Privacy Policy
Last updated: October 18, 2026
1. Introduction; Scope
This Privacy Policy (this "Policy") describes how Spaces, Inc., a Delaware corporation ("Spaces," "we," "us," or "our"), collects, uses, and discloses personal information in connection with our websites, the Spaces platform, and our related applications, tools, and services (collectively, the "Service"). This Policy does not replace, and should be read together with, any privacy notice provided to you by an organization through which you access the Service.
2. Roles of the Parties
Spaces processes personal information in two capacities. With respect to information concerning visitors to our websites, prospective customers, and individuals who register for, administer, or are billed for accounts, Spaces acts as a controller, and this Policy governs that processing. With respect to information processed within a customer’s Spaces workspace — including content, usage telemetry, and workforce information described in Section 3 — Spaces acts as a processor or service provider on behalf of, and pursuant to its agreement with, the customer organization that controls that workspace (the "Customer"). If you access the Service through an organization, that organization is responsible for its workspace and its own policies; requests concerning workspace data should be directed to that organization’s administrator, and Spaces will refer any such requests it receives to the relevant Customer and provide reasonable assistance.
3. Information We Collect
We collect information you provide directly, such as your name, email address, company name, and role when you create an account or contact us. We also collect information that a Customer’s administrators provide about the Customer’s members, such as role, team, seat assignments, contact details, and workforce information the Customer elects to record (which may include compensation figures used for the Customer’s own cost analytics). We also collect usage data, at the direction and under the configuration of the Customer, including how you interact with Spaces, features used, and session duration, and, where the Customer enables usage capture, development-activity and AI-usage telemetry attributed to individual users, including, without limitation, AI model and token usage, computed costs, session timing, development-tool and feature usage, repository and file-path identifiers, commit metadata, and, where the Customer routes AI traffic through the Spaces gateway, limited bounded excerpts of session context used for classification. Where the Customer connects third-party integrations (such as issue trackers, code hosting, messaging, email, or document tools), we ingest and process content from those sources as directed by the Customer. Technical data such as browser type, IP address, and device information is collected automatically. We also receive crash and diagnostic reports and log data generated by use of the Service. Payment card information is collected and processed by our payment processor; Spaces does not receive or store full payment card numbers.
4. How We Use Your Information
We use your information to provide, secure, and improve the Spaces platform, communicate with you about your account and our services (including service, security, and transactional messages, which you may not opt out of while you maintain an account), analyze usage patterns to enhance the product, provide customer support, and send you marketing communications (which you can opt out of at any time). We also use personal information to detect, investigate, and prevent fraud, abuse, and security incidents; to comply with legal obligations; and to establish, exercise, or defend legal claims. We may create de-identified or aggregated data and use it for any lawful purpose, including analytics, benchmarking, and improving the Service; we will not attempt to re-identify such data. We do not use customer workspace content to train machine-learning models that are made available to other customers.
5. Disclosure of Personal Information
We do not sell your personal information. We do not share personal information for cross-context behavioral advertising. We may share data with service providers and subprocessors who assist in operating Spaces (hosting, infrastructure, payment processing, analytics, email delivery, and AI-model infrastructure), but only as necessary and under contractual data-protection commitments; a current list of subprocessors is available upon request from privacy@spaces.so. We may also disclose personal information to the Customer that controls the applicable workspace (including its administrators); to third-party services that you or your organization direct us to connect; to our professional advisors, subject to confidentiality obligations; and to actual or prospective counterparties and their advisors in connection with a merger, acquisition, financing, or other corporate transaction, in which case this Policy will continue to apply to the transferred information. We may disclose information if required by law or to protect the rights, safety, or property of Spaces, our users, or the public.
6. Data Security
We implement industry-standard security measures to protect your data, including encryption in transit and at rest, access controls, and monitoring. We maintain incident response procedures and will notify affected individuals and, where applicable, regulators of a breach of personal information as required by applicable law. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Data Retention
We retain your account data for as long as your account is active and thereafter for as long as necessary to fulfill the purposes described in this Policy. Retention periods vary by category: security, audit, and integrity records are retained for extended periods where we have a legitimate need or legal obligation; backup and disaster-recovery copies expire in accordance with their schedules; and billing and tax records are retained as required by law. Retention of information within a Customer’s workspace is governed by our agreement with that Customer. You may request deletion of your data at any time by contacting us. Upon a verified request, we will delete personal data within the time periods required by applicable law, except where continued retention is permitted or required, including for the purposes described above.
8. Your Rights and Choices
Depending on your jurisdiction, you may have the right to access, correct, or delete your personal data, to receive a copy of it in a portable format, or to object to or request restriction of certain processing. You may exercise these rights by contacting privacy@spaces.so; we may need to verify your identity, and we will respond as required by applicable law. Where Spaces acts as a processor, we will refer your request to the relevant Customer and provide reasonable assistance. You may opt out of marketing email at any time using the unsubscribe link in any marketing message. If you are in the EU/EEA, or the United Kingdom: our legal bases for processing are the performance of a contract, our legitimate interests (including securing, operating, and improving the Service), consent where required by law, and compliance with legal obligations; you have rights under the GDPR including data portability, and you have the right to lodge a complaint with your supervisory authority. California residents have additional rights under the CCPA.
9. International Data Transfers
Spaces is headquartered in the United States, and personal information is processed in the United States and in other locations where we or our service providers operate. Where required by applicable law, we rely on appropriate safeguards for cross-border transfers, including standard contractual clauses incorporated into our agreements with service providers.
10. Cookies and Similar Technologies
Our marketing site uses privacy-friendly, cookieless analytics (Matomo) to understand aggregate usage. It sets no tracking cookies, is configured to truncate IP addresses, and is never used for advertising. You can opt out of this analytics at any time using the control below. Within the Spaces product, we use only essential cookies and similar storage to maintain your session and preferences; we do not use third-party advertising cookies or trackers.
11. Children’s Privacy
The Service is intended for business use and is not directed to individuals under the age of 16. We do not knowingly collect personal information from children.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated Policy on this page with a revised "Last updated" date and, where required by applicable law, provide additional notice of material changes. Your continued use of Spaces after changes take effect constitutes acceptance of the updated policy. We encourage you to review this page periodically.
13. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us at privacy@spaces.so. For data protection inquiries in the EU, you may also contact us at the same address. To report a security vulnerability, contact security@spaces.so.
Analytics Opt-Out
Our analytics are cookieless and configured to truncate IP addresses. If you’d still prefer not to be counted in aggregate usage, you can opt out here — your choice is remembered on this device.