Privacy Policy

1. Who we are

Spacebar is operated by Pencil Learning Technologies, Inc. ("Spacebar", "we", "us", "our"). This policy covers:

• The Site: our website at spacebar.ai and the Spacebar waitlist.
• The Platform: the Spacebar app at app.spacebar.ai and our other apps, browser extension, APIs and connectors, including the AI agents that work in Spacebar.

Together, we call these the "Services". In this policy, "personal information" means any information that, alone or combined with other information we hold, identifies you as an individual, such as your name, your email address, or your voice and image in a call. "Content" means what people create and share in the Services, described in section 3.

If you have questions about this policy, email us at privacy@spacebar.ai.

2. Organizations, spaces and our role

Every space in Spacebar belongs to an organization, such as a company or team that has signed up for a plan (a "Customer"). The organization decides who can join its spaces, which features and AI agents are turned on, which apps are connected, how long content is kept, and whether Content in its spaces may be used to improve AI or licensed to others (see section 5).

An organization's settings apply to everyone in its spaces, including guests from other organizations. When you join a space, the settings of the organization that owns it apply to what you contribute there.

When we provide the Services to a Customer, we process the Content in its spaces on its behalf and under its instructions, as its service provider (sometimes called a "processor"). The Customer's own privacy notice describes how it uses that information. If you use Spacebar through an organization, send requests about its Content to your organization's administrator, and we will help them respond.

For everything else, including running the Site and the waitlist, managing accounts and billing, keeping the Services secure, and using Content to improve AI or licensing it as an organization's settings allow, we decide how personal information is used and are responsible for it under this policy. If a Customer's agreement with us says something different about how we may use its Content, that agreement applies.

3. Information we collect

Information you give us

• Account and profile: your name, email address, password or sign-in method, profile photo, organization, role, and settings such as language and time zone.
• Sign-in with another service: if you sign in with Google, Microsoft, Apple or another provider, we receive the information that provider shares under your settings with it, such as your name, email address and profile photo. You can revoke this access at any time in your account settings with that provider.
• Billing: the billing contact, plan, invoices and payment history for a Customer's account. Payment card details are collected and stored by our payment processor. We do not store full card numbers.
• Waitlist sign-up: your email address, name, company or project, role, and a short description of what you're building.
• Support and communication: what you send us when you contact support, report a problem, answer a survey, book a meeting, or write to us by chat, email or our contact form.

Content in Spacebar

When you and others use the Platform, we store and process the Content you create and share, including:

• Spaces and boards: text, notes, drawings, shapes, images, documents, files you upload, links, and apps built in a space.
• Messages: chat, comments, the requests you make to AI agents, and the agents' replies and activity.
• Calls: audio, video and screen shares, which we transmit to the other participants in real time. If a call is recorded, we store the recording. When an AI agent is in a call, or transcription is turned on, we also create a transcript of what each participant said.
• Shared browsers: the websites opened in a shared browser and what participants do there, along with the website session data the shared browser needs, such as cookies and sign-in state. If you choose to bring a page you're signed in to from your own browser into a space, we transfer the session information needed to open that page in the shared browser.
• Email sent to a space: some spaces have their own email address. Messages and attachments sent to it become Content in that space.
• Scheduled tasks: instructions you give an agent to carry out later, and their results.

Information from apps you connect

You or your organization can connect other services to Spacebar, such as calendars, documents, email and project-management tools. When you do, we receive the information you authorize, along with the access credentials needed to act on your behalf. We use them only to do what you or your agents ask, and you can disconnect a service at any time.

You can also connect an AI assistant from another company to Spacebar, or add a third-party agent to a space. That assistant or agent can see and change the spaces you allow, and its provider handles what it receives under its own terms and privacy policy.

