Privacy Policy
Effective 2026-09-04 · Version 1.1
Data controller
SpaceSkills (spaceskills.shop) is operated by an individual sole trader. Privacy contact: [email protected], read and answered personally.
What we collect
When you register we collect your email, the name you enter and your password (stored only as a scrypt hash). When you sign in with Google or GitHub we receive only your email, name and account identifier. When you join the Director Agent queue we collect the brief and contact you enter; when you leave a message we collect its content and your email; when you buy a service we collect order details. Ideas, scripts, images, character photos and music submitted for a plan are used only for that plan.
Payment data
Card and other payment data are processed exclusively by our PCI-DSS compliant payment processor, Waffo Pancake, and never pass through or are stored on our servers. We keep only the order id, amount and status.
How we use it and legal basis
Your email is used to sign in, verify your address and send service emails (queue status, password reset, sign-in links) on the basis of performing our contract with you. Briefs and material are used to produce your plan, same basis. Site analytics are used to improve the site on the basis of legitimate interest. We send no marketing email beyond service messages; if we ever do, we will ask for separate consent and include an unsubscribe link. We do not sell or rent your information or use it for advertising.
Analytics
The site uses self-hosted Umami for visit statistics. It sets no cookies and collects no personally identifiable information.
Third-party processors
Payments: Waffo Pancake (merchant of record and payment processing). Email: Resend. Delivery and storage: Cloudflare (CDN, R2). AI generation: Qwen models on Alibaba Cloud Model Studio, used to generate the text of production plans; your material is sent to that service at generation time and is not used for training. These providers process data only as needed to provide their service.
Security
HTTPS everywhere; passwords stored only as hashes; session cookies are HttpOnly and Secure; the server is accessible only to the operator. If a security incident involves your personal data we notify you by email within 72 hours of becoming aware.
Retention
Account data is kept while you use the service and deleted within 30 days of account closure. Queue and order records are kept for 2 years after the service is completed (disputes and accounting). Material submitted for a plan is deleted within 90 days after delivery and the revision period, unless you ask us to keep it or agree to a case study. Messages are kept for 1 year. Analytics are anonymous aggregates kept indefinitely.
Your rights
You may request access, correction, deletion, export of the data you provided, restriction of or objection to processing, and withdrawal of consent. Write to [email protected]; we reply within 7 days and complete requests within 30 days.
Changes
Material changes are announced at least 15 days in advance on the site or by email; the effective date and version are shown at the top of this page.