Terms of Service

Last Updated: March 19, 2026

1. About These Terms

1. This agreement (“Terms”, “Agreement”) is between you (“you”, “your”, “User”) and SPACETWO LABS Limited (“SPACETWO”, “we”, “us”, “our”). These Terms govern your use of our file sharing platform available at spacetwo.xyz (“Service”, “Platform”).

2. When you use SPACETWO to upload, store, or share files, you remain the owner and controller of your content. We simply provide the platform infrastructure. For data containing personal information about others, you act as the data controller and we act as your data processor under UK GDPR.

3. By using SPACETWO, you confirm that you accept these Terms and agree to comply with them. If you disagree with any part of these Terms, you must not use our Service.

4. If you're accepting these Terms on behalf of an organisation, you confirm that you have authority to bind that organisation to this Agreement.

2. Key Definitions

Throughout these Terms, the following words have specific meanings:

“Account” means your registered user profile that gives you access to premium features.

“Consumer” means an individual using our Service for personal purposes, not for business.

“Content” means any files you upload, including documents, images, videos, audio files, or other digital materials.

“Force Majeure” means events beyond our reasonable control, such as natural disasters, government actions, internet infrastructure failures, cyber attacks, war, or terrorism.

“Intellectual Property” means patents, trademarks, copyrights, trade secrets, database rights, and other protected rights recognised under Scots law.

“Personal Data” means information about an identifiable living individual.

These Terms are governed by Scots law. Terms defined under UK GDPR have the same meaning here.

3. Your Consumer Rights

1. If you use SPACETWO for personal purposes, you have statutory rights under the Consumer Rights Act 2015 that cannot be excluded or limited by these Terms.

2. Contact us about consumer issues at hello@spacetwo.xyz or visit spacetwo.xyz.

3. For information about consumer rights, visit: www.gov.uk/consumer-protection-rights

4. If you're a Consumer with a complaint and cannot resolve it with us, you may use the EU Online Dispute Resolution platform at: ec.europa.eu/odr

4. Account Registration and Eligibility

1. You must be at least 18 years old and legally capable of entering into binding contracts to use SPACETWO.

2. Some features require you to create an Account. When you register, you must provide accurate information and keep it updated.

3. You're responsible for keeping your Account credentials confidential and secure. All activity through your Account is your responsibility. If you suspect unauthorised access, notify us immediately at hello@spacetwo.xyz.

4. Each person may only have one Account.

5. We may refuse service, close Accounts, or remove Content at our discretion where necessary to protect our Service or comply with legal obligations.

5. Using Our Service

1. SPACETWO lets you upload, store, and share files within the limits of your service tier. You retain all ownership rights to your Content. We only use your Content to provide the Service – we don't use it for any other purpose.

2. You must use our Service lawfully and in accordance with these Terms.

3. You must not use SPACETWO to:

❌ Engage in or facilitate any criminal activity

❌ Violate any laws that apply to you or us

❌ Infringe anyone else's intellectual property rights, such as sharing copyrighted material without permission

❌ Damage our Platform or attempt to bypass security measures

❌ Upload or share illegal content under UK law, including: hate speech, violent content, child sexual abuse material, non-consensual intimate images, content promoting terrorism or extremism, or seriously harmful misinformation

❌ Facilitate money laundering, terrorist financing, or financial crime

❌ Send spam, conduct phishing, or engage in harassment

❌ Impersonate others or misrepresent your identity or affiliations

4. We may investigate whether you're complying with these Terms, either on our own initiative, following a complaint, or as required by law. This may include automated scanning of Content for malware, illegal material, and copyright infringement.

5. If you breach these Terms, we may: limit your access, remove your Content, suspend your Account, or terminate this Agreement. We'll normally give you notice and an opportunity to fix the problem first, unless immediate action is necessary to prevent harm, comply with legal obligations, or protect our Service. We'll explain why we've taken action and how you can appeal.

6. You must not attempt to circumvent any restrictions we place on your Account.

6. Pricing and Payment

1. Basic features are free. Premium “Pro” features require payment. All prices are in British Pounds Sterling (GBP) and include VAT where applicable.

2. When you subscribe to Pro, you authorise us to charge your payment method. Payments are processed securely by Stripe Inc.

