Spacebring privacy policy

Last Modified: November 9, 2026

This policy describes the information we process to support Spacebring software, Spacebring website (“Spacebring Products”, “Products” or “Services”) and communicate with clients, potential clients, partners and\or other third parties, unless we specified otherwise.

Spacebring Sp. z o.o., a Republic of Poland company, KRS: 0000772992, NIP: PL5842781756, REGON: 38263506000000 and its affiliates and subsidiaries (collectively the "Company," “we,” “us”, "Spacebring", “andcards”, and “our”), respects your privacy rights and is committed to protect your information collected through Services and websites accessed through internet-capable hardware platforms including personal computers, mobile computers and\or mobile devices.

Spacebring provides proprietary software to coworking space operators ("Customer"), who use our Services in their business activity.

As a provider of information and communication services, we comply with relevant laws and privacy protection rules and guidelines of certain countries. For example European Union Regulation 2016/679 ("GDPR").

As a data processor on behalf of the Customer, we comply with relevant legislation as stated in Data Processing Addendum between Spacebring and such Customer.

We have adopted this privacy policy to explain how we collect, store, disclose, transfer, protect, and otherwise use the information collected in connection with our Services (the "Privacy Policy").

Please read the following Privacy Policy carefully. By visiting our website, chat with our Customer Support, connecting us by other means and\or becoming a Customer, you agree that (a) we may transfer, process, and store your or your representative's information in other countries that may have different privacy protections than your country; (b) we may process your or your representative's data in accordance with the following Privacy Policy; and (c) you are bound by our Privacy Policy.

 

Who this privacy policy applies to?

This Privacy Policy applies to all visitors of our website, Customers and their contact persons, our partners, potential clients or partners and their representatives ("you" or "your").

For Services offered by Spacebring used by residents of the European Union, we are the data processor of Users (see definition in our Terms of Use) personal information. Customer is the data controller responsible for Users' personal information.

For Services offered by Spacebring, we are responsible for the personal information of all visitors of our website, who contacted us, Customers contact person, our partners, potential clients and their representatives.

We are also the data controller for personal information we process to handle illegal-content notices and authority orders under the Digital Services Act (see "Illegal-content notices and authority orders (Digital Services Act)" below).

 

What does this privacy policy apply to?

This Privacy Policy applies to the Company's Services, Products, websites, mobile applications, and other services that link to it or display it. In addition, the Company may also from time to time add new sites and services.

This Privacy Policy does not apply to websites or services maintained by other companies or organizations (such as Customer or those who promote the Company's products and services) and the Company cannot and does not guarantee the security of any information disclosed to those third parties. In addition, please note that we may hire vendors (agents or contractors) to collect information on our behalf and in such cases such vendors will be instructed to comply with this Privacy Policy. These vendors may not use your information for their own marketing purposes.

 

Information we collect

We collect data from you, through our interactions with you and through our Products. We collect all information that you provide us, including personal information that identifies you and that may be used to contact you or your representative online or offline. The Company collects information from you on a voluntary basis.

You provide some of these data directly, and we get some of it by collecting data about your interactions, use, and experiences with our Services. The data we collect depends on the context of your interactions with us and the choices you make.

We need to process information about you to provide Services. The types of information we collect depends on how you use our Services.

When you submit information to the Company, it will usually take the form of:

• Subscribing to newsletters or alerts;
• Scheduling demo of our Services;
• Downloading demos, programs, or other software;
• Requesting customer support;
• Contacting with Spacebring employees; or

otherwise through use of our Services, including mobile products, and computer products where your information is required for use.

Your refusal to submit information may limit your ability to use Services, which requires provision of such information.

 

Information we process as a data processor

As far as our Services are for Customers who work with their clients with help of our Product, we do not collect and process any personal information of Users as a data controller. We process such personal information as a data processor in accordance with the Data Processing Addendum between Spacebring and relevant Customer. The one exception is handling illegal-content notices and authority orders under the Digital Services Act, where we act as controller, as described below.

