Last updated: 25 October 2026 This notice explains what personal details StiqaSpace collects, why, who we share them with, how long we keep them and the choices you have. It covers our website (stiqa.space), the client dashboard, our newsletters and the services we provide to client organisations: websites, hosting, email, domains, support and billing. StiqaSpace decides how and why these details are used, which makes us the "controller" under data protection law. If you have a question about this notice or your details, email hello@stiqa.space.

When you contact us or fill in a form on our website: your name, organisation, email address, phone number if you give it, your website address and what you tell us in your message. When you sign up for our newsletter: your email address, your name if you give it, the topics you choose, when and how you agreed, and whether each newsletter was delivered. When your organisation is our client: the names, email addresses, phone numbers and roles of the people your organisation adds to the dashboard; sign-in records; the requests, approvals and support messages you send; and any feedback or reviews you choose to give. For billing: the billing contacts and address of your organisation, invoices, payments and receipts, any wallet balance or reward coins, and referral records if you refer someone or were referred. Card and bank payments are handled by our payment providers; we do not see or store full card numbers. When you use the Help assistant in the dashboard: the questions you ask, the answers given and whether you marked them helpful, so we can improve our help articles. For security: sign-in and two-step sign-in records, and a log of important actions in the dashboard (for example who approved a change), so we can protect accounts and investigate problems.

When we host a client's website or email, we store the content of that website, its forms and its mailboxes on our servers so the service works. We also check websites for uptime, speed, updates and security issues. For this content we act on the client organisation's instructions (as a "processor"). We only access it to provide, secure, back up or fix the service, or when the client asks us to. The client organisation is responsible for telling the people whose details are on its website or in its mailboxes how those details are used.

- To reply to enquiries and give quotes. Legal basis: steps taken at your request before entering a contract, and our legitimate interest in responding to people who contact us. - To provide and support our services, run the client dashboard and keep accounts secure. Legal basis: performance of our contract with your organisation and our legitimate interest in running a secure service. - To invoice, take payments, keep financial records and run the wallet and referral programme. Legal basis: contract, and legal obligations for tax and accounting records. - To send newsletters. Legal basis: your consent, which you can withdraw at any time using the unsubscribe or manage preferences link in every newsletter. - To send service messages, such as renewal reminders, security alerts and invoices. These are part of the service and are not marketing. - To improve our services and help articles. Legal basis: our legitimate interest in making the service better. We do not sell personal details, and we do not use them for advertising or profiling.

We use trusted service providers to run StiqaSpace. They only use your details to provide their service to us, under written agreements that protect your details. - Database, sign-in and file storage: Supabase (data stored in the EU, Frankfurt). - Website and dashboard hosting: Vercel. - Servers that host client websites and mailboxes: KnownHost. - Sending email such as invitations, invoices and newsletters: Resend. - Business email accounts, where your organisation uses Google Workspace through us: Google. - Payments: Stripe and Paystack. - Domain names: the registrar for each domain (for example Namecheap, Porkbun or pair Networks), which must receive the domain owner's contact details under the rules for domain names. - The Help assistant and drafting help: AI providers (OpenAI and Google), which receive only the question and the published help text needed to answer it, not your account records. - Password safety: when you set a password, we check it against known leaked passwords using a method that never sends your password itself. We may also share details with professional advisers, such as our accountant, or where the law requires it.

Some of our providers are based in, or may access data from, countries outside the European Economic Area, such as the United States. Where this happens, we rely on the protections the law requires, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

- Enquiries that don't lead to work: up to 2 years after our last contact. - Client account and service records: while your organisation is a client, and for up to 2 years after the service ends, so we can answer questions and resolve any issues. - Invoices, payments and other financial records: 6 years after the end of the financial year they relate to, as Irish tax law requires. - Newsletter details: until you unsubscribe. After that we keep only your email address and the fact that you unsubscribed, so we don't email you again. Sign-ups that are never confirmed are removed. - Security and activity records: for as long as they're needed to protect accounts and investigate problems, and no longer than the client relationship plus 2 years. - Website and mailbox content we host: until the service ends, then deleted after a short handover period, unless the client asks us to delete it sooner.

You can ask us to: - give you a copy of the personal details we hold about you, - correct details that are wrong, - delete your details, where we don't need to keep them, - restrict or object to how we use them, - give you your details in a format you can take elsewhere. Where we rely on your consent, such as for newsletters, you can withdraw it at any time. To use any of these rights, email hello@stiqa.space. We'll reply within one month. If you're unhappy with how we've handled your details, you can complain to the Data Protection Commission in Ireland (dataprotection.ie) or the data protection authority where you live.

We protect personal details with encrypted connections, access controls so staff only see what they need, two-step sign-in for our team, activity logs and regular backups. No system is completely secure, but if something goes wrong that affects your details we'll tell you and the authorities when the law requires it. Our services are for organisations and are not aimed at children.

We only use what the site needs to work. We do not use analytics, advertising or tracking cookies, and our fonts are served by us, not a third party. What we store in your browser: - Staying signed in: when you sign in to your dashboard, your browser keeps a sign-in key so you stay signed in. It is removed when you sign out. - Security: during two-step sign-in, and when our team opens a read-only view of your dashboard to help you, a short-lived key is kept for that browser tab only. - Your choices: light or dark mode, which organisation you were viewing, and how you arranged the menu, so the site looks the way you left it. - Finding your place: if a Help link sends you to sign in first, we remember which article to open afterwards (this tab only). Because these are all needed for the site to work, we do not ask for cookie consent. If we ever add anything optional, we will ask first and you can change your mind at any time.

If we change how we use personal details, we'll update this page and change the date at the top. If the change is significant, we'll tell clients by email or in the dashboard.