3. Pro subscriptions renew automatically each month unless you cancel. We'll send you a reminder at least 7 days before each renewal.

4. You can cancel your Pro subscription anytime through your Account settings. Cancellation takes effect at the end of your current billing period. We don't provide refunds for partial months, except where required by law or if we fail to provide the Service.

5. Special promotional offers may have additional terms stated at the time of the offer.

6. We may change our pricing with 30 days' notice. Price changes won't affect your current billing period. Continuing to use Pro after the notice period means you accept the new pricing.

7. Consumers entitled to refunds under these Terms or UK law will receive refunds within 14 days using the same payment method used for the original purchase.

7. 🔐 Your Content and Our Rights

1. We own all intellectual property rights in our Service, including our website, software, logos, and platform design. Subject to these Terms, we grant you a non-exclusive, revocable, non-transferable license to use our Service for its intended purpose.

2. You retain full ownership of your Content. You grant us only the limited rights necessary to operate the Service: specifically, a non-exclusive, non-transferable license to store, transmit, and share your Content as you direct. This license exists only while your Content is on our platform and covers: (a) storing your files, (b) delivering files you've chosen to share, and (c) performing security scans and backups. When you delete Content or close your Account, this license ends, except where we must retain copies for legal or regulatory reasons.

3. You confirm that you have all necessary rights to upload and share your Content, and that your Content doesn't infringe anyone else's intellectual property rights.

4. We do not use your Content for AI training, advertising, data mining, or any commercial purpose beyond providing you the Service. We will not sell or license your Content to third parties.

5. If you believe Content on our platform infringes your intellectual property rights, email us at hello@spacetwo.xyz with: (a) details of the copyrighted work, (b) location of the infringing material, (c) your contact details, (d) a statement that you believe in good faith that the use is unauthorised, and (e) confirmation that the information is accurate and you're authorised to act for the rights holder.

8. 🔒 Data Protection and Privacy

1. We handle your personal data according to our Privacy Notice, which is part of this Agreement and explains what data we collect, how we use it, and your rights.

2. When your Content includes Personal Data about others, you are the data controller and we are the data processor. Our obligations as processor are detailed in Appendix 1: Data Processing Terms.

3. We use these third-party processors: Supabase Inc. (database and file storage), Vercel Inc. (hosting and delivery), and Stripe Inc. (payment processing for Pro users). Data is processed on servers in the European Economic Area and United States, with appropriate safeguards for international transfers including standard contractual clauses. We'll notify you 30 days before adding or changing processors.

4. You can exercise your data protection rights (access, correction, deletion, data portability, objection) by contacting hello@spacetwo.xyz. If you're unhappy with our data handling, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint/

9. Our Responsibilities and Limits

1. We cannot exclude liability for: (a) death or personal injury caused by our negligence, (b) fraud or fraudulent misrepresentation, (c) obligations under the Supply of Goods and Services Act 1982, or (d) anything else we cannot legally exclude.

2. Consumers: Nothing here affects your statutory rights under the Consumer Rights Act 2015. We'll provide the Service with reasonable care and skill, and we're liable if we fail to do so.

3. Subject to the above, we're not liable for:

Indirect losses including lost profits, revenue, business opportunities, goodwill, or data

Losses from inaccurate information you provided

Losses from Force Majeure events

Losses arising from your breach of these Terms or actions we take in response

Losses from unauthorised Account access due to your failure to keep credentials secure

Losses related to third-party services or content

4. Subject to sections 9.1 and 9.2, our total liability for all claims arising from these Terms, whether in contract, negligence, or otherwise, is limited to the greater of: (a) £500, or (b) the total fees you paid us in the 12 months before the event causing liability.

5. We provide the Service “as is” and “as available”. To the extent permitted by law, we disclaim implied warranties about availability, performance, or fitness for particular purposes. We don't guarantee error-free or uninterrupted operation, or that defects will be corrected.

6. Important: SPACETWO is a file-sharing platform, not a backup service. You are solely responsible for maintaining your own backup copies of important Content. We strongly recommend keeping separate backups of all critical files.

7. We'll make reasonable efforts to maintain Service availability and security, but cannot guarantee the Service will always be available or completely free from security vulnerabilities.

