Privacy policy
Last updated: 23 September 2026
This policy covers the emspace app at my.emspace.app and the public site at emspace.app.
Who is responsible
emspace is operated by Tatiana Boye in the Netherlands. For privacy questions or requests, email privacy@emspace.app.
For account information, correspondence, security records and website statistics, Tatiana Boye is the controller. For personal data in workspace content, the person or organization deciding what is recorded and why is the controller; emspace processes it on their behalf.
What is kept and why
- Account information: your name, email address, password hash, the invite code used to create your account, and settings. This is needed to create and manage your account and send service emails.
- Workspace content: the people, work items and notes you enter. This is stored so you can use and export your workspace.
- Correspondence: your contact details and messages when you contact emspace. This is used to answer support and privacy requests.
- Technical records: error reports, application logs, service-email records and operator access records. These are used to operate, troubleshoot and secure the service.
- Website statistics: Umami collects visit statistics for emspace.app. This is used to understand use of the public site.
Account information is processed because it is needed to provide the service; the invite code is also used to control access to the beta. Correspondence is processed to answer messages, technical records to operate and secure emspace, and website statistics to understand use of the public site. These are legitimate interests. Privacy requests are also handled to meet legal obligations. Where emspace acts as a processor, the controller determines the legal basis.
emspace does not sell personal data or use it for advertising.
Access and service providers
Only you can access your workspace through the app. Other emspace users cannot see it. The operator can access stored data when needed for support, maintenance, troubleshooting or security. emspace does not provide end-to-end encryption.
| Provider | Purpose | Data region |
|---|---|---|
| Hetzner | App hosting, database and backups | EU |
| Lettermint | Service emails | EU |
| Forward Email | Privacy, support and other correspondence | US |
| Sentry | Error reporting | EU |
| Umami | Visit statistics for emspace.app | EU |
| Netlify | Hosting emspace.app | US |
Some providers or their subprocessors may process personal data outside the European Economic Area. Where required, those transfers are covered by an adequacy decision or the European Commission’s Standard Contractual Clauses.
Error reports are filtered to remove workspace content and search terms. A report may still contain technical identifiers or incidental personal data.
Cookies and browser storage
The app uses two necessary cookies: one for login and one to protect requests against forgery.
Umami measures visits to emspace.app without cookies or cross-site tracking. The app itself has no analytics. The site saves your theme choice in your browser.
Retention
Account and workspace data are kept while your account exists. Deleting your account removes them from the live database immediately. Copies in backups expire within 30 days.
Records of sent service emails are deleted after 28 days.
Operator access records are kept for 90 days. Their backup copies may remain for up to another 30 days. Error reports are kept for 30 days, and website statistics for six months. Application logs are kept only as long as needed for troubleshooting and security.
Correspondence is kept for as long as needed to handle it and meet any related legal obligations.
Your rights
Under the GDPR, you may request access to your personal data, correct it, have it deleted, restrict its use, receive a portable copy, or object to processing based on legitimate interests. Some rights are limited in particular circumstances.
You can export your workspace, edit records and delete your account in the app. Send other requests to privacy@emspace.app.
Requests are answered within one month. If a request is complex, this may be extended by up to two months; you will be told within the first month.
You may complain to a data-protection authority where you live or work. In the Netherlands, this is the Autoriteit Persoonsgegevens.
Changes
The date above shows when this policy was last updated.