Privacy Policy

1) Scope and applicability worldwide

This Privacy Policy explains how Spacefit.ai SAS ("Spacefit", "we", "us") collects, uses, and shares personal data when you visit our website(s), interact with our chatbot or forms, request a demo, contact Sales, or otherwise communicate with us, and when you use our Platform at app.spacefit.ai under the Platform Terms of Use (and, for Enterprise customers, a signed Master Services Agreement).

Spacefit operates worldwide. Depending on where you are located, your rights and our obligations may vary. This Policy addresses, in particular, the requirements of the EU/UK General Data Protection Regulation (GDPR), the French Data Protection Act, the Swiss Federal Act on Data Protection (FADP), the California Consumer Privacy Act as amended (CCPA/CPRA), and other applicable data protection laws.

Our Platform access is provided following a commercial process and is governed by the Platform Terms of Use accepted at the time of order (and, for Enterprise customers, a signed MSA or Order Form). Where Spacefit processes personal data on behalf of a Customer using the Platform, Spacefit acts as a data processor and the processing is governed by the Platform Terms of Use, any applicable Customer Agreement, and the Data Processing Agreement (DPA).

2) Personal data we collect

• Data you provide: name, work email, company, job title, phone number, message content, meeting requests, demo requirements, and any files you choose to share for evaluation.
• Account data: credentials, role within the Customer organisation, language and interface preferences, and acceptance records of these terms (timestamp, version, IP).
• Platform usage data: actions taken in the Platform, projects accessed, share events, login/logout times, and feature usage.
• Data collected automatically on our website: IP address, approximate location (city/country), device type, browser/OS, pages viewed, time on page, referring/exit pages, and cookie identifiers.
• Chatbot data: information you submit and the conversation transcript. Our chatbot and lead handling are operated via HubSpot.
• Website tracking and analytics data: analytics and attribution data collected via Apollo and HubSpot.

We do not knowingly collect data from children under 16. Spacefit is a business-only platform.

3) Why we use your data (purposes)

• To respond to your requests, schedule demos, and communicate with you.
• To qualify inbound interest and manage our B2B sales process.
• To provide, operate, secure, maintain, and improve the website and the Platform.
• To measure marketing performance and website engagement.
• To comply with legal obligations and to establish, exercise, or defend legal claims.

4) Legal bases (EEA, UK, Switzerland)

• Legitimate interests (responding to B2B inquiries, improving the website and Platform, preventing fraud, qualifying prospects). We balance our interests against your rights and freedoms.
• Consent (for non-essential cookies and tracking technologies where required by applicable law).
• Performance of contract or pre-contractual steps (e.g., when you request a demo or use the Platform under an agreement).
• Legal obligation (where applicable).

We do not use your personal data for automated decision-making producing legal or similarly significant effects.

5) Cookies and similar technologies

We use cookies and similar technologies for essential website functionality, analytics and measurement (including Apollo and HubSpot), and preference management. A detailed list of cookies, their purposes, providers, and durations is available in our separate Cookie Policy at spacefit.ai/cookie.

You can manage your cookie choices via our cookie consent banner and through your browser settings. Refusing non-essential cookies does not prevent access to the website.

6) Sharing and disclosures

We may share personal data with:

• Service providers acting on our behalf, including: HubSpot (chatbot, CRM, lead management), Apollo (website tracking, visitor identification, analytics), Microsoft Azure (hosting), and email/scheduling providers.
• Professional advisors (legal, audit) as needed.
• Authorities where legally required, or to protect rights, safety, and prevent fraud.
• A buyer/seller in a corporate transaction (e.g., merger/acquisition), subject to appropriate safeguards and prior notice where feasible.

We do not sell personal data, and we do not share personal data for cross-context behavioural advertising (as defined under applicable US state privacy laws).

7) International transfers

Customer Content uploaded to the Platform is hosted within the European Union (Microsoft Azure, EU data centres). The international transfers described in this section concern primarily website, marketing, and CRM data handled by our service providers (such as HubSpot and Apollo).

Spacefit serves customers worldwide. Some of our service providers process data outside the European Economic Area, including in the United States. Where required, we rely on lawful transfer mechanisms such as the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, the Swiss SCCs, and adequacy decisions, and we implement appropriate supplementary safeguards.

8) Data retention

• Prospect/lead data: up to 3 years from last meaningful contact.
• Analytics data: retained per vendor default settings, typically up to 26 months.
• Chatbot transcripts: retained for the duration of the commercial relationship and up to 3 years thereafter.
• Platform account and usage data, and Customer Content (including any retention for later re-activation where the Customer's plan provides for it): as set out in the Platform Terms of Use and any applicable Customer Agreement and Data Processing Agreement (DPA).
• Legal/compliance records: as long as required by applicable law.

When data is no longer needed, it is deleted or anonymised.

9) Security

We implement technical and organisational measures to protect personal data, including access controls, monitoring, encryption in transit, and segregation of customer data on the Platform. No method of transmission is fully secure; we continuously review and improve our safeguards.

10) Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (CNIL in France) within 72 hours in accordance with Article 33 of the GDPR. Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay.

11) Your rights

Depending on your location, you may have the right to access, correct, delete, or restrict the processing of your personal data, object to processing, request portability, and withdraw consent (where consent is the legal basis). EEA, UK, and Swiss residents may lodge a complaint with their local data protection authority (in France: CNIL, www.cnil.fr).

California residents have, under the CCPA/CPRA, the right to know what personal information we collect and how it is used, to request deletion or correction, to limit the use of sensitive personal information (where applicable), and to be free from retaliation for exercising their rights. We do not "sell" or "share" personal information as defined under California law.

To exercise your rights, contact: contact@spacefit.ai

12) AI and machine learning

Our Platform uses deterministic algorithms and may use artificial intelligence and machine learning techniques to generate Outputs. We do not use personal data of our website visitors to train AI models. Customer Content uploaded to the Platform is not used to train models for the benefit of other customers; any training of our models is limited to data the Customer has expressly authorised in writing, or to aggregated and de-identified data.

13) Children

Our website and services are intended for business users and are not directed to children under 16.

14) Changes

We may update this Privacy Policy from time to time. The latest version will be posted on our website with an updated effective date.