Privacy Policy

Spatia turns iPhone walkthroughs of real spaces into floor plans, 3D models, and measurements. That work necessarily involves detailed imagery of private spaces, so this policy is written around one idea: scans are your property, processed on your behalf. We do not sell your data, and we do not use your scans for advertising.

This policy covers the Spatia capture app, the web workspace, share links, and this website. It is a draft: bracketed items are decisions counsel must finalize before publication.

Scan data. When you capture a space with the Spatia app we collect the capture itself: camera imagery, LiDAR depth data, device pose and motion data, derived room geometry, and capture metadata such as timestamps and per-frame exposure. Scans are of spaces — we ask you to capture rooms without people in them.

Account information. Name, email address, and organization, provided when the Spatia team provisions a pilot account.

Service records. Processing logs, delivery records, and measurements or notes you create in the workspace.

Support communications. Emails you send us.

We do not run third-party advertising or analytics trackers on the product today.

Captures and the deliverables produced from them belong to you or to the client you captured them for. For scan data, Spatia acts as a processor: we store and transform it to deliver the service you asked for, and we act on your instructions for sharing and deletion. For account information, Spatia is the controller.

Internal test captures made by the Spatia team (our own rooms, used to develop the reconstruction pipeline) are handled separately from client work and are never presented as client output.

We use the information above to:

• reconstruct your captures into floor plans, 3D models, and measurements, and deliver them to your workspace;
• serve the viewers behind share links you issue;
• diagnose processing failures and keep the pipeline reliable;
• provision accounts, provide support, and send service notices;
• meet legal obligations.

We use scan data to improve reconstruction quality only where your pilot agreement permits it. We do not use your scans to train models for unrelated purposes, and we do not sell or license your data to data brokers or advertisers.

Scan data and deliverables are stored in Amazon Web Services (S3) in the United States, encrypted at rest and in transit. Access to production systems is restricted to the Spatia team on a need-to-know basis, and production credentials are never embedded in client-facing surfaces.

No system is perfectly secure. If we learn of a breach affecting your data we will notify you without undue delay, consistent with applicable law.

We share data only with:

• Infrastructure subprocessors that run the service: Amazon Web Services (storage and delivery) and RunPod (GPU processing of captures during reconstruction). [final subprocessor list, regions, and data-processing agreements — to be confirmed before publication]
• People you share with: anyone holding a share link you issued sees what that link permits, until it expires or you revoke it.
• Authorities, where a valid legal demand requires it. We will tell you about such a demand unless we are legally prevented from doing so.

We do not sell personal information and have not sold it in the preceding 12 months. There are no other categories of third-party disclosure.

Scan data and deliverables are retained while your account or pilot agreement is active, so your workspace keeps working. When you delete a scan, or ask us to close your account, we delete the associated scan data from active systems within 30 days and from backups as they rotate out. [exact backup rotation window — to be confirmed against the production backup policy]

Processing logs that do not contain imagery may be kept longer for reliability and billing records.

Scans document spaces, not people. Capture guidance in the app asks you to scan rooms while they are empty. If a person, or personal information such as documents or screens, appears in a scan incidentally, the property owner or capture author can ask us to remove or obscure that content — email us with the scan and the area of concern and we will act on it. If you believe you appear in someone else’s scan, contact us and we will work with the scan owner to resolve it.

This website sets no advertising or third-party analytics cookies. When workspace sign-in launches, an essential session cookie will keep you signed in; it is not used for tracking. Because we only use essential cookies, there is no cookie-consent banner to click through.

If you are in the European Economic Area or the United Kingdom, you have the right to access, rectify, erase, and receive a portable copy of your personal data, to restrict or object to its processing, and to withdraw consent where processing is based on consent. Our legal bases are performance of a contract (delivering the service), legitimate interests (keeping the service reliable and secure), and consent where we ask for it.

To exercise these rights, email mohamedelhag07@gmail.com. You also have the right to lodge a complaint with your supervisory authority. [EU/UK representative appointment — to be determined before serving EEA/UK clients]

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to request deletion and correction; and to not be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is no need for a “Do Not Sell or Share” opt-out.

The categories we collect are listed in Information we collect; the purposes and recipients are listed in the sections that follow it. To exercise any right, email us; we will verify the request against the account it concerns.

The service is operated from the United States and data is stored there. If you use the service from elsewhere, your data is transferred to the US. For EEA/UK clients, transfers will be covered by standard contractual clauses in the data-processing agreement. [SCCs and transfer-impact assessment — to be completed before serving EEA/UK clients]

The service is for professional use and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.

We may update this policy as the service evolves. Material changes will be announced to account holders by email or an in-product notice before they take effect, and the update date at the top of this page will change.

Privacy questions and requests: mohamedelhag07@gmail.com. [postal address of the legal entity — to be completed before publication]