Information collected automatically

• Device and log data: your IP address, browser and device type, operating system, device identifiers, language, the date and time of your requests, and the website that referred you.
• Usage data: the features you use and the actions you take, which spaces you join and when, how long you stay, the people you interact with, feedback you give on agent responses, network and connection quality, and error and performance reports.
• Location: the general area your device connects from, based on its IP address, which we use for security, such as spotting unusual sign-ins, and to improve performance.
• AI usage: the number and type of AI requests made in a workspace and the credits they use, which we track for billing, usage limits and capacity planning.
• Product analytics: tools that record how people use the app's interface, such as pages viewed, clicks and mouse movements, so we can fix problems and improve the design.
• Referral data: if you join the waitlist through someone's referral link, we record which link you used. Your sign-up counts toward their referrals once you confirm your email address.
• Cookies and similar technologies, described in section 10.

Processing on your device

Some optional features, such as gesture recognition and background effects, analyze your camera feed inside your browser rather than on our servers. When a feature shares a result with others, such as a raised hand, only that result is sent, not the video.

Information from other sources

• Security and anti-abuse: Google reCAPTCHA returns a risk score for waitlist sign-ups, we check the domain of your email address against lists of disposable email providers, and security partners help us detect fraud and abuse.
• Payments: our payment processor tells us whether a payment succeeded.
• Marketing: vendors may give us information about organizations and people who may be interested in Spacebar for their business.
• AI development: to develop the AI models and agents that power Spacebar, we also use information from other sources, such as publicly available information and datasets we license from others.

4. AI agents and AI features

Spacebar includes AI agents that join spaces as participants. When you or your organization turn them on and ask them to, agents can read and edit boards, use shared browsers, listen and speak in calls, answer in the AI panel, send messages and emails, run scheduled tasks, and act in apps you have connected.

• What an agent can access: an agent works with the content of the space it's in: the boards, files and shared browsers there, its conversation with you, and, while it's in a call, what participants say.
• Your camera: when an agent is in a call and your camera is on, Spacebar keeps the most recent still image from your camera at the moment you speak, so the agent can look when your request needs it, such as "what am I holding?". The agent does not watch your video continuously.
• Voice: when voice is on, what you say to an agent is converted to text so it can respond, and its replies are converted to speech. Agents speak with synthetic voices and may appear as an animated or video avatar.
• AI service providers: to produce responses, transcribe speech, and generate voices, images and other outputs, we send the information each request needs to AI service providers that process it on our behalf. We choose providers for each task and may change them over time. They may use this information only to provide their services to us.
• Check important work: AI output can be inaccurate or incomplete. Review an agent's work before you rely on it, and avoid sharing sensitive information an agent doesn't need.

Section 5 explains how Content may be used to improve AI. We do not use your personal information for automated decision-making that has legal or similarly significant effects on you. If the law requires such processing, we will tell you and give you the opportunity to object.

5. How we use Content to improve AI

Spacebar is an AI company, and the work people do in Spacebar helps us make our agents and models better. This section explains when we use Content for that purpose and how organizations control it.

Improving our models

Unless the organization that owns a space has turned this off, we may use Content from that space to improve the Services, including to train, fine-tune and evaluate the AI models and agents that power Spacebar. This includes the requests people make to agents, the work agents do, the content of boards and shared browsers, messages, and call audio, video and transcripts.

This setting belongs to the organization that owns the space, and it applies to everyone in that space, including guests from other organizations. If you join a space owned by an organization that has not turned it off, Content you contribute there may be used as described in this section. Organization administrators can turn this off in their organization's settings or by emailing privacy@spacebar.ai. Once it's off, we stop using new Content from that organization's spaces for this purpose.

Licensing to other AI developers

On plans that include data licensing, such as our free and lowest-cost plans, we may also license Content from the organization's spaces to other companies to train and evaluate their AI models. We tell organizations whether a plan includes data licensing when they choose it, and administrators can turn licensing off in their organization's settings or by emailing us. On other plans, we license Content only with the organization's separate, explicit agreement. Licensees must agree in writing to use Content only to develop and evaluate AI, to keep it secure, and not to try to identify the people in it.

