updated July 21, 2026

Effective July 21, 2026

01Introduction

Malibu (“Malibu,” “we,” “us,” or “our”) is operated by Superposition Technologies Pte. Ltd., a Singapore private limited company (UEN 201721187N) and the data controller for the personal information described in this Privacy Policy. You can reach us at team@malibu.tech or at 3 Fraser Street, #04-23A, Duo Tower, Singapore 189352. This Privacy Policy describes how we collect, use, disclose, and protect personal data in connection with our online interfaces and activities, including:

The informational website at malibu.tech and its subdomains
The Malibu console at console.malibu.tech
The Malibu provider desktop application for macOS
Community communication channels administered by Malibu, including forums, GitHub Discussions, and messaging platforms
Analytics, support, and technical tools associated with the foregoing (collectively, the “Services”)

This Privacy Policy does not apply to third-party websites, public blockchain networks not controlled by Malibu, or activities conducted entirely outside the Services.

02Important notice regarding blockchain technology

Transactions conducted on public blockchain networks are public, immutable, and irreversible.

When you interact with the Services — for example by verifying an inference receipt on-chain, or (once available) paying for inference in USDC or receiving $MALIBU rewards as a provider — certain information may be recorded on a public blockchain, including:

Wallet addresses and public blockchain identifiers
Transaction hashes, receipts, and related metadata
Timestamps and protocol-level interaction data

Malibu does not control public blockchain networks and cannot modify, obscure, anonymize, or delete information recorded on-chain. Any personal data written to a public blockchain or otherwise disclosed through on-chain activity may remain permanently accessible and may be processed by third parties outside Malibu’s control.

This Privacy Policy applies only to personal data collected off-chain through the Services. It does not apply to information publicly available on blockchain networks.

03Personal data we collect

(a) Information you provide voluntarily

Email address or other contact information you choose to provide
Content you submit through forms, email, support requests, or community platforms
GitHub account information (such as username, email address, and avatar) if you sign in to the console with GitHub OAuth
Community usernames, profile information, or other content you voluntarily disclose in Malibu-administered forums

(b) Blockchain-related information

Public wallet addresses you connect to the Services
Transaction hashes and other publicly available blockchain data associated with those wallets
Receipts, refunds, and settlement metadata connected to inference activity

Malibu does not control how public blockchain data is recorded, displayed, or indexed. Malibu does not associate wallet addresses with real-world identities unless such information is voluntarily provided by you.

(c) Service usage information

For buyers, we may process:

API keys, daily-quota consumption, and usage history. Prepaid credit balances and USDC top-up history are on the roadmap; when they become available we will process the same billing information about them.
Prompt routing metadata (such as the model requested, token counts, response latency, and provider assignment)
Prompt inputs and model outputs, in transit through Malibu’s gateway and coordinator, for the purposes of routing your request, metering usage, settling payments, and verifying inference receipts. Prompt content is also processed as plaintext by the independent provider selected to serve your request (see Section 07). Beyond what is needed for these purposes, and beyond what you explicitly save in the console, Malibu does not retain prompt content or model outputs.
Console session state, feature usage, and support interactions

The Services are not private-inference infrastructure. Buyer prompts and model outputs are processed as plaintext on independent provider hardware, and providers can technically observe what routes through their machine. Do not submit content you would not share with an independent provider. A self-hosted coordinator for buyers who need local-only trust is on the roadmap.

For providers running the Malibu Mac application, we may process:

The public wallet address used to receive earnings
Hardware and OS characteristics your node reports (such as chip family, memory, and macOS version) for scheduling and eligibility
Uptime, latency, throughput, and other node-performance metadata
Verification data submitted for verified-model settlement

(d) Automatically collected information

When you access the Services, we may automatically collect:

IP address
Browser type and version
Operating system
Device identifiers
Pages viewed and interaction data
Referring URLs and timestamps

(e) Aggregated or de-identified information

We may create aggregated or de-identified information for analytical and operational purposes. Such information does not identify, and cannot reasonably be used to identify, an individual.

04Information we do not collect

Malibu does not intentionally collect:

Government-issued identification numbers
Social Security numbers
Payment card or bank account information
Biometric identifiers
Precise geolocation data
Health or medical information

The Services are non-custodial with respect to your crypto assets. Fiat top-ups, where offered, are handled by third-party payment processors; Malibu does not itself store card or bank data.

05How we use personal data

We use personal data for the following purposes:

To operate, maintain, and improve the Services
To route inference requests, meter usage, and settle payments between buyers and providers under the currently live billing model, and under any additional payment rails (such as prepaid credits and USDC top-ups) when those become available
To distribute $MALIBU rewards to providers once on-chain $MALIBU emission is live (currently planned; not yet in production)
To respond to inquiries and communications
To monitor, analyze, and improve system performance and security
To prevent fraud, abuse, and unauthorized activity
To comply with applicable legal and regulatory obligations

Malibu does not use personal data for targeted advertising.

