Privacy policy
Draft. This text is a working draft that has not been reviewed by a lawyer and is not legal advice. Items in [square brackets] must be completed before launch. Last updated: [date].
1. Who we are
[Company legal name] ("Spatibase", "we", "us") operates the Spatibase website and the Spatibase platform. Our address is [registered address]. You can contact us at [privacy contact email].
2. What this policy covers
This policy explains what personal data we collect when you visit spatibase.com, create an account, use the Spatibase platform, or contact us, how we use it, and the choices you have.
3. Data we collect
- Account data: name, work email address, organization and the credentials or sign-in method you use.
- Content you manage: the places, fields, text, images, files and other data you or your team add to your projects ("Customer Content"). You own it; we process it on your behalf to provide the service.
- Usage and device data: pages viewed, actions in the product, IP address, browser and device information, and diagnostic logs.
- Communications: messages you send us, for example through the contact form, and your email preferences.
- Cookies and local storage: we store your theme choice in your browser. [List any analytics or other cookies and the consent mechanism.]
4. How we use data
- To provide, secure and improve the platform and the website.
- To authenticate users, provide support and send service notices.
- To respond to enquiries and, where permitted, to send product updates you can opt out of.
- To meet legal obligations and to prevent abuse.
5. AI features
When AI agents or AI features process Customer Content to query or propose edits, they act within the permissions of your project and their changes are saved as drafts for review. [State which AI providers are used as sub-processors, whether Customer Content is used to train models (our intent: it is not), and retention.]
6. Legal bases (EEA/UK)
[Contract performance, legitimate interests, consent and legal obligation, mapped to each purpose above.]
7. Sharing and sub-processors
We share data only with service providers that help us run the platform (hosting, email, analytics, payments, AI providers), under written agreements. [Link to the current sub-processor list.] We do not sell personal data.
8. International transfers
[Describe where data is hosted and the transfer mechanisms used, for example Standard Contractual Clauses.]
9. Retention
We keep account data while your account is active and for [period] afterwards. Customer Content is deleted within [period] after you delete it or close your account, subject to backups and legal requirements.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, and to withdraw consent. Contact [privacy contact email]. You may also complain to your local data protection authority.
11. Security
We use technical and organizational measures appropriate to the risk, including access controls, encryption in transit and an audit log of changes. [Add details once finalized.]
12. Changes
We will post updates on this page and, for material changes, notify account holders.