Privacy Policy

Introduction

SpaceNexus LLC ("SpaceNexus," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site.

Information We Collect

Personal Data

We may collect personally identifiable information that you voluntarily provide to us when you:

• Register for an account
• Subscribe to our newsletter
• Fill out a contact form
• Submit feature requests or feedback
• Participate in surveys or promotions

This information may include your name, email address, company name, job title, and other contact or identifying information you choose to provide.

Automatically Collected Data

When you access our platform, we automatically collect certain information, including:

• Device information (browser type, operating system, device type)
• Log data (IP address, access times, pages viewed, referring URL)
• Usage patterns and feature interactions
• For signed-in accounts we record when the account is used, only after you move the pointer, click, tap, scroll or press a key on a page (a tab left open on its own never counts): the time of your latest activity (updated at most once every 5 minutes), when your previous visit ended (a visit ends after 30 minutes without activity), which days the account was used, a count of your visit days and when you first came back on a later day. We use it to show what changed since your last visit and, as totals only, to measure whether the site is worth coming back to. The day records are kept at most 13 months; the rest is a few latest values on your account. All of it is in your account data download and is deleted with the account.
• If you create an account with an email address and password, your account records which kind of sign-up link or box you used (for example a launch page or the end of an article), as a short label. It never records the web address or the page you came from. It is in your account data download and is deleted with the account.
• When you sign up for an account, an email alert or a newsletter, the sign-up also records how that visit reached us, as a broad category (for example search, social media, an email, an AI assistant, an ad or a direct visit) and, if the link you followed had one, the campaign name we gave that link. It never records the address of the page you came from, an ad click id or anything that identifies you, and nothing is stored on your device to carry it. For accounts it is in your account data download and is deleted with the account.
• We count visits with a monthly-changing, one-way code made from your connection details; it is never stored on your device, never linked across months, and deleted after 31 days.
• On our monthly launch schedule pages we are testing which sign-up box comes first. Each page load is shown one version at random, and the choice is not stored on your device: no cookie, no identifier. We keep only daily totals per version (how many times each was shown and used). If you sign up there, your subscription records which version you signed up from, as it already records where on the site you signed up.
• For each job listing we count, per day, anonymous totals of views and apply clicks to show employers how their listings perform, without storing any address, browser string or identifier.
• If you turn on browser push notifications, the push subscription your browser gives us (an address at your browser's push service and its keys), used only to deliver the notifications you chose

Mobile Apps

SpaceNexus offers apps for iPhone and iPad (App Store) and for Android (Google Play). The apps show this website inside the app, so the same account, the same data and this same policy apply. In addition:

• App identification: the apps add the word "SpaceNexusApp" to the browser identification they send, so our site can show app-specific screens. It identifies the app, not you.
• Device permissions: the apps do not read your contacts, photos, camera, microphone or location. They ask for permission to send notifications only when you turn on app alerts.
• Push notifications: when app notifications are available and you turn them on, Apple (Apple Push Notification service) or Google (Firebase Cloud Messaging) gives the app a device token, which we store with your account only to deliver the alerts you chose. Turning notifications off, or deleting your account, removes it.
• Sign-in: signing in with Google opens your phone's browser, then returns you to the app with a one-time code that expires within a minute. If you use Sign in with Apple, Apple gives us a stable identifier for your Apple ID and the email address you choose to share, which may be a private relay address that forwards to you; your name is shared only the first time, if you allow it. We keep a token from Apple only so that deleting your account can revoke it.
• In-app subscriptions: subscriptions bought in the apps are processed by Apple or Google. We never receive your card or bank details. RevenueCat manages the subscription records for us: it receives your SpaceNexus account identifier (an internal number, not your email address), the products you bought, their status, renewal and expiry dates, the store's transaction identifiers, and the country and currency of the store. We use this only to switch your plan on or off and to keep our sales records.
• No tracking across apps: the apps do not track you across other companies' apps or websites, do not use the advertising identifier, and do not show personalised advertising.

Community Data

When you use our community features, we collect:

• Forum posts, threads, and replies you create
• Messages you post in a launch live chat, with the display name shown beside them
• Companies and other subjects you choose to follow
• Content reports you submit
• Your moderation history (warnings, mutes, bans)

Company Profile Claims and Enquiries

• Claim requests: when you ask to claim a company profile we keep your account, the business email you give, any note you add, how your claim was checked and the decision. To check the business email we send it a one-time link.
• Sanctions screening: we check every company profile claim, every job post and every advertising, sponsor-slot and partner-article order against the U.S. Treasury (OFAC) sanctions lists, and keep a dated record of the names checked and the result.
• Enquiries to companies: if a company profile offers a contact form and you use it, we first email you a link to confirm your address. Only after you confirm do we send your name, email, company, phone and message to that company. The company then holds them as its own record and decides how to use them (it is an independent controller of that copy).
• We never sell enquiries, claim details or contact details.

Launch Reminders Without an Account

• Email reminders: when you ask for launch alerts by email we keep your address, what you asked to hear about, when you confirmed, and which part of the site you asked from (a page name, never anything about you). Every alert has a one-click stop link.
• Reminder key: when you confirm a launch alert in a browser, or open Your launches from an alert email and choose “Remember this device”, that browser keeps a random key in its local storage (not a cookie) under sn-launches-key. We store only a one-way hash of it, the address it belongs to, and when it was made and last used. It lets that browser add or stop launch reminders for that address in one tap and open Your launches. Every reminder added with it sends that address a receipt with a stop link. “Forget this device” on Your launches, or the link in any receipt, switches the key off; clearing this site's data removes it from the browser.
• Private calendar link: if you ask Your launches for a calendar link of everything you follow, we keep a random token for it and count how often it is fetched (a number, never who fetched it). Anyone with the link can see which launches you follow, so keep it to yourself.
• App notifications without an account: if you turn on notifications for a launch in the SpaceNexus app without signing in, we store the device token Apple or Google gives the app, a random key for that device and the launches you chose, only to send those alerts. Stopping them on Your launches, or turning notifications off, removes them.

