Privacy

Your data belongs to you. We're just the custodian.

We believe in privacy by design. We collect only what's necessary to provide our services, give you full transparency into how your data is used, and provide tools to exercise your privacy rights.

Data We Collect

Category	Data Types	Purpose
Account Data	Name, email, profile photo	User identification and authentication
Workspace Content	Documents, files, messages, tasks	Core product functionality
Usage Data	Feature usage, performance metrics	Product improvement and support
Device Data	Browser type, IP address, device info	Security and troubleshooting
Payment Data	Billing address, payment method (via Stripe)	Subscription management

How We Use Your Data

Purpose	Description	Legal Basis
Service Delivery	Providing and maintaining the platform	Contract
Security	Protecting accounts and detecting threats	Legitimate Interest
Support	Resolving issues and answering questions	Contract
Improvement	Analyzing usage to improve features	Legitimate Interest
Communication	Service updates and announcements	Contract
Compliance	Meeting legal and regulatory obligations	Legal Obligation

Data Retention

Data Type	Retention Period	Notes
Active Account Data	Duration of account	Deleted upon account closure
Workspace Content	Duration of workspace	Deleted when workspace is removed
Audit Logs	2 years	Required for security and compliance
Backups	7 days	Rolling retention window
Deleted Content	7 days	Grace period for recovery

Your Privacy Rights

Right	Description	How to Exercise
Access	Request a copy of your data	Settings > Privacy > Export Data
Correction	Update inaccurate information	Edit your profile or contact support
Deletion	Request deletion of your data	Settings > Account > Delete Account
Portability	Export your data in standard formats	Settings > Privacy > Export Data
Objection	Object to certain data processing	Contact [email protected]
Restriction	Limit how we process your data	Contact [email protected]

Data Sharing

Recipient	Purpose	Safeguards
Subprocessors	Service delivery (see Subprocessors page)	DPAs and security requirements
Legal Authorities	When required by law	Only with valid legal process
Business Transfer	In case of acquisition or merger	Notice provided, rights preserved

We never sell your data to third parties.

International Transfers

Mechanism	Description
Standard Contractual Clauses	EU-approved contracts for data transfers
Data Processing Agreements	Binding agreements with all subprocessors
Adequacy Decisions	Transfers to countries with adequate protection

Privacy by Design

Principle	Implementation
Data Minimization	Collect only what's necessary
Purpose Limitation	Use data only for stated purposes
Storage Limitation	Retain data only as long as needed
Accuracy	Tools to keep data current
Integrity	Security measures protecting data
Accountability	Documented policies and procedures

Cookie Policy

Cookie Type	Purpose	Duration
Essential	Authentication, security	Session
Functional	Preferences, settings	1 year
Analytics	Usage statistics via Google Analytics (EU; with consent)	1 year

You can manage cookie preferences in your browser settings or through our cookie consent banner. Analytics cookies are only set after you provide consent in GDPR regions.

Children's Privacy

collab.space is designed for business use and is not intended for children under 16. We do not knowingly collect data from children.

Contact Privacy Team

Inquiry Type	Contact
Privacy Questions	[email protected]
Data Protection Officer	[email protected]
Data Subject Requests	[email protected]

We respond to all privacy inquiries within 30 days.