Privacy policy

When an account is created we record:

• your name, your email address, and the password you choose — stored only as an Argon2id hash, never in a form anybody here can read;
• your business’s display name, its registered legal name, and the web address you chose;
• the six-digit codes we email to confirm an address or reset a password — kept as a hash, like the password, and swept away shortly after they are used or expire;
• who else you invite to the account, and what each person is allowed to do.

Signing in writes a session record. It holds a hash of the session token, when it expires, when it was last used, and the IP address and browser identification of the device that signed in. That is how a session can be recognised and cut off, and we would rather say it plainly than claim we hold no IP address at all.

We do not ask for a physical address, an identity number, a date of birth or a phone number, and there is nowhere in Space to put one.

Your catalogue: products and their variants, the width, height and depth you approve, 3D models you upload, photographs you upload as rendering references, posters, supporting documents, your logo, your brand colours, your website domain, and the support and privacy addresses you want shown.

Uploads are private. Source models and reference photographs go to a storage bucket that is not publicly readable, and they are reachable only through a short-lived signed link issued to somebody signed in to your account. When a reference photograph passes our checks, a frozen copy of it is kept — that copy, and only that copy, is what a render is built from, so what was approved and what was used cannot drift apart.

Every query in the application is scoped to one business. Another business asking for something of yours is answered as though it does not exist.

Publishing an object copies its approved derivative files — the 3D model for each kind of device, a poster image, and a small manifest describing them — into a public bucket, served from a public asset address. The object’s page is unlisted rather than secret: whoever holds the link can open it, search engines are asked not to index it, and a business address on its own shows nothing.

Published files are immutable and cached for a year, which is what makes a shopper’s second visit instant. It has a consequence we will not dress up:

If something has to come down, write to us and say so — that action exists and we will take it. What we will not do is tell you it happens by itself.

Payments are taken by Paystack. Full card details are typed into Paystack’s own window and never reach Space. We never see or store a full card number, and never a CVV.

What we keep against your business after a payment:

• an authorisation token from Paystack, which lets us charge the same card next month and does nothing anywhere else;
• the card brand, its last four digits and its expiry month and year, so the billing screen can tell you which card is on file;
• the email address used at checkout, and for each charge the amount, currency, status and Paystack’s reference.

Paystack processes your payment under its own terms and its own privacy policy.

3D rendering assistance is produced with the help of a specialist third-party rendering service. When you order a render, what leaves Space is:

• the reference photographs you selected — sent as expiring links that point at the frozen copies rather than at your upload slots, and that stop working within the hour;
• the variant’s width, height and depth;
• a technical ceiling on how detailed the result may be.

Your name, your business name, your email address and the product’s name are not sent. The service receives photographs and three numbers, and we send it nothing that names you — though a photograph of your product may of course show your own branding. The link it hands back to collect the finished model is used the moment it arrives and is never written down.

That service operates outside South Africa. We will tell you which service it is if you ask — see your rights.

Space sends transactional email only — messages about something that happened in your account:

• the code that confirms your email address, and password resets;
• a model is ready for you to review;
• a render finished, or a render could not be delivered;
• a payment receipt, a failed payment, a suspension, a plan activated.

Each message is written to an outbox inside your account’s own transaction and handed to the workflow service that sends it, which receives the recipient address and the few fields that message needs.

There is no marketing list, no newsletter and no advertising or behavioural tracking in anything we send.

A published object page reports a small, fixed set of facts so a retailer can see whether the feature works: a page view, whether the model loaded, whether AR was attempted, whether it succeeded, and if it failed, why. Each event may also carry which AR route the device took, a device class of mobile, tablet, desktop or other, and a coarse timing band.

A scheduled job deletes raw event rows once they pass the platform’s analytics retention window — 90 days as it is configured. We do not use these rows to identify anybody, and Space holds nothing that would let us do so.

One honest caveat: serving any web page means our hosting and our API process the request, and a request necessarily carries an IP address. We do not store one against an event, we do not build a profile from one, and we do not claim one is never processed.

Space uses one cookie:

• space_session — set when you sign in. It is HttpOnly, so no script on the page can read it, and it lasts 30 days or until you sign out.

The short-lived token used for each API call is held in memory only and is deliberately never written to your browser’s storage, so closing the tab loses it. Your light or dark theme choice is stored locally in your own browser under space.theme and is never sent to us.

There are no advertising cookies, no analytics cookies and no cross-site trackers anywhere in Space — including on a published object page, which sets no Space cookie at all.

Space keeps an append-only record of the decisions made on an account — a model approved, an object published, disabled or rolled back, a plan cancelled, a render closed, a credit granted — with who did it and when. It is not changed after the fact and it is not deleted on request: it is the record of what happened to a catalogue, and it is what lets us answer honestly when somebody asks why something changed.

Space is not built out of nothing. Behind it are:

• Cloudflare — serves the application and stores every file, private and published;
• Paystack — takes payments and holds the card details we never see;
• a managed PostgreSQL database service, which holds the application’s records;
• the workflow service that delivers our transactional email;
• the specialist rendering service described above, and only when you order a render.

We do not sell personal information, and we do not share it with anybody for their own marketing.

• Your account and catalogue — for as long as the account exists. There is no automatic deletion, and we would rather say that than publish a schedule nothing runs.
• Sign-in sessions — a session lasts 30 days. Expired and revoked session rows are cleared 30 days after they stop being usable.
• One-time email codes — cleared 24 hours after they expire or are used.
• Object-page analytics — deleted on a rolling window, 90 days as configured.
• Published files — until somebody removes them, as described above.
• Payment and charge records — kept for as long as we need them for accounting and tax.

Under the Protection of Personal Information Act 4 of 2013, and any other law that applies to you, you may ask us what we hold about you, ask us to correct it, object to how we use it, and ask us to delete it. You may also complain to the Information Regulator (South Africa).

The way to exercise any of these is to write to space@spacecodestudios.com from the address on the account. There is no form and no portal.

If you want to know which specific providers processed something of yours — including which rendering service built a particular model — ask, and we will tell you.

You reached a Space page because a retailer put a link on their product page. We do not know who you are and we do not attempt to find out.

• Placing an item in your room uses your device’s own AR. Your camera runs on your phone, for you. No camera frame, room scan, room measurement or location is ever uploaded to Space — there is no code in the product that could.
• The page reports only the anonymous facts described above, and sets no cookie.
• Questions about the product, the price or your order belong with the retailer, not with us. Questions about the page itself can come to space@spacecodestudios.com.

• passwords stored as Argon2id hashes, never recoverable;
• the session cookie is HttpOnly, so no script can read it, and the API token is never written to browser storage;
• every query is scoped to one business, and a request for another business’s record is answered as not found rather than forbidden — so the answer itself gives nothing away;
• uploads live in a bucket that is not publicly readable, reached only through short-lived signed links;
• webhook addresses and other secrets are stripped out of the error messages and logs Space keeps for diagnosis. The stored Paystack authorisation token is the deliberate exception: it is what charges next month’s subscription, and it is described above;
• sign-in, public page resolution and event reporting are each rate limited.

No system is perfect. If you think you have found a weakness in Space, write to space@spacecodestudios.com and we will take it seriously.

The version date in the block at the top of this page is the version you are reading. When this policy changes, the new version is published here with a new date.

SpaceCode Studios (Pty) Ltd — space@spacecodestudios.com. The terms and conditions and the refunds and cancellations policy complete the set.