Who is responsible
Spacescaping, founded in Istanbul, Türkiye, is the data controller. For anything about your data, write to hello@spacescaping.co with “Privacy” in the subject.
What we collect
Account: your email address, password (stored only as a hash by our authentication provider), name, handle, country, plan and role. What you add: your photo, discipline, résumé, projects, portfolios, writings, boards, files, and what you choose to publish. Teams: team names, who is in them and their roles, and invitations. Forms: for the waitlist, your email, preferred handle, how you work, and the consent you gave with its date and version; for contact, the reason, your name, email and message; for careers, your name, email, role, link and message. AI tools: what you type, the screen context you choose to share, and what the tool returns. Technical: short-lived server logs (IP address, browser, times) for security and abuse prevention, and your credit and storage use. On the website we count page reads without any identifier (see the cookie policy).
Why, and on what basis
To provide your account and the Service (performance of a contract). To keep the Service secure, prevent abuse, fix problems, answer you and improve the Service (our legitimate interests, weighed against yours). To email you about early access or news where you asked for it (your consent, which you can withdraw at any time). To meet legal duties such as tax, accounting or lawful requests (legal obligation). Under KVKK we rely on the same grounds in Article 5 — establishing and performing a contract, legal obligation, legitimate interest — and on your explicit consent where the law requires it.
What becomes public
Anything you publish — your public profile and the projects, portfolios, writings and boards you mark public — can be seen by anyone, indexed by search engines, and copied or saved by others. You decide what is published and can unpublish it at any time; copies others already made are outside our control.
Who processes it for us
We use a small number of providers who process data only on our instructions: Vercel (hosting and delivery), Supabase (database, sign-in and file storage), and — only when you use an AI tool, and only what that tool needs — Anthropic, OpenAI, Replicate and Stability AI. We choose providers whose terms for this kind of use do not let them train their models on your data by default. We may also disclose data when the law requires it, to protect rights and safety, or as part of a merger or sale under this notice. We do not sell personal data, and we do not share it for cross-context behavioural advertising.
Across borders
Our providers may process data outside your country, including in the European Union and the United States. Where the law requires it, transfers rely on an adequacy decision, the European Commission’s Standard Contractual Clauses, or other lawful safeguards; transfers of data from Türkiye follow Article 9 of KVKK.
How long we keep it
Your account and content: while your account is open, then deleted within 30 days of closing it, with backups overwritten within a further 90 days. Waitlist entries: until you are admitted or ask us to remove them, and no longer than 24 months. Contact and careers messages: up to 24 months. Security logs: up to 90 days. Records we must keep by law: as long as the law requires. Page counts contain no personal data.
Your rights
You can ask to access, correct, delete or receive a copy of your data, to restrict or object to how we use it, and to withdraw consent at any time without affecting what was done before. Under KVKK Article 11 you also have the right to learn whether and how your data is processed, who it is transferred to, and to claim compensation for unlawful processing. California residents have the right to know, delete and correct, and not to be treated differently for using these rights; we do not sell or share personal data. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Write to hello@spacescaping.co; we answer within 30 days and may ask you to confirm who you are.
If you want to complain
Tell us first and we will try to fix it. You can also complain to a data protection authority — in Türkiye the Personal Data Protection Board (KVKK), in the EU or UK the authority where you live or work.
Keeping it safe
Data is encrypted in transit, access is limited by role and by database rules that let each member reach only their own and their team’s private data, and very few people can reach production systems. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
Children
The Service is not meant for anyone under 16. If we learn we hold such a person’s data, we will delete it.
Cookies
What the website and the app store in your browser is described in the cookie policy.
Changes
We will update this notice as the Service changes, and change the date at the top. If a change is material, we will tell you in the Service or by email before it applies.