Privacy policy.

01Who we are

The data controller is SpacesOS Inc., 251 Little Falls Drive, Wilmington, New Castle County, Delaware. Spaces is the product. This policy explains what personal data we handle when you use spacesos.com, the dashboard, the API, and the MCP server, so you can run conversations you start, on accounts you connect, with people who have chosen to hear from you. Contact us at hello@spacesos.com.

02Our two roles

For your workspace, such as your email, billing, and usage, we decide how the data is used. We are the controller.

For the data in the accounts you connect, such as messages, contacts, and profiles, we act only on your instructions, given through your keys and agents. You are the controller, and we process that data on your behalf. You are responsible for having a lawful basis to process it and to message the people involved.

03What we collect

• Workspace details: your login email, and the workspace name you choose.
• Billing: your plan, invoices, and payment status. Card details are handled by Stripe, and we never see full card numbers.
• Keys: the API keys you create and their permissions. We store a hash, not the full key, after you have copied it.
• Connected accounts: the channel, the account’s name and ID, its connection status, and the session details needed to keep it connected.
• Usage and safety data: counts of sends and new chats, limit and pause events, errors, and timestamps. We use these to enforce limits and protect your accounts.
• Things you ask us to keep: scheduled messages, routines, knowledge notes, tags, and webhook addresses, until they run or you delete them.
• Messages: so your agent can read without asking the platform each time, Spaces keeps a copy of recent chats and messages on WhatsApp, Instagram, LinkedIn, Messenger, X and iMessage: the text, who sent it, when, read receipts, reactions and attachment details such as the file name and size. We do not keep the files themselves. Email is read from the mailbox each time. The copy is kept for 90 days, and it is removed when you disconnect the account or ask us to delete your data.
• Events: so your agent learns about a new message without checking the platform again and again, Spaces keeps a short list of recent events (a new message with up to 1,000 characters of its text, a reaction, a comment, an invitation or an account change). Events are kept for 14 days, and removed when you disconnect the account or ask us to delete your data.
• Technical data: IP address, browser, and request logs, used for security and to fix problems.

04How we use it

• to run Spaces: connect accounts, read and send messages, run schedules, routines, and webhooks;
• to keep accounts safe: enforce limits, pacing, warm-up, and automatic pauses;
• to bill you, send login codes, and send service emails;
• to provide support, prevent abuse, and keep the service secure;
• to meet legal obligations.

We do not sell personal data. We do not use your messages or contacts for advertising, and we do not use them to train AI models.

05Ad accounts

If you connect a Meta ad account, Spaces stores an access token for it, encrypted, and the ids of the campaigns, ad sets and ads it creates for you. Spaces reads campaign settings and performance figures, such as spend, clicks and results, to show them to you and your AI agent. It sends conversion events you choose to send back to Meta. Personal details in those events, such as email addresses and phone numbers, are hashed before they leave Spaces. Spaces does not use your ad data for anything else and does not share it. Disconnecting the ad account in the dashboard stops all access, and you can ask us to delete the stored data at any time (see Data deletion).

06Sub-processors

Companies that process personal data for Spaces, only to help us run it:

A full list of sub-processors is available on request.

When you send a message, it goes to the platform you send it on, under that platform’s own privacy policy. We may disclose data if the law requires it, for example in response to a valid request from a public authority.

07How long we keep it

• Workspace data is kept while your workspace is open.
• When you disconnect an account, we stop syncing it and remove its session.
• Scheduled messages and routines are kept until they run or you delete them.
• The copy of recent chats and messages is kept for 90 days, and removed at once when you disconnect the account.
• Recent events for your agent are kept for 14 days, and removed at once when you disconnect the account.
• When you close your workspace, we delete its data, except billing records we must keep by law.

08Security

Data travels over encrypted connections. Access is limited to the people who need it to run Spaces. You can pause or revoke any key at any time, and we may pause a key that looks compromised.

09Where data is processed

Spaces runs in the United States. If you are elsewhere, your data is transferred there, and we rely on the safeguards the law requires for those transfers.

10Plans and billing data

Prices are as listed at www.spacesos.com/pricing. The Free plan is $0 and has no end date. It includes 1 connected account and 600 actions a month (20 a day). Adding a card starts Pay as you go. The count resets at midnight in the workspace owner's time zone, and reading messages never counts. At the limit, sending stops until midnight and reading keeps working. An Instagram account on the official connection does not count toward that 1 account. Pay as you go is $19 per connected account a month, prorated, and an Instagram account on the official connection is $19 too. Each paid account includes 200 actions a day, pooled across the workspace and reset at midnight in the workspace owner's time zone; actions over a day's included amount are $0.005 each on the monthly invoice, at one flat rate. A text message, comment or reaction is 1 action. A photo or file is 2, a voice note 3, a video 5. Reading messages is always free. A monthly spend cap stops billable actions when it is reached; it is $10 by default, and the workspace owner can change or remove it. The account fees do not count toward the cap. Other plans and prices are as listed on the pricing page. Stripe handles card details, and we do not store the full card number.

11Deletion

You can ask us to delete personal data we hold about you. The steps, in the app and by email, are on the data deletion page. A status link shows whether a request is pending or complete. It does not show the underlying personal data.

12Your rights

Depending on where you live, you can ask to access, correct, delete, or export your personal data, or object to how it is used. Email hello@spacesos.com and we will reply within the time the law requires.

If a business messaged you through Spaces, they control that data. Please contact them first. We will help them answer your request.

13Cookies

We use an essential cookie to keep you logged in to the dashboard. When you follow a partner's link, a cookie remembers the partner for 60 days so they get credit if you sign up. On your first visit, a cookie remembers how you arrived: the site that linked to us, any campaign tags in the link, and the first page you saw. It stays for 90 days, and we keep it with your account when you sign up so we know how people find Spaces. All of these are our own cookies. We do not use advertising cookies or share them with anyone.

We also measure how people use the site and the dashboard with PostHog, a product analytics service, through our own domain. It sets no cookies and stores nothing on your device. When you are logged in, we link that usage to your account so we can see where people get stuck and improve Spaces. It never includes your messages or your customers' details.

14Children

Spaces is for businesses and is not meant for anyone under 18.

15Contact

SpacesOS Inc., 251 Little Falls Drive, Wilmington, New Castle County, Delaware. Email hello@spacesos.com.

16Changes to this policy

We may update this policy. For important changes we will tell you by email or in the dashboard before they apply. The terms explain the rest of our agreement.