Privacy policy

What we collect, why we have it, where it lives, and how to get it back or get rid of it.

Last updated 2 November 2026

The short version. UtilitySpaces is a workspace where your team and your AI agents share one inbox, so almost everything we hold is content you or your agents put there: messages, files, tasks and the records of what an agent did. We run the service on our own servers using our own database, our own mail server and our own speech-to-text, so far fewer companies touch your data than you might expect. Card details never reach us: a card payment happens inside Creem' own checkout, so there is no card number stored anywhere on our side. We do not sell anything to anybody, and nothing you write is used to train an AI model. If you want your data gone, delete the workspace and it is purged within 30 days, or write to privacy@utilityspaces.com and we will do it for you.

Who is responsible for your data

The service is operated under the name UtilitySpaces. For data you put into your own workspace, you are the controller and we are your processor: you decide what goes in, we run the machine it sits on. For your account itself — your email address, your sign-in records, your invoices — we are the controller. The data processing addendum sets out the processor half of that in detail and forms part of our agreement with you.

What we collect

Things you give us

Account details. Your email address, your display name, and the password you choose (which we never store — see security, below).
Sign-in security. If you turn on two-factor authentication, the authenticator secret (stored encrypted) and hashes of your recovery codes. If your workspace uses single sign-on, the identifier your identity provider gives your account, so we can match you on the next sign-in.
Workspace content. Messages in channels, direct messages, tasks, notes, table rows, documents, and file attachments. Whatever your team puts in the product.
Agent configuration. The instructions, roles and tool permissions you give your agents, and the schedules you set them to run on.
Connector credentials. When you connect a business application, we store the access token that connection issued. When you bring your own AI provider key, we store that key encrypted.
Billing details. The name and email an invoice should go to, and the transaction reference Creem issued for the card payment that paid it.

Things the product generates

Agent run records. What an agent was asked to do, which tools it called, what it produced, what it cost, and who approved it where approval applied.
The audit log. A hash-chained record of significant actions in your workspace, so a later change cannot quietly rewrite an earlier entry.
Session and security records. Sign-ins, password resets, invitation acceptances, and the rate-limit counters that keep those endpoints from being brute-forced.
Server logs. Ordinary web server and application logs, kept for operations and abuse investigation.

What we do with it

We use it to run the product you asked for: show your messages, let your agents do their work, enforce your plan's limits, send the notifications you enabled, raise your invoices, and answer your support requests. We use security and log data to keep accounts from being taken over and to investigate abuse. We do not profile you, we do not build advertising audiences from your content, and we do not sell or rent data to anyone.

The legal basis for each of those

Where the GDPR or UK GDPR applies to you, we have to name the lawful basis we rely on for each purpose rather than list the purposes alone. This is that list.

Why we process it	Lawful basis
Running the workspace: accounts, sign-in, messages, agent runs, connectors, plan limits	Performance of a contract — Art. 6(1)(b). Without it there is no service to give you
Answering your support requests	Performance of a contract — Art. 6(1)(b)
Raising and settling invoices	Performance of a contract — Art. 6(1)(b); and a legal obligation for the accounting records themselves — Art. 6(1)(c)
Keeping accounts from being taken over: rate limiting, the audit log, security records, abuse investigation	Legitimate interests — Art. 6(1)(f). Our interest is running a service that is not trivially broken into; we judged it not to override your rights because the data is limited to what security needs and is never used to market to you
Server logs, for operations and fault-finding	Legitimate interests — Art. 6(1)(f), on the same reasoning
Analytics on the public marketing pages	Consent — Art. 6(1)(a), given through the cookie banner and withdrawable at any time from the cookie policy
Knowing which page, site or campaign led you to start a demo	Legitimate interests — Art. 6(1)(f). Our interest is learning which pages and campaigns bring people to the product; we judged it not to override your rights because it is limited to a page path, a site's domain and the link's campaign tags, and is never used to profile you or to build an advertising audience
Marketing email, if you asked for it	Consent — Art. 6(1)(a). It is a separate, unticked box; you can never end up on a mailing list by asking for something else
Complying with a law, a tax rule or a valid legal order	Legal obligation — Art. 6(1)(c)

Where we rely on legitimate interests you have the right to object, and where we rely on consent you can withdraw it without giving a reason and without it costing you anything. Both are covered under your rights, below.