 

Customer support and communication (required)

You may provide us with information related to your use of our Services and how to contact you so we can provide you technical, customer or other types support through email, chat or in other ways. For example, you may send us an email with information relating to our website performance or other issues. All information sent by you during contact with our Customer Support will be used only for the purpose of identifying you, providing you technical, customer or other support, resolving your problem, answering your questions, cooperation with you and\or improving our Services. Technical information can be used for statistical, marketing purposes and for technical improvement of Services.

 

Automatically collected information

 

How we use and store automatically collected information

As described below, we collect information from your computers, phones, and other Internet-connected devices that integrate with our Services, as well as information about these devices, and combine such data from different devices that you use. We use such information to provide you Services, to guarantee and improve our Services functionality, stability and security. We may combine your information across other computers or devices that you may use.

 

Usage and log Information

We collect service-related, diagnostic, and performance information. This includes information about your activity (such as how you use our Services, etc.), log files, and diagnostic, crash, website, and performance logs and reports.

 

Device and connection information

We collect device-specific information when you install, access, or use our Services. This includes information such as hardware model, operating system information, browser information, IP address, mobile network information including phone number, and device identifiers. We do not store device location information.

 

Cookies

Cookies are small files placed on your device to store data that can be recalled by a web server in the domain that placed the cookie. We use cookies for storing and honoring your preferences and settings, combating fraud, analyzing how our products perform, and fulfilling other legitimate purposes.

For detailed information please read our Cookie Policy.

Our marketing website uses an advertising pixel from OpenAI to measure and improve our advertising. If you visit from the European Economic Area or the United Kingdom, it does not load until you accept marketing cookies in our cookie banner. Elsewhere, it may load when you visit. Wherever you are, you can turn it off at any time in the 'Manage your preferences' section of our Cookie Policy at https://www.spacebring.com/cookies.

OpenAI Ireland Limited and Spacebring are joint controllers for collecting and transmitting this data. Spacebring is responsible for obtaining your consent and for informing you. OpenAI's privacy policy governs its own further processing, for which OpenAI is an independent controller. Once you accept marketing cookies, the pixel also uses automatic advanced matching. It detects contact details you enter on our website, such as your email address, hashes them in your browser and sends the hash to OpenAI to match conversions to ads.

OpenAI Ireland Limited processes this data. Where it transfers the data outside the European Economic Area, OpenAI states that it uses a valid transfer mechanism. See our Cookie Policy for details.

The same applies to the advertising tags of LinkedIn (LinkedIn Ireland Unlimited Company), Microsoft Advertising (Microsoft Ireland Operations Limited) and Google (Google Ireland Limited), for Google Ads and for advertising audiences built in Google Ads from Google Analytics data. Our Google Analytics property is linked to Google Ads. Spacebring and each of them are joint controllers for collecting and transmitting this data. Spacebring is responsible for obtaining your consent and for informing you. Each of them is an independent controller for its own further processing, under its own privacy policy. If you visit from the European Economic Area or the United Kingdom, these tags load only after you accept marketing cookies, and Google Analytics only after you accept analytics cookies. Elsewhere, they may load when you visit.

If marketing cookies are on and you submit our contact sales, demo or trial form, the Google, Microsoft Advertising, LinkedIn and OpenAI tags also hash your email address in your browser and send the hash to match your request to an ad. Google and Microsoft Advertising also receive your hashed phone number, and OpenAI your hashed phone number, first name and last name.

 

Third-party information

 

Third-party providers

We work with third-party providers to help us operate, provide, improve, understand, customize, support, and market our Services. For example, we work with companies to distribute our apps, provide our infrastructure, delivery, and other systems, supply map and places information, help us understand how Customers use our Services, and market our Services. These providers may provide us information about you in certain circumstances; for example, app stores may provide us reports to help us diagnose and fix service issues.

 

How we use information

We use the data we collect to provide you with good using experiences, to help us operate our Services. In particular, we use the data to:

• provide our Services, which includes updating, securing, and troubleshooting, as well as providing support;
• improve and develop our Services;
• advertise and market our Services to you, which includes sending promotional communications, and presenting you with relevant offers.

We also use the data to operate our business, which includes analyzing our performance, meeting our legal obligations, developing our workforce, and doing research.

