Privacy Notice
Last Updated: March 18, 2026
💡 We've written this in plain English with summaries so you know exactly how we handle your data.
1. Who We Are
We are SPACETWO LABS Limited (“SPACETWO”, “we”, “us”, “our”), a Scottish company that created a simple, secure file sharing platform. Our goal is to provide an easily accessible and privacy-focused way to share files while keeping you in complete control of your content.
You can access SPACETWO through our website at spacetwo.xyz and our web application. Together, these are our “Services”.
📌 Snapshot: We're SPACETWO LABS Limited – a Scottish company that built a fast, private file sharing platform. We keep things simple and you stay in control of your content.
2. Our Role with Your Data
We process Personal Data, which means any information that can identify a living person. Under UK GDPR, we have two different roles:
Controller: For your account information and service data, we decide how to process your Personal Data. We're responsible for protecting it.
Processor: For Personal Data contained in files you upload, we only process it according to your instructions. You're the controller of that data – we just store and share it as you direct.
If you have questions about your Personal Data, contact us at hello@spacetwo.xyz. If you have questions about Personal Data in someone else's uploaded files, contact us and we'll forward your request to the file owner.
If you believe content in uploaded files is illegal or violates our Terms, contact us at hello@spacetwo.xyz.
📌 Snapshot: We have two roles: (1) Controller for YOUR account data – we decide how to protect it. (2) Processor for data IN YOUR FILES – we just store it as you instruct. Questions about your account? Contact us. Questions about data in someone's files? We'll connect you with them.
3. 📊 Our Service Tiers
We offer three tiers, each with different features and data collection:
Free Account Users
Upload files up to 3GB per file
Manage your files through your account
X-day file retention
Free
Pro Users (Paid Subscription)
Upload files up to 5GB per file
90-day file retention
Password protection and custom expiration
Premium features
Paid monthly
📌 Snapshot: Use SPACETWO create a free account for better management, or upgrade to Pro for more storage, longer retention, and premium features.
4. 📝 What Data We Collect
As a Controller, we collect different data depending on how you use SPACETWO. We collect the minimum necessary to provide our Services.
4.1 Data from ALL Users (Anonymous, Free, and Pro)
| Personal Data | Purpose | Legal Basis |
|---|---|---|
| Files you upload | To store and share files as you request | Contract performance |
| File access logs | To track access and prevent abuse | Legitimate interest |
| Upload timestamps | To manage file expiration | Contract performance |
| Device type, browser, IP address | To deliver the service and prevent abuse | Legitimate interest |
4.2 Additional Data for Account Users (Free and Pro)
| Personal Data | Purpose | Legal Basis |
|---|---|---|
| Email address | To create and manage your account, send important updates | Contract performance |
| Account credentials | To secure your account and keep you logged in | Contract performance |
4.3 Additional Data for Pro Users
| Personal Data | Purpose | Legal Basis |
|---|---|---|
| Name | To process payments and send invoices | Contract performance |
| Payment information (via Stripe) | To process your subscription payments | Contract performance |
| Billing history | To maintain accounts and comply with tax requirements | Legal obligation |
4.4 Data We Collect Generally
Beyond service usage, we may collect data in these contexts:
Website visitors: Device type, browser, IP address, session data – to deliver the website correctly and improve usability
Contact form: Name, email, message content – to respond to your questions and support requests
Social media: Public posts and comments – to respond and engage with our community
Newsletter (if applicable): Name and email – to send updates (with your consent or as part of Pro subscription)
📌 Snapshot: We collect more data as you use more features – just files and basic technical info. Account users: add email and login details. Pro users: add payment information. We also collect basic visitor data from our website and contact forms.
5. Required Information
Some information is legally or contractually required for us to provide specific Services (marked with * where applicable). For example, we need your email to create an account. If you don't provide required information, we may not be able to provide certain Services.
📌 Snapshot: Some information is required for certain services. If you don't provide it, we can't provide those services.
6. ⚙️ Our Technology Infrastructure
We built SPACETWO with simplicity, speed, and transparency in mind. Here's exactly what we use:
Core Technology
Backend: Modern web framework with TypeScript
Hosting: Vercel edge network for fast global performance
Database: Supabase (PostgreSQL) for data storage and authentication
File Storage: Supabase integrated S3 file storage
Payments: Stripe for secure payment processing
Data Location
Primary data storage is in the European Economic Area and United States, with appropriate safeguards for international transfers including standard contractual clauses.
📌 Snapshot: We use Vercel for fast global delivery and Supabase for secure data and file storage. Data is stored in EU and US with proper protections. Payments processed securely by Stripe.
7. 🍪 Cookies and Similar Technologies
We use cookies and similar technologies on our website. A cookie is a small text file stored on your device when you visit our website. Cookies help us recognise your browser and provide a better experience.