Google user data

UtilitySpaces' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google data only ever enters UtilitySpaces because someone in your workspace deliberately connected a Google account, and it is only ever used inside that workspace, for that workspace's own purposes. You can disconnect the connector at any time from your workspace settings, which revokes our access; you can also revoke it from your Google account at myaccount.google.com/permissions.

Per scope, this is what happens:

What is accessed. Only the data covered by the scopes you approve on Google's own consent screen, for the account you connected. We request the narrowest scopes that let the feature work.
Why. So an agent or a person in your workspace can do the job you asked for with that application — for example reading a thread you pointed an agent at, or writing a reply you approved.
Whether it is stored. We store the connection's access and refresh tokens so the connector keeps working. Google content itself is fetched to serve the action in front of it; where a result is written into your workspace — an agent summarising a thread into a message, for instance — that written result lives in your workspace like any other message, and is deleted with the workspace.
Whether it is shared. Not with anyone outside your workspace, except the AI provider processing the specific request that needs it, which is the same provider handling the rest of that workspace's traffic and is listed on our sub-processors page.
Training. Google user data is never used to develop, improve or train any generalised or non-personalised AI or machine learning model.
Selling. Google user data is never sold, and never transferred for advertising, credit assessment, lending, or any similar purpose.
Human access. No human reads your Google data except where you explicitly ask us to (for example, a support request you raise), where it is necessary for security purposes or to comply with applicable law, or where the data is aggregated and anonymised.

AI models and your prompts

Agent work means sending some of your workspace content to a language model. There are two routes, and you choose which one your workspace uses.

Our gateway. By default your requests go through our own LLM gateway, which forwards them to a third-party model provider. Those providers are listed on the sub-processors page.
Your own key. If you add your own provider API key, your workspace's prompts go only to the provider you chose, under your own agreement with them. Stored provider keys are encrypted at rest and are never returned by any read path in the product, masked or otherwise — once saved, a key can be replaced but never read back.

We do not train models. We have no model of our own to train, and we do not grant any provider the right to train on your content beyond whatever their own terms say for the account the traffic runs under — which is exactly why bringing your own key is offered: it puts that relationship directly between you and the provider.

Voice notes

Voice messages are transcribed by a Whisper speech-to-text service we run ourselves, on our own infrastructure. Your audio is not sent to a third-party transcription company.

Payments

Upgrades are invoiced and paid by card. Card payments are taken by Armitage Labs OÜ as merchant of record, inside Creem' own checkout and under its privacy policy; Creem receives your email address, the plan and the invoice number. We never see, receive or store a card number, and there is no payment vault on our side to be breached. What we do hold is the invoice itself: who it was addressed to, what it was for, whether it was paid, and — for a card payment — Creem's transaction reference.

Where your data lives

The managed service runs in Docker on our own servers, behind Cloudflare, which provides the CDN, DDoS protection and the Turnstile captcha on our public forms. The database is PostgreSQL, running on that same infrastructure. File attachments are stored in Cloudflare R2 object storage, with a local-disk fallback; attachment links are signed URLs that expire. Email is sent by our own mail server on this domain. WhatsApp notifications, if you enable them, go out through a WhatsApp HTTP API we run ourselves.

Because Cloudflare and the AI providers operate globally, data in transit may be processed outside the country the service is hosted in, including in the EU and the US. Each of those parties, and what it does, is named on the sub-processors page.

Sending data outside the EEA and the UK

The service is not operated from inside the EEA or the UK, so if you are there, using it means your data is transferred out of it. We are not relying on you not noticing, so here is the mechanism.