06Cookies and analytics

If we introduce non-essential cookies or similar technologies in the future, we will update this section, provide notice, and (where required by applicable law) obtain your consent before setting them.

You may disable cookies through your browser settings. Certain features of the Services may not function properly if you do.

07How we share information

Personal data may be disclosed:

To the independent Mac provider selected to serve your inference request. Prompt inputs and model outputs pass through the provider’s hardware in plaintext for the purpose of generating and returning results. Providers can technically observe the prompts and outputs that route through their machine.
To service providers that support hosting, analytics, security, communications, or infrastructure
To professional advisors, including legal and accounting firms
To comply with applicable law, regulation, subpoena, or legal process
To protect the rights, safety, and integrity of Malibu, our contributors, users, or others

Malibu does not sell personal data. Malibu does not share personal data for cross-context behavioral advertising.

08Data retention

We retain personal data only for as long as reasonably necessary to:

Fulfill the purposes described in this Privacy Policy
Comply with applicable legal obligations
Resolve disputes
Enforce agreements

Public blockchain data is retained indefinitely by the applicable blockchain networks and is not subject to our retention controls.

09Your privacy rights

Depending on your jurisdiction, you may have certain rights regarding personal data we process, including the right to:

Request access to personal data we maintain about you
Request correction of inaccurate personal data
Request deletion of certain personal data
Opt out of certain data-processing activities, where applicable

These rights may not apply to:

Publicly available blockchain data
Information that Malibu does not control
Information required for legal or regulatory compliance
Data necessary to maintain the security or functionality of the Services

Requests may be submitted using the contact information provided below.

10Children’s information

The Services are not intended for individuals under the age of 18. Malibu does not knowingly collect personal data from children.

11Data security

We implement reasonable administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, disclosure, alteration, or destruction. These safeguards are intended to reflect the nature of the Services and the categories of personal data we process.

However, no system, network, or method of electronic transmission is completely secure. While we seek to protect personal data, we cannot guarantee its absolute security, particularly where information is transmitted over the internet or interacts with decentralized networks beyond Malibu’s control.

12Global data processing

The Services rely on globally distributed infrastructure and service providers. As a result, personal data processed in connection with the Services may be transferred to, stored in, or accessed from jurisdictions with data-protection laws that may differ from those of your home jurisdiction. By accessing the Services, you acknowledge that such cross-border processing may occur.

13Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the effective date of the current version. For material changes, we will provide reasonable notice through the console, the provider app, or by email, and we encourage you to review updates when notified.

14Contact

Questions about this Privacy Policy, or requests regarding your personal data, can be sent to team@malibu.tech.

01Introduction

This notice applies specifically to individuals located in the European Union, European Economic Area, and Switzerland.

This Privacy Notice describes how Malibu, operated by Superposition Technologies Pte. Ltd., a Singapore private limited company (UEN 201721187N) (“Malibu,” “we,” “us,” or “our”), processes personal data of individuals located in the European Union, European Economic Area, and Switzerland (“EU Users”) in accordance with Regulation (EU) 2016/679 (the “General Data Protection Regulation” or “GDPR”).

This Privacy Notice applies when EU Users interact with:

The informational website at malibu.tech and its subdomains
The Malibu console at console.malibu.tech
The Malibu provider desktop application for macOS
Community channels administered by Malibu
Analytics, support, and technical tools associated with the foregoing (collectively, the “Services”)

For purposes of this Privacy Notice, “process” has the meaning given in Article 4(2) GDPR and includes the collection, use, disclosure, storage, and other handling of personal data.

This Privacy Notice does not apply to:

Third-party websites, applications, or services not operated by Malibu
Public blockchain networks or protocols not controlled by Malibu
Activities conducted entirely outside the Services

02Data controller

For the purposes of the GDPR, the data controller is:

Superposition Technologies Pte. Ltd.
3 Fraser Street, #04-23A, Duo Tower
Singapore 189352
team@malibu.tech

03Important notice regarding blockchain technology

Transactions conducted on public blockchain networks are public, immutable, and irreversible.

Wallet addresses and public blockchain identifiers
Transaction hashes, receipts, and related metadata
Timestamps and protocol-level interaction data

This Privacy Notice applies only to personal data collected and processed off-chain through the Services and does not apply to information that is publicly available on blockchain networks or other decentralized systems.

