Legal

Privacy Policy

1. Who we are

SpaceStatus is the data controller for personal data collected through this platform. You can find our full contact details in the Legal Notice (Imprint). For anything privacy-related, write to [email protected].

2. What we collect

2.1 Account data

When you register, we collect your full name, work email address, and a hashed version of your password. We use this to identify you and to run the Service under your chosen plan.

2.2 Microsoft 365 calendar data

When you connect your Microsoft 365 tenant, SpaceStatus fetches room calendar data through the Microsoft Graph API. That includes room mailbox addresses, meeting titles, booking start and end times, and room metadata like building, floor, and capacity. This data is pulled in real time to build the availability display. It is not stored permanently. Each request fetches fresh data, renders it, and discards it.

We do not access personal mailboxes, attendee lists, meeting body content, or anything outside of room resource calendars.

2.3 Display device identifiers

When a screen opens /display, a random identifier is saved in the browser's localStorage. This keeps the pairing between the screen and a board intact across page loads. It is not linked to any individual person.

2.4 Authentication cookie

When you sign in to the dashboard, an authentication session is stored in an httpOnly cookie in your browser. This means page scripts cannot read it, which protects it from a certain class of attack. It expires automatically after 7 days and is cleared server-side when you sign out.

2.5 Analytics

With your consent, we use Google Analytics 4 to collect anonymised usage data such as page views, session duration, and navigation paths. We use Google's Consent Mode v2: no cookies and no personally identifiable data are sent to Google unless you accept via the cookie banner, and your IP address is anonymised before anything reaches Google.

If you click "Essential only" in the banner, no cookies or identifying data are sent to Google. A minimal, cookieless technical ping may still occur as part of how Consent Mode v2 operates, but it carries no cookie, no identifier, and no usage data about you.

2.6 Server logs

Our servers automatically record standard access logs: IP addresses, request paths, timestamps, and HTTP status codes. We use these for security monitoring and debugging. Logs are kept for a maximum of 90 days.

3. Why we use your data

4. How long we keep data

• Account data: Kept while your account is active, plus 30 days after deletion so you can recover it if needed. After that, it is permanently deleted.
• Calendar data: Not stored at all. Fetched fresh on each request.
• Device identifiers: Stored in your browser only. We do not store them on our servers beyond the active pairing record.
• Server logs: Kept for 90 days, then deleted.
• Analytics data: Controlled by Google's retention settings, which default to 14 months in GA4. You can request deletion at any time.

5. Third parties we use

SpaceStatus relies on the following third-party services to run:

• Microsoft Azure / Microsoft Graph API: Used to retrieve calendar data. Data may be processed in Microsoft's EU or global data centres, under Microsoft's Data Processing Addendum.
• Stripe Payments Europe Ltd: Used to process subscription payments, generate invoices, and store payment method details. Stripe handles your card details directly; we never see or store your full card number. Data transfers to Stripe entities outside the EEA are covered by Standard Contractual Clauses.
• SMTP2GO: Used to deliver transactional emails, such as account verification, password resets, and billing notifications. Only your email address, name, and the relevant message content are shared.
• Google Analytics 4: Used for usage analytics, only if you have given consent. Data is processed by Google LLC in the United States. IP addresses are anonymised. Standard Contractual Clauses cover the EEA-to-US transfer.
• Google Fonts: Used for web fonts. When fonts load, Google's servers receive your IP address. The display page (/display) does not load Google Fonts.

We do not sell, rent, or pass your personal data to any third party for marketing.

6. Data transfers outside Switzerland

SpaceStatus is operated from Switzerland. Some of the services we use, notably Google, may transfer data to the United States. Those transfers rely on EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Switzerland recognises these safeguards under its own adequacy decisions.

7. Your rights

Under GDPR and the Swiss nFADP, you have the right to:

• Access: ask for a copy of your personal data
• Rectification: correct anything that is wrong or out of date
• Erasure: ask us to delete your data
• Restriction: ask us to pause how we use your data
• Portability: receive your data in a format you can use elsewhere
• Objection: push back on processing we do based on legitimate interests
• Withdraw consent: change your analytics preference at any time using the cookie banner

To use any of these rights, write to [email protected]. We will respond within 30 days. You can also file a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), or with your local data protection authority.

8. Cookies and browser storage

SpaceStatus sets one first-party, httpOnly session cookie when you sign in, strictly to keep you logged in. It cannot be read by page scripts, is not used for tracking or advertising, and is not shared with any third party. It is essential to the Service and is not subject to cookie consent rules. We also use browser localStorage for the display device identifier described in 2.3, which likewise stays in the browser and is not shared with third parties.

Google Fonts and Google Analytics may set their own third-party cookies when you consent. You can manage these through the cookie banner or through your browser settings.

9. Security

We use TLS encryption for all data in transit, PBKDF2 (SHA-256, 310,000 iterations) for password hashing, and access controls on every API endpoint. That said, no internet service is completely secure, and we cannot make absolute guarantees.

10. Children

SpaceStatus is a business tool. It is not aimed at children under 16. We do not knowingly collect data from children. If you believe we have done so by mistake, please contact [email protected] and we will remove it.

11. Changes to this policy

We may update this policy from time to time. For significant changes, we will let you know by email or through a notice in the dashboard, at least 14 days before the changes take effect. The date at the top of this page always shows when it was last updated.

Privacy questions: [email protected]. See also our Terms of Service, DPA, and Imprint.