We use:
Essential cookies: Required for the website to function (e.g., keeping you logged in)
Analytics cookies: To understand how people use our service and improve it
For more details about cookies, see our Cookie Policy on our website.
📌 Snapshot: We use cookies to make the website work properly and understand how people use it. Check our Cookie Policy for full details.
8. ⏱️ How Long We Keep Your Data
We only keep Personal Data as long as necessary for the purposes described above, or as required by law. Here are our retention periods:
| Data Type | Retention Period |
|---|---|
| Free users | X days after upload |
| Files (Pro users) | X days after upload (or custom expiration) |
| Account data | 1 year after account deletion. Unused accounts deleted after 2 years (with advance notice) |
| Billing records | 7 years (legal requirement) |
| Support correspondence | 2 years after resolution |
| Newsletter subscriptions | Until you unsubscribe |
After these retention periods, we may keep certain Personal Data longer if required by law or necessary for fraud investigations or legal claims. In such cases, we store the data separately and only use it for those specific purposes.
📌 Snapshot: Files auto-delete after X days (X days for Pro). Account data kept for 1 year after deletion. Billing records kept for 7 years (legal requirement). We may keep data longer if required by law or for legal claims.
9. Sharing Your Data with Others
We work with trusted third parties to provide our Services. We remain responsible for protecting your Personal Data when shared with these partners.
Our Processors (Data Processors)
These companies process data on our behalf according to our instructions:
| Company | Purpose | Data Location |
|---|---|---|
| Supabase Inc. | Database and file storage | EU/US |
| Vercel Inc. | Hosting and content delivery | EU/US |
| Stripe Inc. | Payment processing (Pro users only) | EU/US |
Data Controllers
We may also share data with parties who use it for their own purposes:
Tax authorities: We're legally required to share financial records with HMRC
Legal authorities: When required by law or to protect rights and safety
Business transfers: If we merge with or are acquired by another company
We do not sell your Personal Data. We do not use it for advertising. We only share what's necessary to provide our Services or comply with legal obligations.
📌 Snapshot: We use Supabase, Vercel, and Stripe to run our service. All have strong data protection. We share financial data with tax authorities as required by law. We don't sell your data or use it for ads.
10. 🌍 International Data Transfers
Some of our service providers are located outside the United Kingdom or European Union. When we transfer Personal Data internationally, we ensure appropriate safeguards are in place, such as:
Standard contractual clauses approved by the UK Information Commissioner's Office
Transfers to countries with adequate data protection as recognised by UK law
Contact us at hello@spacetwo.xyz if you'd like more information about our international transfer safeguards.
📌 Snapshot: Some data is stored in the US. We use standard contractual clauses and other safeguards to protect your data when transferred internationally.
11. 🔗 Third-Party Websites
Our website may contain links to other websites. We're not responsible for the privacy practices of these third-party sites. When you visit another website, their privacy policy applies, not ours. We encourage you to read their privacy policies before providing any Personal Data.
📌 Snapshot: If you click a link to another website, their privacy policy applies there. We're not responsible for other sites.
12. Changes to This Privacy Notice
We may update this Privacy Notice from time to time. Please check back periodically. The updated version will be effective immediately upon posting. For significant changes, we'll prominently announce them on our website. The “Last Updated” date at the top shows when the most recent changes were made.
📌 Snapshot: We might update this notice. Check back periodically. For major changes, we'll announce them prominently on our website.
13. ✅ Your Privacy Rights
Under UK GDPR, you have important rights over your Personal Data:
| Right | What This Means |
|---|---|
| Right of access | Ask us what Personal Data we have about you and get a copy |
| Right to rectification | Ask us to correct inaccurate Personal Data |
| Right to erasure | Ask us to delete your Personal Data (“right to be forgotten”) |
| Right to restriction | Ask us to restrict how we process your Personal Data |
| Right to data portability | Ask us to transfer your Personal Data to another service |
| Right to object | Object to certain processing of your Personal Data |
| Right to withdraw consent | Withdraw your consent at any time where we rely on consent |
To exercise these rights, contact us at hello@spacetwo.xyz. We'll respond within one month.
If you're unhappy with how we handle your Personal Data, you can complain to the UK Information Commissioner's Office (ICO):
Website: ico.org.uk/make-a-complaint
📌 Snapshot: You have rights over your data: access it, correct it, delete it, restrict how we use it, move it elsewhere, or object to processing. Contact us to exercise these rights. Unhappy with our response? Complain to the UK Information Commissioner's Office.
14. Contact Us
✉️ Questions about this Privacy Notice or how we handle your Personal Data?
SPACETWO LABS Limited
📧 Email: hello@spacetwo.xyz
🌐 Website: spacetwo.xyz
