Privacy Policy

Digital Space is a developer-led studio based in England and Wales. This policy covers https://www.digital-space.io, our contact forms, and the social media scheduling platform we operate for clients (the “Platform”).

For personal data submitted through this website, and for our own business records, we are the data controller. For content and account data held in the Platform on behalf of a client, we act as a data processor and the client is the controller.

Questions, requests or complaints: privacy@digital-space.io.

Information you give us. Your name, email address, company and the content of your message when you use a contact form or email us.

Information from connected social accounts.When you authorise a social media account in the Platform, we receive from that platform’s API:

• OAuth access and refresh tokens, and the scopes you granted (these are credentials, not passwords; we never see or receive your password)
• Account identifiers and public profile details: account or page ID, handle, display name, avatar and the list of pages or profiles you chose to connect
• Posts and media you or your team create, schedule or publish through the Platform, and their delivery status
• Aggregate performance metrics for those posts (impressions, reach, engagement counts) where the platform makes them available and you have granted the relevant scope

Technical information. Server logs containing IP address, browser user agent and timestamps, retained for security and debugging.

We do not collect special category data, and we ask that you do not submit it to us.

• To reply to enquiries and to provide the services set out in our contract with you
• To publish, schedule and report on content on the connected accounts, at your instruction
• To keep connections alive by refreshing tokens before they expire
• To secure, monitor, debug and back up the Platform
• To meet our legal, accounting and tax obligations

We do not sell, rent or share your data with advertisers or data brokers. We do not use content or metrics from connected accounts to train machine learning models. We do not use your data for our own marketing without your consent.

Under the UK GDPR and EU GDPR we rely on:

• Contract: to deliver the services a client has engaged us for, including operating the Platform
• Consent: for connecting a social account, which you give through that platform’s own OAuth screen and can withdraw at any time by disconnecting
• Legitimate interests: to respond to enquiries, secure our systems and prevent abuse, balanced against your rights
• Legal obligation: for financial records and lawful requests

The Platform integrates with Meta (Facebook Pages and Instagram Professional accounts), TikTok, X (formerly Twitter), LinkedIn (personal profiles and company pages), YouTube. Use of information received from these APIs adheres to each provider’s developer terms and platform policies, including the Meta Platform Terms and Developer Policies, the TikTok Developer Terms of Service, the X Developer Agreement and Policy, the LinkedIn API Terms of Use, and, where the YouTube API Services are used, the YouTube Terms of Service and the Google Privacy Policy.

Specifically, we commit that:

• We request the minimum scopes needed to publish and report on content, and nothing more
• Platform data is used only to provide features you have asked for, never to build advertising profiles, enrich third-party datasets or train models
• Access tokens are encrypted at rest and are never shared between client workspaces
• Revoking access in the platform’s own settings, or disconnecting inside the Platform, immediately stops all further access and triggers deletion of the stored token

We use a small number of vetted sub-processors, each bound by a data processing agreement or the provider’s standard terms:

• Hosting and storage: Hetzner Online GmbH data centres in Germany (EU), where the Platform, its database and its backups reside
• Website hosting: Vercel Inc. hosts this marketing website (contract/legitimate interests: delivering the site to you)
• CMS and database: our content management system and Postgres database run on a VPS managed through Coolify, hosted by Hetzner Online GmbH in the EU (contract/legitimate interests)
• Email delivery: Resend is used to send and deliver contact-form notification emails (contract: responding to your enquiry)
• Spam protection: Cloudflare Turnstile verifies contact-form submissions are not automated; it may process your IP address and browser signals (legitimate interests: preventing abuse)
• Analytics: Google Analytics 4, only if you consent via the cookie banner. See our Cookies Policy (consent)
• Appointment booking: where offered, Google Calendar is used to schedule a call at your request (contract/consent)
• Social media platforms: content you schedule is transmitted to the platform you selected, in order to publish it
• Email and business tooling: used to correspond with you and keep records

We will also disclose data where we are legally required to, or to establish or defend legal claims. If our business is ever transferred, we will tell you before your data moves.

The Platform and its database are hosted in Hetzner Online GmbH data centres in Germany (EU). Data may be accessed by us from the United Kingdom, which the European Commission has recognised as providing an adequate level of protection. Where any transfer falls outside the UK or EEA, we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

• Enquiry messages: up to 24 months from our last exchange, then deleted
• OAuth tokens: until you disconnect the account or revoke access, then deleted immediately
• Scheduled and published content, and metrics: for the life of the client account, then deleted within 30 days of termination
• Server logs: 90 days
• Invoices and financial records: 6 years, as required by UK tax law

You have the right to access, correct, erase, restrict or object to our processing of your personal data, to data portability, and to withdraw consent at any time. Exercising these rights is free and we will respond within one month.

To make a request, email privacy@digital-space.io. For deleting data held about a connected social account, see our data deletion instructions.

If you are not satisfied with our response you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to your local supervisory authority in the EEA.

All traffic is served over HTTPS. Access tokens and other credentials are encrypted at rest. Administrative access is limited to named personnel, protected by multi-factor authentication, and each client’s content sits in a separate workspace. Backups are encrypted. No system is perfectly secure, but if a breach affects your rights we will notify you and the relevant regulator without undue delay.

This website uses essential cookies/local storage to run and to remember your cookie choice, plus optional analytics cookies (Google Analytics 4) that only load if you accept them. The Platform sets a session cookie to keep you signed in. We do not run advertising or cross-site tracking cookies. See our Cookies Policy for details and how to change your choice.

Our services are for businesses and are not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with data, contact us and we will delete it.

We may update this policy as our services change. The date at the top of this page always reflects the current version, and we will tell active clients directly about any material change before it takes effect.