10. Ending This Agreement

1. Account holders: You can end this Agreement anytime by deleting your Account through your settings or emailing hello@spacetwo.xyz. We'll delete your Account data within 30 days, except information we must keep for legal reasons.

2. We may suspend or terminate your access if: (a) you materially breach these Terms and don't fix the problem within 14 days of our notice, (b) we're required to by law, (c) we cease providing the Service to all users, or (d) continuing would cause us legal or regulatory harm. We'll usually give reasonable notice before terminating, except where immediate termination is legally required or necessary to prevent harm.

3. When this Agreement ends, your right to use the Service stops immediately. We'll normally give you 30 days to download your Content before deletion, unless immediate deletion is legally required or necessary to prevent harm.

4. These sections survive termination: Section 7 (ownership provisions), Section 8 (Data Protection), Section 9 (liability limits), and Section 13 (governing law).

11. Changes to These Terms

1. We may modify these Terms. We'll give you at least 30 days' notice of material changes by email (if you have an Account) or by notice on our Platform.

2. If you don't agree with changes, you can delete your Account before they take effect (see Section 10). Using our Service after changes take effect means you accept the modified Terms.

3. We maintain previous versions of these Terms on our website.

12. General Legal Terms

1. Rights under these Terms are in addition to, not instead of, rights under Scots law, unless explicitly stated otherwise.

2. If we don't enforce a right immediately, that doesn't mean we've waived it. We can still enforce it later.

3. If any part of these Terms is found invalid or unenforceable, that part will be limited or removed to the minimum extent necessary, and the rest of the Terms remain in effect.

4. These Terms are the complete agreement between us about the Service and replace all prior agreements and understandings.

5. You cannot transfer your rights under these Terms without our written consent. We may assign these Terms to any affiliate or in connection with a merger, acquisition, or sale of assets, provided your rights aren't materially reduced.

6. Notices under these Terms must be in writing. Notices are deemed given when: delivered personally, sent by confirmed email, or three days after being sent by first-class post to the addresses in these Terms.

13. Governing Law and Disputes

1. These Terms and any disputes arising from them are governed by Scots law.

2. Business users: The Scottish courts have exclusive jurisdiction for disputes relating to these Terms.

3. Consumers: If you live in England, Wales, Northern Ireland, or the European Union, you can bring proceedings in your local courts. Nothing in these Terms affects your consumer protection rights in your jurisdiction.

14. Contact Information

Appendix 1: Data Processing Terms

These terms apply when your files contain personal information about other people.

1. Purpose and Application

1. These Data Processing Terms (“DPT”) ensure compliance with Article 28 of the UK GDPR and EU GDPR (together, “GDPR”) when we process Personal Data in your Content.

2. These DPT apply when your Content contains Personal Data. In this relationship, you are the data controller and we are your data processor.

3. These DPT don't reduce your obligations under GDPR.

4. For international data transfers, we use standard contractual clauses approved by the UK Information Commissioner's Office and European Commission.

2. How We Process Data

1. We only process Personal Data according to your instructions (through your use of the Service), unless required by UK or EU law. If law requires different processing, we'll inform you beforehand unless legally prohibited.

2. If we believe your instructions violate GDPR, we'll inform you immediately.

3. We process Personal Data only for the purposes specified in Section 9 of this Appendix: storing and sharing files as you direct.

4. We keep Personal Data only for the retention periods specified in Section 9: 7 days for Anonymous/Free users, 90 days for Pro users (or your custom setting).

3. Security Measures 🔐

1. We implement the technical and security measures described in Section 10 to protect Personal Data from unauthorised access, loss, alteration, or disclosure. We consider current technology, implementation costs, and the risks to individuals when determining appropriate security.

2. Only staff who need access to perform the Service can access Personal Data. All staff are bound by confidentiality obligations.

3. We only transfer Personal Data internationally based on your instructions or legal requirements, using appropriate safeguards like standard contractual clauses.

4. Both parties must be able to demonstrate compliance with these DPT.

5. We'll respond promptly to your inquiries about Personal Data processing.

6. We'll provide information needed to demonstrate compliance. At your reasonable request and expense, we'll permit audits of Personal Data processing at reasonable intervals or if there are compliance concerns. You may conduct audits yourself or through an independent auditor. We'll cooperate with audits conducted with reasonable notice during business hours to minimise disruption.

