Privacy Policy

1. Who we are

The Services are operated by Collective Space Inc.. The public-facing name of the platform is Collective Earth. For privacy requests, data subject inquiries, and questions about this policy, contact us at info@collectivespace.org. You may also use our contact form on this website.

2. Information we collect

Depending on how you use the Services, we may collect:

• Account & authentication. Email address, authentication provider identifiers (including when you sign in with Google), session data, and profile identifiers managed through our auth provider (Supabase Auth).
• Profile. Name, username, avatar, timezone, bio, notification preferences, and similar fields you choose to provide.
• Bookings & spaces. Room and space reservations, titles, notes, dates and times, and related metadata needed to operate scheduling and prevent conflicts.
• Payments. When you subscribe or pay for paid features, our payment processor (Stripe) collects and processes payment method and billing details. We receive limited billing-related identifiers (such as customer ID and subscription status), not full card numbers on our own servers.
• Feedback & proposals. Messages you submit through in-app feedback, region suggestions, feature interest, or similar forms, plus technical context such as the page you came from when you choose to submit feedback from the product.
• Community content. Text and images you post in space feeds or similar features, stored in our database and file storage as designed for those features.
• Technical & usage data. IP address, browser type, device information, approximate location derived from standard server logs, cookies or similar technologies, and diagnostic data needed to secure and improve the Services.

3. How we use information

We use information to:

• Provide, operate, and improve the Services, including accounts, bookings, and collaboration features.
• Authenticate users, prevent fraud and abuse, and enforce our Terms of Service.
• Process payments and communicate about billing where applicable, including through Stripe and email.
• Respond to support requests and send service-related notices.
• Analyze usage in aggregate to improve reliability and user experience.
• Comply with legal obligations and protect rights, safety, and property.

We do not sell your personal information for money. We use subprocessors listed below to host and process data on our behalf as described in this policy.

4. Legal bases (EEA / UK / similar)

Where laws such as the GDPR apply, we rely on appropriate bases including: performance of a contract (providing the Services you request), legitimate interests (security, product improvement, proportionate analytics), and consent where required (for example certain cookies or optional communications). You may withdraw consent where processing is consent-based, without affecting prior lawful processing.

5. Sharing & subprocessors

We share information with service providers that process data on our instructions, including:

• Supabase — authentication, database, file storage, and related infrastructure.
• Vercel — application hosting and delivery.
• Stripe — payment processing and subscription management.
• Google — when you choose Sign in with Google, Google's authentication flows apply; Google receives standard OAuth signals under Google's policies.
• Email and transactional messaging — for magic links and service-related email as configured through our stack and domain settings.
• Slack — when Slack Incoming Webhooks are configured, some feedback may be copied to an internal channel for our team; those channels are for operations only, not public distribution.

We may also disclose information if required by law, legal process, or to protect users and the public, or in connection with a merger, acquisition, or asset sale, with notice where appropriate and required.

6. Retention

We retain information only as long as needed for the purposes above, including legal, accounting, and dispute resolution. Account and booking records may be retained for operational and integrity reasons. You may request deletion of your account or personal data subject to legal exceptions and reasonable backup cycles. Contact info@collectivespace.org for such requests.

7. Security

We use industry-standard measures appropriate to the nature of the Services, including encryption in transit, access controls, and separation of duties for administrative operations. No method of transmission or storage is completely secure; we encourage strong passwords and safeguarding access to the email account you use to sign in.

8. Your rights & choices

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability. To exercise these rights, contact info@collectivespace.org. You can manage cookie preferences in your browser and review Google's own account tools for data connected to your Google account.

9. Children

The Services are not directed at children under 13, or under the minimum age required in your jurisdiction. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us immediately at info@collectivespace.org.

10. International transfers

We and our subprocessors may process information in countries other than where you live, including where Supabase, Vercel, or Stripe host or process data. Where required by law, we use appropriate safeguards such as standard contractual clauses or equivalent mechanisms.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date. For material changes, we may provide additional notice as appropriate, including by email or a notice within the Services.

12. Contact

Collective Space Inc.
Privacy and data inquiries: info@collectivespace.org
Contact page