Spaces.fm (“we”) operates the Spaces.fm app and website. This Privacy Policy explains what personal data we collect, why, and the rights you have under the EU General Data Protection Regulation (GDPR) and, where applicable, Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, as reformed in 2025).
1. Who is the data controller
Spaces.fm, KvK 42173515 · VAT/BTW NL005556901B97 · Beverwijk, the Netherlands, contactable at legal@spaces.fm.
2. What we collect
Account data: email address, an optional display name, a preferred language, the date you signed up.
Activity data: the practices and sessions you start (breathe, stillness, wisdom, listening, mixer, frequencies), their category and source (e.g. picked from a specific collection, espacio or curated set), how long they last, and the track you played. Used to compute your stats, streaks and awards.
Content you create: favorites you save, the Espacio mixes you create (name, layer list, per-layer volume), and the frequency stacks you save (name and each voice's settings: mode, frequency, carrier or beat, waveform, volume).
Onboarding & preferences: the intents you pick during onboarding (e.g. focus, sleep, calm), your notification preferences, and a record of the Terms version and timestamp you accepted.
Consent records: when you give a specific, optional consent (for example the EU cooling-off-period waiver at checkout, or contact permission in feedback), we store a record of the consent type, version, locale and surface in an internal consents log. This is how we can prove, and honour, what you agreed to.
Feedback (optional): if you use the feedback panel, we store the score you gave, an optional NPS score, the intents you selected, your free-text suggestion, whether you agree to be contacted about it, plus the app route and version at the moment you submitted.
Team interest (optional): if you submit the “Spaces.fm for teams” form, we store the business email, company, team size, message and locale you provided so we can reply.
Subscription data: if you start a Premium trial or subscription, Stripe processes your payment. We store a Stripe customer ID, subscription status, current period end, and which price you bought. We never see or store your card details.
Technical data: standard server request data (IP address, user agent, timestamps) for short-term security and abuse prevention. We also derive your approximate country from your IP address to show regional pricing and prevent pricing abuse.
3. Why we use it (legal bases)
Contract (GDPR Art. 6(1)(b)): to give you an account, deliver sounds and practices, and process your subscription.
Legitimate interest (Art. 6(1)(f)): service security, fraud and abuse prevention, regional pricing, aggregate product statistics computed from your activity, cookieless visit counts (Cloudflare Web Analytics), and subscription conversion events (trial started, paid, canceled) linked to your account id only.
Consent (Art. 6(1)(a)): product analytics and session replay (PostHog), only if you click "Accept" in the cookie banner and withdrawable via "Cookie settings"; optional feedback submissions, team-interest submissions, and specific opt-ins such as the EU cooling-off-period waiver at checkout. You can withdraw consent at any time by writing to legal@spaces.fm; withdrawal does not affect the lawfulness of processing before you withdrew. Withdrawal applies to future processing. The legal effect of the cooling-off waiver on a purchase you already made is governed by the Terms and the Refund Policy. Consents are recorded in our internal consents log (see §2).
Legal obligation (Art. 6(1)(c)): tax, accounting, and consumer-law obligations.
4. Who we share it with (processors)
These processors act on our instructions under data-processing agreements (DPAs). Where data leaves the EEA, we rely on EU Standard Contractual Clauses and supplementary measures per each DPA. We do not sell personal data and we do not share it with advertisers.
| Processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage, account emails (verification, password reset) | EU (Frankfurt) | DPA; data stored in the EEA |
| Stripe Payments Europe, Ltd. | Payments, subscription billing, tax | Ireland (EU) | DPA; SCCs for any non-EEA transfers |
| Resend, Inc. | Service and product emails (e.g. trial reminders, product updates you've opted into) | United States | DPA + SCCs |
| Cloudflare, Inc. | Edge hosting and content delivery | Global edge network | DPA + SCCs and supplementary measures |
| PostHog Inc. | Product analytics, heatmaps and session replay (only with your consent); subscription conversion events | EU (Frankfurt) | DPA; data stored in the EEA |
Session replays mask everything you type. We never send your email or name to PostHog.
5. How long we keep it
- Account, profile, content and practice data: while your account is active.
- After you ask us to delete your account, data is removed within 30 days. During that window you can cancel deletion by signing in.
- Feedback submissions: kept while relevant to improving the product.
- Team-interest submissions: kept until your request is handled, plus a reasonable follow-up period.
- Invoices and tax records: kept as long as Dutch and EU tax law requires (typically 7 years), in a separate accounting system.
6. Your rights
You can ask us to access, correct, export, or delete your data, to restrict or object to processing, and to withdraw consent at any time. Email legal@spaces.fm from your account address. You can also delete your account yourself in Account → Delete account.
EU residents may lodge a complaint with their national Data Protection Authority (in the Netherlands: Autoriteit Persoonsgegevens).
Mexican residents may exercise ARCO rights (Access, Rectification, Cancellation, Opposition) by writing to the same email, and may contact the Mexican data-protection authority (currently the Secretaría Anticorrupción y Buen Gobierno, which assumed the functions of the former INAI).
Wherever you live, we voluntarily extend the same GDPR-level rights described above to you. Local law may give you additional rights, which we will honour.
7. Cookies
We use a small number of strictly-necessary cookies for sign-in, session management, and your language preference. We do not use advertising cookies. See the Cookie Policy for the full list, including similar technologies such as local storage.
8. Children
Spaces.fm is not directed to children under 16. We do not knowingly collect data from children under 16.
9. Changes
Material changes will be announced on this page with a new “last updated” date and, if you have an account, by email.