We may use AI-powered tools, including Spacebring Intelligence and Agent (an AI assistant that may reply to members and assist administrators), to help us operate and improve our Services. Spacebring Intelligence is provided through Vercel AI Gateway. Vercel routes requests to three AI model providers that it engages as its own sub-processors: Anthropic, Google (on Vertex AI) and OpenAI. We have no direct contract with them. They are listed in the “Product sub-processors” table below. When you or your Users use these AI-powered features, those interactions may be processed by Vercel and those providers. We have configured Vercel AI Gateway so that requests go only to those providers, with prompt training disallowed and zero data retention enabled, subject only to the limited retention some providers keep for abuse and safety monitoring under their terms. We do not permit Customer Data submitted through these AI-powered features to be used to train the providers’ general-purpose models. If a Customer connects a third-party AI service (such as the ChatGPT plugin or a Claude connector), that provider’s terms and privacy policy govern that connection. Spacebring personnel may review Agent chats and Agent runs that Users or Customers rate, or that are queued for quality, safety or abuse review (including through Langfuse), to operate, secure and improve Spacebring Intelligence. Other chats and runs are not reviewed by personnel by default.

Where we do not collect personal data from you directly, such as business contact details of prospects, we get it from publicly available professional sources, such as company websites and professional networks, and from business contact data providers, such as Hunter and Generect. This covers your name, job title, business email, phone number and company. You can object to this at any time (Art. 21).

 

Legal bases

We process your data on the following bases:

a) Performance of contract (Art. 6(1)(b) GDPR):

• provision of services to Customers, including Spacebring Intelligence
• technical support
• billing and invoicing

b) Legitimate interest (Art. 6(1)(f) GDPR):

• website analytics and performance monitoring without cookies (Vercel Web Analytics and Speed Insights)
• help center hosting (Mintlify), and videos that load with help center pages (YouTube in privacy-enhanced mode)
• security and fraud prevention
• establishing, investigating or defending against claims
• business-to-business sales outreach to business contacts, where the law of the recipient's country allows it without prior consent
• website and help center analytics, and advertising cookies and tags, for visitors outside the European Economic Area and the United Kingdom, who can turn them off at any time in the 'Manage your preferences' section of our Cookie Policy

c) Consent (Art. 6(1)(a) GDPR):

• responding to inquiries from potential customers
• newsletter
• direct marketing, where the law requires consent
• website and help center analytics, and advertising cookies and tags, including the OpenAI pixel, in the European Economic Area and the United Kingdom
• embedded content you choose to load on our website, such as videos, demos and tables

d) Legal obligation (Art. 6(1)(c) GDPR):

• accounting and tax settlements
• handling illegal-content notices, authority orders and statements of reasons, and notifying authorities, under Articles 9, 10, 11, 12, 16, 17 and 18 of Regulation (EU) 2022/2065 (Digital Services Act)

 

Our services

We operate and provide our Services, including providing customer support, and improving, fixing, and customizing our Services. We understand how you use our Services, and analyze and use the information we have to evaluate and improve our Services, research, develop, and test new services and features, and conduct troubleshooting activities. We also use your information to respond to you when you contact us. We use cookies to operate, provide, improve, understand, and customize our Services.

We may use aggregated and anonymized information (which does not identify individuals) to understand usage trends and improve our Services.

 

Safety and security

To protect your information, we follow generally accepted industry standards and maintain reasonable safeguards in attempt to ensure the security, integrity, and privacy of the information you have provided. We have security measures in place designed to protect against the loss, misuse, and alteration of the information under our control. Your information collected by us is stored in secure operating environments that are not available to the public.

We verify activity, and promote safety and security on and off our Services, such as by investigating suspicious activity or violations of our Terms, and to ensure our Services are being used legally. We also implement secure communications protocol for information exchange within our Services to protect against third parties from reading them. We also implement security modules that help protect your information from hackers.

However, no system can be 100% secure and human errors occur, so there is the possibility that there could be unauthorized access to your information. By using our Services, you assume this risk.