How We Use Your Information

We use the information we collect for various purposes, including:

• Providing, operating, and maintaining our services
• Improving, personalizing, and expanding our platform
• Understanding and analyzing how you use our services
• Developing new products, services, features, and functionality
• Communicating with you about updates, security alerts, and support
• Sending you marketing and promotional communications (with your consent)
• Processing transactions and managing your account
• Detecting, preventing, and addressing technical issues and fraud
• Complying with legal obligations
• Moderating community content for compliance with our Community Guidelines
• Processing content reports and enforcing platform rules

Information Sharing and Disclosure

We may share your information in the following situations:

Service Providers

We share information with service providers who perform services on our behalf. Today they are:

• Railway: hosts the site and its database
• Stripe: processes payments and subscriptions on the website
• Apple and Google: process subscriptions bought in our iOS and Android apps (the App Store and Google Play), and Apple provides Sign in with Apple if you use it
• RevenueCat: manages the records of subscriptions bought in our apps, as described under Mobile Apps
• Resend: delivers our emails (account, alert and newsletter email)
• Google Analytics: measures site usage, including the approximate country and region Google works out from your IP address, only after you accept analytics cookies
• Google AdSense: may serve ads to free-plan visitors, only after you accept advertising cookies
• Google Workspace and Gmail: host our own mailboxes, so email you send us, and the notices of contact-form messages we send ourselves, are stored there
• YouTube: launch video players load from YouTube's privacy-enhanced domain (youtube-nocookie.com), which receives your IP address and browser details when a player loads
• Your browser's or phone's push service (for example Google, Apple or Mozilla): delivers the push notifications you turn on

Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

With Your Consent

We may share your information for other purposes with your explicit consent.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our platform and store certain information. Cookies are files with a small amount of data that may include an anonymous unique identifier.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our service.

For more detailed information about the cookies we use, please see our Cookie Policy.

Data Security

We take technical measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. They include:

• Data sent between your browser and SpaceNexus travels over HTTPS, and browsers are told to use HTTPS only (HSTS)
• Your data is stored in a database with our hosting provider, Railway
• Passwords are stored only as bcrypt hashes, never in readable form
• Card details go straight to Stripe; we never see or store your card number
• Sign-in attempts are rate limited, and administrative tools require an administrator account

Our Security page describes these measures in more detail, including what we do not have yet.

However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal information
• Portability: Request a copy of your data in a portable format
• Objection: Object to processing of your personal information
• Restriction: Request restriction of processing your data
• Withdrawal: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us using the information provided below. You can also download a copy of your account data (profile, forum posts, messages, follows, alert rules, saved searches and watchlist) at any time from your Account Settings page; for anything that download does not cover, contact us and we will send it.

Global Privacy Control (GPC)

We respect the Global Privacy Control (GPC) signal. When we detect a GPC signal from your browser, we treat it as a valid opt-out request for the sale or sharing of your personal information, consistent with applicable state privacy laws including the CCPA, VCDPA, CPA, and CTDPA.

You can learn more about GPC at globalprivacycontrol.org.

Account Deletion

You can permanently delete your account and all associated data at any time through the Account Settings page. Account deletion is immediate and irreversible. All your personal data, preferences, saved searches, watchlists, API keys, and other account-related information will be permanently removed from our systems. The same page works inside our apps. Deleting your account does not cancel a subscription you bought through the App Store or Google Play: cancel it in the store first (the steps are on our Support page). If you signed in with Apple, deleting your account also revokes the sign-in we hold from Apple.

Data Retention

We retain different types of data for different periods, depending on the purpose for which it was collected and our legal obligations:

• Account data: Retained until you delete your account
• Forum posts and threads: Retained until deleted by you or removed by a moderator
• Content reports and moderation records: Kept for safety and legal purposes. We do not yet delete them automatically on a fixed schedule; ask us and we will review a deletion request
• Server logs: Kept by our hosting provider for its standard log-retention period
• Company claim requests: kept while the claim is active; a request that is rejected or withdrawn is kept for 90 days after the decision, then deleted
• Enquiries sent to companies: our copy is kept for 12 months, then deleted. An enquiry whose sender never confirmed their email is deleted about a week after its link expires
• Sanctions screening records: kept as a dated record of the check, for as long as the law that requires the check may need it
• Newsletter subscription data: Until you unsubscribe
• Days a signed-in account was used: at most 13 months, and deleted with the account
• Page experiment totals: daily totals per version of a page only, with nothing about any visitor
• SpaceNexus Research saved work (saved screens and their alert settings, portfolios, seat assignments and briefing-call registrations): kept when a Research plan is cancelled or expires, so everything is there if you restore the plan. While the plan is off, screen alerts are not sent and seats cannot be used. Deleted when you delete your account.

When we no longer need your information, we will securely delete or anonymize it.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country. We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy.

Children's Privacy

You must be at least 16 years old to use our services, and at least 18 years old, or the age of majority where you live if that is older, to buy a subscription or any other paid service (see the Terms of Service). We do not knowingly collect personal information from children under 16. If you become aware that a child under 16 has provided us with personal information, please contact us and we will take steps to delete such information.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: