RetainSpace
Privacy
Privacy Policy
1. Who we are
RetainSpace is operated by Social Impact Ltd, a company registered in England and Wales (company number 08995296), registered office 12 Limedale Avenue, Oakwood, Derby, England, DE21 2UE ("we", "us", "RetainSpace"). We are the data controller for the personal data described in this policy, except where we act as a processor on a consultant's behalf (see section 4).
For any privacy question or to exercise your rights, contact us at [email protected]. Our ICO registration reference is ZA743773.
2. What this policy covers
This policy covers our marketing website (retainspace.com) and the RetainSpace application (portal.retainspace.com), where consultants run client workspaces and their clients log in to follow progress, approve work and submit requests.
3. The personal data we collect
- Account data. Your name, email address and a securely hashed password, created when you sign up. Authentication is handled by Supabase.
- Workspace content. The deliverables, requests, comments, files, company and contact details, retainer amounts, and social or analytics figures that a consultant enters or uploads, and that their invited clients can view.
- Billing data. If you subscribe to a paid plan, our payment processor Stripe collects and processes your payment details. We do not store full card numbers; we receive limited billing metadata (such as plan, status and the last four digits) to manage your subscription.
- Usage and analytics data. If you consent to analytics cookies, we collect product usage data through PostHog to understand how the service is used and improve it. This is off until you allow it.
- Communications. Emails you send us, and transactional emails we send you (for example invitations and approval notifications), delivered via Resend.
- Technical data. Server logs and security data processed by our hosting provider, Cloudflare, including IP address, needed to deliver and protect the service.
4. Controller and processor roles
For your own account data and your use of the service, we are the controller.
For the client and company data that a consultant uploads into their workspace, the consultant is normally the controller and we act as a processor, handling that data only on the consultant's instructions to provide the service. Consultants are responsible for having a lawful basis to upload that data and for telling their own clients how it is used. If you are a client who logs in to a consultant's workspace and have a question about your data, please contact that consultant in the first instance.
5. Why we use your data and our lawful bases
- To provide the service (accounts, workspaces, deliverables, requests, invitations) - performance of our contract with you.
- To take payment for paid plans - performance of our contract, and compliance with legal and accounting obligations.
- To secure the service and prevent abuse - our legitimate interests in keeping the service safe and reliable.
- Product analytics to understand and improve the service - your consent (you can withdraw it at any time).
- Service and transactional emails you need to use the service - performance of our contract.
- Legal compliance where we must keep or disclose data - compliance with a legal obligation.
6. Who we share it with (processors)
We do not sell your personal data. We share it with the service providers we rely on to run RetainSpace, each under a data processing agreement:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and file storage | United Kingdom (London) |
| Cloudflare | Hosting, content delivery and security | Global edge network |
| Stripe | Subscription payments | United States / global |
| Resend | Transactional email delivery | United States |
| PostHog | Product analytics (only with your consent) | United States |
| Website analytics and reviews you connect for your own clients | United States / global |
We may also disclose data if required by law, or to establish, exercise or defend legal claims.
7. International transfers
Your core account and workspace data is hosted in the United Kingdom. Some of our processors (such as Stripe, Resend and PostHog) are based in the United States or operate globally. Where personal data is transferred outside the UK, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or transfers to countries the UK considers adequate.
8. How long we keep it
We keep your account and workspace data for as long as your account is active. If you close your account, we delete or anonymise personal data within a reasonable period, except where we must keep certain records (for example billing records) to meet legal and accounting obligations. Backups are rotated and overwritten in the ordinary course.
9. Your rights
Under UK GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it. To exercise any of these, email [email protected]. We will respond within one month. Where we act as a processor for a consultant, we will pass your request to the relevant consultant.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk/make-a-complaint or 0303 123 1113. We would appreciate the chance to address your concern first.
10. Security
Access is invitation-only and role-based. Data is isolated per client at the database level (row-level security), files are served only through short-lived signed URLs, and traffic is encrypted in transit. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.
11. Children
RetainSpace is a business tool not directed at children, and is not intended for anyone under 18. We do not knowingly collect data from children.
12. Cookies
We use a small number of strictly necessary cookies and storage to run the service, and optional analytics cookies only with your consent. See our Cookie Policy for the full list and how to change your choices.
13. Changes to this policy
We may update this policy from time to time. We will change the "last updated" date above and, for significant changes, let you know.
14. Contact
Social Impact Ltd, 12 Limedale Avenue, Oakwood, Derby, England, DE21 2UE. Email [email protected].