 

Illegal-content notices and authority orders (Digital Services Act)

We handle notices of illegal content, orders from authorities, statements of reasons and challenges to our decisions under Regulation (EU) 2022/2065 (Digital Services Act). For this, we act as data controller and process:

• for people who send a notice: name, email address, the content of the notice, and technical data of the submission (such as date and time);
• for Users and Customers affected by a notice or order: Account and contact details, the reported content and its location in the Services, the space or network concerned, our decision and the statement of reasons, and any challenge and our reply;
• for authorities: the order and our correspondence with the authority.

We may share this information with: the Customer whose space or network contains the content, so it can review the content and act on it; the User or Customer affected by our decision, in the statement of reasons (including, only where necessary, the identity of the person who sent the notice); the judicial or administrative authorities that issue orders to us (Articles 9 and 10 DSA), the President of the Office of Electronic Communications (UKE) as Poland's Digital Services Coordinator, and other competent authorities; and police or prosecutors where we suspect a criminal offence that threatens a person's life or safety (Article 18 DSA). The providers we use for customer support and email host this information for us.

 

Do we collect children's personal information?

The Company does not knowingly collect personal information from children under 16 years old (or older, if applicable law provides for different protections). If we become aware that a child has submitted information to the Company, we delete this information immediately. We encourage parents to instruct their children to never give out their real names, addresses, or phone numbers, without permission, when using the Internet.

 

Information you and we share

You share your information as you use and communicate through our Services, and we share your information to help us operate, provide, improve, understand, customize, support, and market our Services.

 

Third-party providers

We work with third-party providers to help us operate, provide, improve, understand, customize, support, and market our Services. We share personal information with third-party service providers who help us operate, provide, secure, support, and improve our Services. Providers that process Customer or User personal data on our behalf as Processor are Sub-processors under our Data Processing Addendum. Other providers below process personal data for which we are the controller (for example our own sales, marketing, and internal operations). These providers are authorized to process personal information only for the stated purpose, and they are contractually required to protect it. We do not sell your personal information. When we share information with third-party providers, we require them to use your information in accordance with our instructions and terms or with express permission from you.

 

Product sub-processors

These providers may process Customer or User personal data when we act as Processor. This is the list referred to in our Data Processing Addendum §VIII.

Payment providers that a Customer connects for its own collections are not Spacebring’s sub-processors. We do not list them here.

Vercel engages its own sub-processors to provide its services, including Anthropic, Google and OpenAI. They are listed in Vercel’s published sub-processor list at https://security.vercel.com.

Services you connect yourself, such as MCP servers, the ChatGPT plugin or the Claude connector, receive data on your instruction and are not our sub-processors. Their own terms and privacy policies apply.

 

Controller-side providers

These providers process personal data for which Spacebring is the controller (website visitors, Customer contact persons, prospects, and our own operations). They are not product Sub-processors under the DPA.

When you use third-party services, their own terms and privacy policies will govern your use of those services.

Some of our integration pages have an embed showing Zapier recipes. It loads only when you click it. Zapier, Inc. then acts as an independent controller under its own privacy policy. Storylane and Airtable content appears only in some blog posts, and also loads only when you click it.

 

Other cases of disclosing

The Company may also share your information with third parties as described in this Privacy Policy. The Company may share your information to fulfill a request you have made, such as signing up for an email list or requesting customer support. In addition, we may share aggregate and other information regarding Services usage statistics with third parties.

We may share your information with third parties in connection with an investigation of fraud, intellectual property infringements, or other activity that is illegal or may expose you or us to legal liability, including as required by law enforcement or other government officials. We also may share your information with third parties when we have reason to believe that a disclosure is necessary to address potential or actual injury or interference with our rights, property, operations, users, or others who may be harmed or may suffer loss or damage, or when we believe that disclosure is necessary to protect our rights, investigate, or enforce our policies, terms, and conditions, combat fraud and/or comply with a judicial proceeding, court order, or legal process served on the Company. In addition, your information may be disclosed to a potential or actual successor or assign in connection with a proposed or consummated merger, acquisition, reorganization, bankruptcy, or other similar event involving all or a portion of the Company, the Company's customer information may be transferred to our successor or assign.

 

Assignment, change of control, and transfer

All of our rights and obligations under our Privacy Policy are freely assignable by us to any of our affiliates, in connection with a merger, acquisition, restructuring, or sale of assets, or by operation of law or otherwise, and we may transfer your information to any of our affiliates, successor entities, or new owner.