04Categories of personal data processed

Depending on how you interact with the Services, Malibu may process the following categories of personal data:

Contact information voluntarily provided by you, such as an email address
GitHub account information (username, email address, avatar) if you sign in to the console with GitHub OAuth
Communications and correspondence submitted to Malibu
Public wallet addresses and other blockchain identifiers you connect to the Services
API keys, daily-quota consumption, and usage history. Prepaid credit balances and USDC top-up history are on the roadmap; when they become available we will process the same billing information about them.
Prompt routing metadata (model requested, token counts, response latency, provider assignment)
Prompt inputs and model outputs, processed in transit through Malibu’s gateway and coordinator, and processed as plaintext by the independent provider selected to serve the request (see Section 07)
Node telemetry from the provider app, including hardware and OS characteristics, uptime, latency, and throughput
Technical data, including IP address, browser type and version, operating system, device identifiers, access times, and usage logs

The Services are not private-inference infrastructure. Prompt and output content is processed as plaintext on independent provider hardware, and providers can technically observe what routes through their machine. Do not submit content you would not share with an independent provider. A self-hosted coordinator for buyers who need local-only trust is on the roadmap.

Malibu does not intentionally process special categories of personal data under Article 9 GDPR. If you submit special-category information within a prompt, it will be processed as part of that prompt through the flows described above.

05Purposes of processing and legal bases

Malibu processes personal data for the purposes and lawful bases described below:

Purpose	Legal basis	Interest, where applicable
Operation and maintenance of the Services, including delivery of inference requests between buyers and providers	Legitimate interests (Art. 6(1)(f))	Operating a functional inference marketplace
Metering usage and settling payments between buyers and providers (including verified-model settlement, and, when available, prepaid credits and USDC top-ups)	Contract (Art. 6(1)(b)) where you are a buyer or provider; otherwise legitimate interests (Art. 6(1)(f))	Ensuring providers are paid for verified work and buyers are billed for what they used
Distribution of $MALIBU rewards to providers, when on-chain emission becomes available (currently planned)	Legitimate interests (Art. 6(1)(f))	Aligning provider incentives with the health and growth of the network
Responding to inquiries and communications	Consent (Art. 6(1)(a)) where you initiate contact; otherwise legitimate interests (Art. 6(1)(f))	Providing support and responding to users who contact us
Analytics, performance monitoring, fraud prevention, and security	Legitimate interests (Art. 6(1)(f))	Network security, fraud prevention, and service reliability
Compliance with applicable legal obligations	Legal obligation (Art. 6(1)(c))	—

Where processing is based on consent, you may withdraw your consent at any time. Where processing is based on legitimate interests, you may object under Article 21 GDPR; we will assess objections on a case-by-case basis in line with GDPR requirements.

06Cookies and similar technologies

The Services currently use only strictly necessary storage — such as session and API-key state on the console — required to keep you signed in and to operate features you have requested. We do not use third-party analytics or advertising cookies, and the Services do not currently display a consent banner because no consent is required for the storage in use.

If we introduce non-essential cookies or similar technologies in the future, we will provide notice and obtain your consent, where required by applicable law, before setting them. You may manage storage through your browser settings; certain features of the Services may not function properly if you do.

07Data recipients

Personal data may be disclosed to:

The independent Mac provider selected to serve your inference request — prompt inputs and model outputs are transmitted to and processed as plaintext on the provider’s hardware in order to generate and return results
Infrastructure, hosting, analytics, and security service providers
Professional advisors, including legal and accounting firms
Public authorities or regulators where required by law

Malibu does not sell personal data and does not engage in targeted advertising.

08International data transfers

Personal data may be transferred to, stored in, or accessed from jurisdictions outside the European Union or European Economic Area that may not provide an equivalent level of data protection.

Where GDPR Chapter V applies, we require subprocessors that handle EU personal data outside the EEA to be bound by a lawful transfer mechanism, such as:

European Commission Standard Contractual Clauses
Another lawful transfer mechanism recognized under applicable law

09Data retention

Personal data is retained only for as long as reasonably necessary to fulfill the purposes described in this Privacy Notice, including compliance with legal obligations and resolution of disputes.

Information recorded on public blockchain networks is retained permanently by those networks and is not subject to Malibu’s retention controls.

10Your GDPR rights

EU Users have the following rights under the GDPR:

Right of access (Article 15)
Right to rectification (Article 16)
Right to erasure in certain circumstances (Article 17)
Right to restriction of processing (Article 18)
Right to data portability (Article 20)
Right to object to processing based on legitimate interests (Article 21)
Right to withdraw consent at any time, where applicable

These rights do not apply to publicly available blockchain data or information outside Malibu’s technical control. Requests may be submitted to team@malibu.tech.

11Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority in the European Union Member State of your habitual residence, place of work, or place of the alleged infringement.

12Data security

13Changes to this Privacy Notice

We may update this Privacy Notice from time to time. The “Last updated” date above reflects the effective date of the current version. For material changes, we will provide reasonable notice through the console, the provider app, or by email, and we encourage you to review updates when notified.