To us. Where we act as your processor, the data processing addendum incorporates the European Commission's Standard Contractual Clauses, and the UK Addendum to them for UK personal data. Accepting our terms puts those clauses in place; you do not have to sign anything separately, and we will countersign a copy on request.
Onward, to a sub-processor. Each one is engaged under the same Clauses, or under an adequacy decision where the European Commission has made one for that country.
What that gets you. The Clauses bind the receiver to the same standard of protection, give you enforceable rights against them directly, and commit them to challenge a government access request they believe is unlawful. They do not make a foreign surveillance law disappear, and we would rather say that than imply otherwise.

You can ask us for a copy of the Clauses as they apply to your data by writing to privacy@utilityspaces.com.

Who else processes your data

The complete, current list is on the sub-processors page. In summary: Cloudflare, Google (only for a workspace that connects a Google account, and only for that workspace), and the AI provider your traffic is routed to — or the provider you chose, if you supplied your own key. Analytics on our public marketing pages runs through Google Tag Manager, Google Analytics and Microsoft Clarity — only after you consent, and never inside a workspace. Clarity records the session on those marketing pages, which the cookie policy describes in full.

When you start the demo, the form also sends how you reached us: the path of the first page you opened on this site and when you opened it, the domain of the site that linked you here, any campaign tags (UTM values) in that first page's link, and whether that link came from an ad click (the kind of ad, never its identifier). We keep only those — never the full address of the page that referred you, and nothing is stored on your device to collect them — so we can see which pages and campaigns bring people to the product.

Cookies

We set a small number of strictly necessary cookies and no others without your consent. Every one of them is listed by name, purpose and lifetime in the cookie policy.

How long we keep things

Workspace content: for as long as the workspace exists. Deleting a workspace moves it to a recycle bin and purges it after 30 days — 7 days for demo workspaces.
Demo workspaces: expire automatically about an hour after they are created.
Sessions: 30 days at most, 14 days without use, and immediately on password reset or sign-out.
Agent run records: they belong to the workspace and are destroyed in the same purge as the rest of its content.
The audit log: kept after a workspace is purged, attached to a marker that the workspace existed, because it is the tamper-evident record of what was done in and to the workspace, by its members and by us. No scheduled job deletes it. A demo workspace that expires on its own is removed entirely, audit log included.
Security records — sign-ins, password resets and invitation acceptances are written to the workspace's audit log and kept with it, as described above. Rate-limit counters are short-lived and expire on their own within hours.
Server logs: not kept indefinitely. Each service keeps a bounded amount and the oldest entries are discarded automatically as new ones arrive, so a log line ages out on its own rather than accumulating for ever.
Support correspondence: kept while the ticket is open and for 24 months after it is closed, so we can pick up a thread you refer back to.
Invoices and payment records: kept as business records after the workspace is gone, because we have to be able to account for money received. Five years from the end of the financial year they fall in, which is the period Egyptian commercial and tax rules require. This is the one category we cannot delete on request while the period runs.

The data deletion page has the step-by-step version, including how to ask us to do it for you.

Your rights

Write to privacy@utilityspaces.com from the address on the account and we will respond within 30 days. There is no charge. If we need to check who you are before acting, we will ask for the least we can get away with — usually just a reply from the account address. If you are a member of someone else's workspace, we will point you at that workspace's owner for content they control, and handle your account data ourselves.

Access. A copy of the personal data we hold about you, and the information on this page about what we do with it.
Rectification. Correction of anything inaccurate, and completion of anything half-recorded.
Erasure. Deletion — see the data deletion page for the self-service route, which is faster than asking us.
Restriction. Tell us to keep data but stop using it, for example while a dispute about its accuracy is being sorted out.
Portability. The data you gave us, in a structured, commonly used, machine-readable format, sent to you or straight to another provider where that is technically feasible.
Objection. Object to anything we do on the basis of legitimate interests. We stop unless we can show compelling grounds that override your rights; if you object to direct marketing there is no balancing test and we simply stop.
Withdrawing consent. Where we rely on consent, you can take it back at any time and it is as easy as giving it. Withdrawing does not undo what was lawful before you withdrew.
Not being subject to a decision made purely by machine that has a legal or similarly significant effect on you — see the next section.

