PRIVACYPOLICY

Information You Provide Directly:

• Account Information: Name, email address, password, and profile details when you create an account
• Payment Information: Billing address and payment card details (processed securely by Stripe; we do not store full card numbers)
• Communications: Information you provide when contacting us, including support requests and feedback
• User Content: Bookmarks, saved collections, and preferences you create within the Service

Information Collected Automatically:

• Device Information: Device type, operating system, browser type, and unique device identifiers
• Log Data: IP address, access times, pages viewed, referring URL, and actions taken on the Service
• Usage Data: Features used, content accessed, search queries, and browsing patterns
• Location Data: General location based on IP address (we do not collect precise geolocation)

Information from Third Parties:

• Authentication Providers: If you sign in via Google or other third-party services, we receive basic profile information as permitted by your settings
• Analytics Services: We use third-party analytics to understand how users interact with our Service

We use the information we collect for the following purposes:

• Provide and Maintain the Service: Create and manage your account, process transactions, and deliver the features you request
• Improve and Personalize: Analyze usage patterns, develop new features, personalize your experience, and improve our Service
• Communications: Send transactional emails (receipts, account updates), respond to inquiries, and provide customer support
• Marketing: Send promotional communications about new features, content, or offers (you can opt out at any time)
• Security and Fraud Prevention: Detect, prevent, and address technical issues, fraud, and unauthorized access
• Legal Compliance: Comply with applicable laws, regulations, and legal processes
• Aggregate Analytics: Create anonymized, aggregate data for business analysis and reporting

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide you with the Service and fulfill our contractual obligations
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our Service, marketing, and fraud prevention, where these interests are not overridden by your rights
• Consent: Where you have given explicit consent for specific processing activities (e.g., marketing emails)
• Legal Obligation: Processing necessary to comply with legal requirements

We do not sell your personal information. We may share your data in the following circumstances:

• Service Providers: Third-party vendors who perform services on our behalf, such as payment processing (Stripe), email delivery, hosting (Vercel), analytics (Google Analytics), and customer support. These providers are contractually obligated to protect your data.
• Business Transfers: If Openspaces is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership.
• Legal Requirements: We may disclose your information if required by law, subpoena, court order, or government request, or to protect the rights, property, or safety of Openspaces, our users, or others.
• With Your Consent: We may share your information with third parties when you explicitly consent to such sharing.

We use cookies and similar tracking technologies to collect and store information about your interactions with our Service.

Types of Cookies We Use:

• Essential Cookies: Required for the Service to function (authentication, security, preferences)
• Analytics Cookies: Help us understand how users interact with our Service (Google Analytics)
• Functional Cookies: Remember your preferences and settings

Your Choices: You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service. Most browsers allow you to refuse cookies or alert you when cookies are being sent.

Do Not Track: We do not currently respond to "Do Not Track" browser signals. However, you can use browser extensions or settings to limit tracking.

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account Data: Retained while your account is active and for up to 30 days after deletion to allow for account recovery
• Transaction Records: Retained for 7 years for tax and legal compliance purposes
• Usage Data: Retained in identifiable form for up to 24 months; anonymized data may be retained indefinitely
• Marketing Preferences: Retained until you opt out or request deletion

When we no longer need your information, we will securely delete or anonymize it.

We implement industry-standard technical and organizational security measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication mechanisms and password hashing
• Regular security assessments and monitoring
• Access controls limiting employee access to personal data
• Secure third-party service providers (SOC 2 compliant where applicable)

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Request a copy of your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests or for direct marketing
• Restriction: Request restriction of processing in certain circumstances
• Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time

To exercise these rights, contact us at support@openspaces.design. We will respond to your request within 30 days (or as required by applicable law). We may need to verify your identity before processing your request.

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to Know: Request information about the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share it
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Opt-Out of Sale: We do not sell personal information, but you have the right to opt out if we ever do
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

To exercise your CCPA rights, contact us at support@openspaces.design or submit a request through your account settings. You may designate an authorized agent to make a request on your behalf.

Openspaces is based in the United States. If you access our Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

For users in the EEA, UK, or Switzerland, we ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses approved by the European Commission or other legally recognized mechanisms.

By using our Service, you consent to the transfer of your information to the United States and other jurisdictions as described in this policy.

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@openspaces.design.

If we learn that we have collected personal information from a child under 18, we will take steps to delete that information as soon as possible.

Our Service integrates with or links to third-party services. This Privacy Policy does not apply to third-party websites or services. We encourage you to review the privacy policies of any third-party services you access through our platform.

Key third-party services we use include:

• Firebase (Google): Authentication and database services
• Stripe: Payment processing
• Vercel: Hosting and deployment
• Sanity: Content management
• Google Analytics: Usage analytics

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make material changes, we will:

• Update the "Effective Date" at the top of this policy
• Notify you by email (if you have an account) at least 30 days before the changes take effect
• Post a prominent notice on our Service

Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For GDPR-related inquiries, you may also contact your local data protection authority.