 

Data retention

As a Customer, your personal data will be stored for the period necessary to achieve the purposes indicated in the "How we use information” and “Legal bases" sections of the Privacy Policy, namely:

(i) for purposes related to the conclusion and performance of the agreement – until the termination of its validity or trial period expiration;

(ii) for the purpose of handling communication in a submitted support request or communication with potential clients – for the period necessary to address the reported matter, and after its conclusion, for the limitation period of claims related to the matter;

(iii) for the purpose of establishing, pursuing or defending against claims – until the expiry of the limitation period of claims;

(iv) for tax and accounting purposes or other purposes required under applicable law – for the period consistent with applicable legal provisions;

(v) for the purpose of conducting activities within the framework of software performance analysis – until you withdraw your consent, the legally justified interests of the Company or a third party are satisfied, or an objection to the processing of personal data is raised; and

(vi) for the purpose of handling illegal-content notices, authority orders and statements of reasons under the Digital Services Act – for 3 years after we close the notice, or longer if needed until any related claims are time-barred.

As a User, your personal data will be stored in accordance with the Data Processing Addendum between Spacebring and relevant Customer i.e. for the duration of our contractual relationship with the Customer. The period of data retention is determined by the duration of the Customer’s subscription to our Services. Upon termination or expiration of Customer’s contract to our Services User’s data will be stored no longer than 60 days after the expiration of the contract with this Customer unless the Customer renews their subscription to our Services during this period.

If you would like to manage, change, limit, or delete information, please contact us support@spacebring.com.

 

Your rights under GDPR

Under GDPR, you have the right to:

1. Access (Art. 15) – obtain information on processed data and a copy of the data
2. Rectification (Art. 16) – correct inaccurate data
3. Erasure (Art. 17) –”right to be forgotten”
4. Restriction of processing (Art. 18) – suspend certain operations
5. Data portability (Art. 20) – receive data in a structured format
6. Objection (Art. 21) – to processing based on legitimate interest or direct marketing
7. Withdraw consent – at any time (without affecting the lawfulness of the processing that was made on the basis of consent before its withdrawal.)
8. Lodge a complaint with the supervisory authority – President of the Personal Data Protection Office in Poland

To the extent these rights apply in your country, they may be limited in some situations, for example where we are under a legal requirement to keep certain information. Should you wish to make a request, you may send an e-mail to support@spacebring.com. Please indicate your country of residence in your correspondence.

In all cases for all Services, we will respond to your request for access to update, delete, or correct inaccuracies to your information within 30 days.

 

Applicable law

This Privacy Policy is governed by Polish law.

 

Our global operations

In certain circumstances, we may transfer your personal data to Third Countries (countries outside the European Economic Area) where we use facilities, service providers, or partners. Any such transfer complies with Chapter V of the GDPR to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.

We may transfer personal data to countries outside the European Union where we or our service providers operate (see “Third-party providers”). Where required, we rely on appropriate safeguards under Chapter V GDPR, such as Standard Contractual Clauses (and, where applicable, the UK Addendum/UK IDTA and Swiss addendum), or adequacy decisions where available, and we apply supplementary measures where required.

 

Access to transfer safeguards

You have the right to obtain information about the safeguards we have implemented for international transfers.

To obtain a copy of the safeguards we have put in place for international transfers or information about where they have been made available, please contact our Chief Privacy Officer at support@spacebring.com.

 

Updates to our policy

We reserve the right to make changes to this Privacy Policy. Please check back from time to time to ensure that you are aware of these changes. If we make a material change to this Privacy Policy, we will notify you here, by email, or by means of a notice on our home page or application homepage. As far as permitted by applicable law, your continued use of the Services will signify your acceptance of these changes.

 

Contact us

If you have any questions, complaints or suggestions regarding the protection of your information, please contact our Chief Privacy Officer (Information Data Protection Manager). We will use our best efforts to provide you with a timely and satisfactory response.

• Name: Rostyslav Khanas
• Division: Board of Directors
• Contact: support@spacebring.com or +48585859731
• Address: ul. Polanki 76, Gdańsk 80-302, Poland