Dasar privasi

1. Who we are

Spaceport is operated by Nematix (M) Sdn Bhd (registration 201301020908 (1050738-U)), B-15-3, Jalan Atmosphere 3, 43300 Seri Kembangan, Selangor, Malaysia. We are the data user for the personal data described in this policy under the Personal Data Protection Act 2010 (PDPA).

For the customer data you store in your workspace, you decide what is collected and why. We process it on your behalf to provide the service.

2. What we collect

• Account information: name, email address and a hashed password.
• Profile and workspace data: avatar, workspace name and role.
• CRM data: companies, people, opportunities, tasks, notes and custom fields that you create.
• Usage data: sign-in times, feature usage and error reports.
• Technical data: IP address, browser type and device information.
• Messages you send us, for example through email.

3. How we use it

We use personal data to:

• provide, secure and maintain Spaceport
• authenticate users and enforce workspace access controls
• send service emails such as password resets, invitations and billing notices
• improve the service using aggregated usage patterns
• respond to support requests

4. What we do not do

• We do not sell your data.
• We do not use your CRM data for advertising.
• We do not use your CRM data to train AI models.

5. Rina and AI providers

When you use Rina, the relevant parts of your request and workspace data are sent to the provider of the selected model (Anthropic, OpenAI or Google) to generate a response. We use their business APIs, and they process the data under their own terms.

If you connect an external AI client through the MCP server or API, that client receives only the data its authorised tools request. You can revoke its access at any time from your settings.

6. Service providers and transfers

We use service providers for hosting, email delivery, payments, error monitoring and AI models. Some of them process data outside Malaysia. Where that happens, we take steps so that your data stays protected in line with the PDPA.

7. Security

• Encrypted connections (HTTPS) for all data in transit.
• Workspace isolation on every request.
• Two-factor authentication and passkeys for sign-in.
• Scoped, revocable API tokens.
• Regular security updates.

8. Retention

• Account data is kept while your account is active.
• Deleted accounts and their personal data are removed after a 30-day grace period. Records in shared workspaces remain.
• Support messages are kept for up to 12 months.
• Server logs are kept for up to 90 days.

9. Your rights

Under the PDPA you can ask to access and correct your personal data, and to limit how it is processed. You can also export your data or ask us to delete your account. Email [email protected] and we will reply within 21 days.

10. Cookies

Spaceport uses essential cookies for sign-in sessions and security. This website does not use advertising or tracking cookies.

11. Changes to this policy

We may update this policy. We will tell registered users about material changes by email or in the app.

12. Contact

Questions about privacy? Email [email protected].