1. Who is responsible
The data controller is Spacewebs LLC (30 N Gould St, Ste R, Sheridan, WY 82801, United States), reachable at contact@spacewebs.be.
This policy covers spacewebs.be and the client area. Where we host a customer’s website, that customer is the controller for the data their own site collects; we then act only as their processor.
2. What we collect
Your account: name, e-mail address, password (hashed with bcrypt, never readable by us), profile picture if you upload one, creation and last-update dates.
Your project: information about your business, inbox messages, files you upload, your domain name and the status of deployments.
Your billing: the active subscription, issued invoices, payment history. Card details are handled by Stripe and never reach us.
A technical log: who did what and when in the client area, for security and traceability.
We collect no sensitive data and carry out no advertising profiling.
3. Why, and on what basis
Performing the contract: building your site, hosting it, managing your project, invoicing you, answering you. This covers almost everything we do.
Legal obligations: keeping accounting records and invoices.
Legitimate interest: service security, abuse prevention, audit log, backups.
We send no marketing prospecting and resell no data. Ever.
4. Where the data lives
Data is hosted with Hetzner Online GmbH, in Germany, therefore within the European Union.
Files you upload are stored in private storage: no public address exists, and every view goes through a signed link valid for a few minutes.
As the publisher is a US company, its officers may access this data from outside the European Union in the course of running the service. No data is transferred to a US third party for any other purpose.
5. Who else is involved
Hetzner Online GmbH (Germany): hosting of servers and file storage.
Stripe: payment processing and subscription invoicing.
Google: only if you choose to sign in with your Google account, in which case we receive your name and e-mail address.
Service e-mails (address verification, notifications, password resets) are sent from our own mail servers.
This list is exhaustive: no other third party receives your data.
6. Cookies
We set strictly necessary cookies only: the session cookie that keeps you signed in (httpOnly, unreadable by the browser), a temporary cookie during a Google sign-in, and one that remembers your language.
No advertising cookies, no trackers, no third-party analytics. That is also why there is no banner to dismiss: there is nothing to consent to.
Fonts are served from our own servers: your browser contacts no third-party service while loading this site.
7. For how long
Account and project data is kept for as long as your subscription is active, then thirty days after it ends so you have time to request a copy.
Invoices and accounting records are kept for as long as the applicable accounting obligations require.
Backups rotate: deleted data disappears from backups at most thirty days after deletion.
The audit log is kept for twelve months.
8. Your rights
You may request access to your data, its correction, its erasure, its portability, or object to a processing operation. One address: contact@spacewebs.be. We answer within a month.
If you are a customer of a business whose website we host, contact that business first: they decide about your data, we merely store it on their behalf.
You may also lodge a complaint with the Belgian Data Protection Authority (autoriteprotectiondonnees.be) if you believe your rights have been disregarded.
9. Security
Passwords are hashed and never stored in clear text. Traffic goes over HTTPS. Private files are reachable only through short-lived signed links. Access to the client area is logged.
In the event of a data breach presenting a risk to your rights, we inform you and the competent authority within the time limits set by the GDPR.