Privacy policy
Last updated
This policy explains what personal data Space collects, why, who receives it and what you can do about it.
Space is in development and public sign-ups are not open yet. These terms apply from the day you create an account or buy a plan. Questions go to sequierh@statemethod.com.
Who is responsible
Hugo SEQUIER, Entrepreneur individuel (French sole trader), is the controller of your personal data under the General Data Protection Regulation (GDPR). Write to sequierh@statemethod.com about anything in this policy. For how Space protects workspace content in technical detail, see Privacy & data.
What we collect
Your account
Your email address, a hash of your password (never the password itself), your display name, and, if you sign in with Google or GitHub, the email address and profile name that service shares. We also keep sign-in sessions and the agents and API keys you have authorized.
Your workspace
The documents, tasks, databases and memory you or your agents save. Workspace content is encrypted before it is stored. To make memory searchable without decrypting everything, embeddings and hashes of memory text stay readable in the database: they do not contain the text, but a copy of the database could show which memories are similar or identical.
Activity and technical data
A record of which account or agent made each change and when, IP addresses and request details our hosts process to run and protect the service, and the time of each agent connection’s latest successful request.
Billing
What Stripe collects when you pay, and the few details it sends back to us. See Payments and Stripe.
The website
Page visits on getspace.sh, counted without cookies. Google Analytics only runs if you allow it in the analytics banner. See Cookies and analytics.
Why we use it
| Purpose | Legal basis |
|---|---|
| Running your account and workspace, memory processing and agent connections | Performing our contract with you |
| Taking payment, invoicing and VAT | Contract, and our legal obligations on accounting and tax |
| Keeping Space secure, preventing abuse and fixing faults | Our legitimate interest in a working, safe service |
| Counting page visits and active agent connections in aggregate | Our legitimate interest in knowing how Space is used |
| Google Analytics on getspace.sh | Your consent, which you can withdraw at any time |
| Emails about your account, billing and changes to these terms | Contract |
We do not sell personal data, show advertising, or use your workspace content to train AI models.
Payments and Stripe
Payments are handled by Stripe. When you choose a plan, Space opens Stripe Checkout and tells Stripe only:
- the plan and billing period you chose, and the number of seats;
- an internal account identifier, a random code that links the payment to your Space account;
- your existing Stripe customer reference, if you have paid before;
- the pages to return to after paying.
Space does not send Stripe your workspace content, your memory or your Space password. You give Stripe your email address, name, card details and billing address, plus a VAT number if you are a business, directly on its Checkout page. Stripe uses them to take payment, calculate VAT, prevent fraud and meet its own legal obligations, under the Stripe privacy policy.
Stripe sends us back your Stripe customer and subscription references, your plan and billing period, the subscription’s status, the end of the current period and whether it is set to cancel. We never receive your full card number. Invoices and payment records stay in Stripe, where we can see them to answer questions and issue refunds.
Who receives your data
These providers process personal data on our behalf, only to provide Space, under data processing terms:
| Provider | What for | Where |
|---|---|---|
| Supabase | Sign-in and the database: account details, sessions and encrypted workspace records | United States |
| Cloudflare | The API and agent connections, file storage and encrypted backups | United States and worldwide network |
| Amazon Web Services | Key management for the keys that encrypt your workspace (no content) | United States |
| Vercel | Hosting for getspace.sh and the app, and cookie-free page statistics on getspace.sh | United States |
| OpenRouter, routing to the AI model providers it serves | Extracting memory from text you save, checking search results and, when enabled, organizing memory and judging which memories relate | United States |
| OpenAI | Embeddings: turning memory text into numbers that can be searched by meaning | United States |
| Stripe | Payments, invoices and VAT | Ireland and United States |
| Sign in with Google, and Google Analytics on getspace.sh only if you allow it | United States | |
| GitHub | Sign in with GitHub | United States |
Memory processing sends the text being processed to the AI providers above: the text you save as memory, search queries, candidate results and the names of your memory categories. We ask chat model providers not to store requests where their API allows it, but their own retention terms apply. Settings → Memory processing shows what is enabled for your account.
Agents you connect, and webhook addresses you set up, receive what you allow them to read. They are run by you or by their own providers, such as the company behind your AI assistant, under their own terms, not by us.
We may also disclose data when the law requires it, for example to a court or authority with the power to demand it.
Transfers outside Europe
Space is hosted in the United States, so your data is transferred outside the European Economic Area. These transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses. Write to us for a copy of the safeguards that apply.
How long we keep it
- Account and workspace: for as long as your account exists. After a plan ends your account stays readable until you ask us to delete it.
- Deleted content: removed from your workspace at once. Earlier document revisions stay in source history until the account is deleted, and forgetting a memory does not erase its text from those revisions. Encrypted backups can hold a copy for up to 30 days.
- Deleted accounts: deleted within 30 days of your request, backups included once they expire. We keep a record that the deletion happened, with a hashed account identifier and no content, so that restoring a backup cannot bring the account back.
- Change records: which account or agent made each change, kept for 180 days.
- Billing records: invoices and payment records, kept for 10 years as French accounting law requires.
- Google Analytics: only if you allowed it, for at most 14 months.
Your rights
You can ask us to:
- give you a copy of your personal data, or send it to you in a portable format (Settings → Data exports your documents and tasks yourself);
- correct data that is wrong;
- delete your data or your account;
- restrict or object to processing based on our legitimate interests;
- withdraw a consent you gave, such as for Google Analytics, without affecting what happened before.
You can also tell us what should happen to your data after your death. Write to sequierh@statemethod.com from your account’s email address. We answer within one month. If you think we have not respected your rights, you can complain to the French data protection authority, the CNIL, or the authority where you live.
Cookies and analytics
The app uses strictly necessary cookies to keep you signed in and to return you to the right page after signing in with Google or GitHub. It also stores interface preferences and an encrypted, 24-hour cache of what you have opened in your browser, cleared when you sign out. These need no consent.
getspace.sh counts page visits with Vercel Web Analytics, which sets no cookies. Google Analytics loads only after you choose Allow in the analytics banner, and never when your browser sends a Global Privacy Control or do-not-track signal. It receives page addresses without query strings, with advertising features off. Use “Analytics preferences” at the bottom of any page to change your choice; declining removes its cookies.
Security
Traffic is encrypted in transit, and workspace content is encrypted with keys held in a key management service before it is stored. Services that provide features, such as search and memory processing, decrypt content to do their work. No system is perfectly secure: we will tell you, and the CNIL where the law requires, without undue delay if a breach puts your data at risk.
Children
Space is not meant for children under 15, and we do not knowingly collect their data. If you think a child has given us personal data, write to us and we will delete it.
Changes to this policy
We update this policy when what we collect or who receives it changes, and change the date at the top. We email account holders before a change that matters takes effect.