7. Both parties will provide audit information to supervisory authorities upon request.

4. Third-Party Processors

You authorise us to use these third-party processors:

Supabase Inc. – Database and file storage

Vercel Inc. – Hosting and content delivery

Stripe Inc. – Payment processing (Pro users only)

Processing occurs on servers in the European Economic Area and United States with appropriate safeguards including standard contractual clauses.

2. We'll notify you in writing at least 30 days before adding or replacing processors, giving you time to object on reasonable data protection grounds.

3. Our contracts with processors impose the same data protection obligations on them that we have under these DPT. We ensure processors comply with these obligations.

4. At your request, we'll provide copies of processor agreements (we may redact confidential information).

5. We remain fully responsible for processor performance. We'll notify you if a processor fails to meet its obligations.

5. 🤲 Helping You Meet Your Obligations

1. If we receive a request from someone about their Personal Data in your files, we'll notify you promptly and won't respond unless you authorise us to.

2. Taking into account how we process data, we'll assist you with technical and organisational measures to help you respond to individuals exercising their GDPR rights (access, correction, deletion, data portability, restriction, objection).

3. We'll also help you comply with:

Data protection impact assessments (DPIAs) when required

Consulting supervisory authorities when a DPIA shows high risks

Keeping Personal Data accurate and current – we'll notify you promptly if we discover inaccurate or outdated data

Security requirements under GDPR Article 32

6. 🚨 Data Breach Notification

1. If Personal Data is compromised, we'll cooperate to help you meet your GDPR obligations under Articles 33 and 34.

2. We'll notify you within 72 hours of discovering a Personal Data breach, including (where available):

Description of the breach, including categories and approximate numbers of affected individuals and records

Contact details for more information

Likely consequences of the breach

Measures taken or proposed to address the breach and mitigate harm

3. If we can't provide all information immediately, we'll send what's available and follow up with the rest as soon as possible.

7. ⛔ Non-Compliance and Termination

1. If we breach these DPT, you may instruct us to suspend Personal Data processing until we comply or the Agreement ends. We'll inform you promptly if we can't comply with these DPT for any reason.

2. If we inform you that your instructions violate GDPR and you insist we follow them anyway, we may terminate the Agreement as it relates to Personal Data processing.

3. When the Agreement ends, we'll (at your choice): (a) delete all Personal Data and certify deletion, or (b) return all Personal Data to you and delete copies, unless UK or EU law requires us to keep it. Until deletion or return, we'll continue complying with these DPT.

8. GDPR Terms

Terms defined in GDPR have the same meaning here. These DPT must be interpreted consistently with GDPR and in a way that protects individuals' fundamental rights. If these DPT conflict with the main Terms on Personal Data processing matters, these DPT prevail.

9. Processing Details

Categories of individuals: Any individuals whose Personal Data appears in Content you upload.

Categories of Personal Data: Any categories, as determined by the Content you choose to upload.

Processing activities: Storage, transmission, and delivery of Content.

Purpose: Storing and sharing Content as you instruct through your use of the Service.

Retention periods:

Free users: X days after upload

Pro users: 90 days after upload (or your custom expiration)

10. 🛡️ Security Measures

We implement these security measures:

🔐 Encryption — TLS 1.3 for data in transit, AES-256 for data at rest

🌐 Infrastructure — Vercel edge network with DDoS protection and automatic scaling

👮 Access Control — Role-based access with least privilege principle, multi-factor authentication for administrative access

💾 Data Storage — Supabase PostgreSQL with integrated file storage, hosted in EU and US regions with appropriate safeguards

⚡ Availability — Distributed edge network for high availability, regular automated backups

📊 Monitoring — Vercel Analytics and Supabase monitoring, automated security monitoring and anomaly detection

🗑️ Data Minimisation — Automatic deletion when retention periods expire

🤐 Confidentiality — All staff with access bound by confidentiality obligations

🚨 Incident Response — Documented procedures for responding to data breaches

✅ Vendor Security — All third-party processors vetted for security compliance