Complaining about us

If you think we have handled your data badly, please tell us first — it is the fastest way to get it fixed. But you do not have to, and you never lose the right to go to a regulator instead.

In the EU or EEA: the data protection supervisory authority of the country you live in, work in, or where you think the problem happened. The full list is published by the European Data Protection Board.
In the UK: the Information Commissioner's Office.
In Egypt: the Personal Data Protection Centre established under Law 151/2018.

Decisions made by machine

This product is built out of AI agents, so it would be strange not to address this directly.

We make no automated decision about you that produces a legal effect or similarly significantly affects you. We do not score you, rank you, or decide anything about your access to the service by algorithm; account suspensions under the acceptable use policy are decided by a person.

Your agents are a different matter, and the responsibility for them is yours. An agent you configure acts on your instructions inside your workspace, which makes you the controller of what it decides. The write policy and the approval gate exist to keep a human in charge of what an agent may change, but neither covers everything, and our acceptable use policy forbids using agents to make automated decisions about people — hiring, credit, benefits and the like — without meaningful human review. If you point an agent at that kind of decision anyway, the obligations under Art. 22 land on you, not on us.

If something goes wrong

If personal data we hold is breached, we will notify the relevant supervisory authority within 72 hours of becoming aware of it where the law requires that, and we will tell you directly, without undue delay, where the breach is likely to result in a high risk to your rights and freedoms. We will tell you what happened, what data was involved, what we are doing about it and what you can do about it — and we would rather send that message early and slightly wrong than late and complete. Where we act as your processor, the notice goes to you rather than to your workspace's members, and the data processing addendum sets out the timing.

If you are in California

The CCPA, as amended by the CPRA, gives you a specific set of rights. It also uses its own vocabulary, so to be unambiguous in that vocabulary:

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We never have. There is no “Do Not Sell or Share My Personal Information” link on this site because there is nothing for it to switch off — not because it was left out.
Categories we collect, in the statute's terms: identifiers (your name and email address); commercial information (your plan and invoices); internet or network activity (sign-in and server-log records); and the contents of your own workspace, which may include anything you choose to put there. Where those come from, why we have them, and how long we keep them are the sections above.
We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.
Your rights to know, to delete, to correct, and to opt out are the same requests as the ones listed under your rights above; write to the same address and we will honour them. You may use an authorised agent, and we will ask that agent for proof you gave them permission.
No retaliation. Exercising any of this costs you nothing and changes nothing about your price or your service.

If you are in Egypt

Egypt's Personal Data Protection Law (Law 151/2018) gives you rights to know what is held, to access it, to correct it, to have it erased, and to withdraw consent — substantially the same list as above, and we handle a request under it the same way and at the same address. Cross-border transfers of personal data out of Egypt are made on the basis of your consent to the transfers described on this page and the protections in the Standard Contractual Clauses referred to above.

Security

Passwords are hashed with scrypt (N=2¹⁵, r=8, p=1) using a 16-byte salt unique to each password and a 64-byte digest — we cannot read your password and neither can anyone who steals the database. A new password needs at least 12 characters and is checked against a list of common and leaked passwords held on our own servers, so the check sends your password nowhere. Session tokens are 192 bits of cryptographically secure randomness and are stored only as a SHA-256 hash; they expire after 30 days, or 14 days without use, and are revoked server-side when you reset your password. Sign-in, password reset, join-code and email verification endpoints are rate limited. Two-factor authentication (TOTP) is available. Stored provider keys and connector tokens are encrypted at rest. More detail is on the security page.

If you find a vulnerability, please write to security@utilityspaces.com rather than posting it publicly.

Children

UtilitySpaces is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has an account, tell us and we will remove it.

Changes to this policy

When we change how we handle data, we update this page and move the date at the top. If a change materially affects you — a new sub-processor, a new category of data — we will email workspace owners before it takes effect.

Questions about this document? Write to privacy@utilityspaces.com. We reply to every message within one business day. You can also use the contact form.