We do not license Content contributed by people we know to be in the European Economic Area, the UK or Switzerland unless they have given their consent.

What we don't use

• Information we receive through Google APIs, or from other connected services whose terms don't allow it.
• Content in spaces whose organization's agreement with us excludes it.
• Biometric identifiers, such as voiceprints or face geometry, unless the people concerned have given the explicit consent the law requires.

How we protect Content used for AI

Before we use Content to train models or license it, we take steps to reduce the personal information it contains, such as removing account details like names and email addresses. We may also aggregate or de-identify personal information so that it no longer identifies you, and use or share it for research and AI development. We keep de-identified information in that form and do not attempt to re-identify it, except where the law requires.

Turning off a setting, or deleting Content, stops its future use for these purposes. It does not change models that have already been trained, or data already delivered to licensees under their agreements.

Your individual rights

Depending on where you live, you may have the right to object to our use of your personal information to improve AI, or to opt out of its sale through data licensing, even if the organization that owns a space allows these uses. Section 13 explains how to make these requests, and we will honor them as the law requires.

6. How we use your information

• To provide the Services: deliver calls, sync boards and spaces, run shared browsers, carry out the requests you give AI agents, transcribe calls, and connect the apps you choose.
• To manage accounts and access: sign you in, apply your organization's settings and permissions, and let administrators manage their workspace.
• To bill and measure usage: process payments, track AI credits, and apply plan limits.
• To personalize your experience: remember your preferences, and let agents use earlier work in a space as context.
• To run the waitlist: create your spot, send your confirmation email, show you your referral link and referral counts, and decide the order in which we offer access.
• To communicate with you: send sign-in links, confirmations, technical notices, updates, security alerts, and support and administrative messages, and, with your consent where the law requires it, news and offers about Spacebar.
• To keep Spacebar safe: detect and prevent fraud, spam, abuse and misuse of AI agents, protect accounts, and enforce our terms, including by reviewing Content with automated tools and, where needed, people. On the waitlist, we use reCAPTCHA, IP-based rate limits, disposable-email checks and self-referral checks to keep it fair.
• To support you: answer your questions and investigate problems you report.
• To improve the Services and develop AI: analyze usage and performance, fix problems, conduct research, develop new features, and, as described in section 5, train and evaluate AI models and license Content.
• To meet legal obligations and protect the rights, privacy, safety and property of our users, Spacebar and others.

You can unsubscribe from marketing emails at any time. Even if you do, we may still email you about your account and as we believe necessary to comply with the law, respond to lawful requests, enforce this policy and our terms, or protect the rights, privacy, safety or property of you, us or others.

If you send us feedback, we may use it to improve the Services. We will not publicly associate feedback with your name without your consent.

We do not share personal information for cross-context behavioral advertising. We sell personal information only through data licensing on plans that include it, as described in section 5.

7. Who can see and receive your information

People in your spaces and organization

Spacebar is built for working together. People in a space can see your name, profile photo and presence, what you add to the space, your messages, and your audio, video and screen shares in calls. AI agents in the space can see the same content and act on it. Anyone in a space can see and use its shared browsers, including any website you are signed in to there.

Your organization's administrators can manage your account and can access content and activity in their workspace, including recordings, transcripts, agent activity and AI usage.

Service providers

We share personal information with companies that process it on our behalf, under contracts that limit their use of it to providing services to us. They include providers of:

• cloud hosting, storage and databases;
• real-time audio and video delivery;
• AI models, speech recognition, and voice and media generation;
• email delivery and customer support;
• payment processing;
• product analytics and error monitoring; and
• bot protection, website hosting and meeting scheduling.

Customers can ask us for our current list of sub-processors.

AI developers that license Content

On plans that include data licensing, we provide Content to other AI developers under written agreements, as described in section 5.

Services you choose

When you connect an app, connect your own AI assistant, add a third-party agent, open a website in a shared browser, or ask an agent to send an email or create something in another service, we share the information needed to do that with the service involved. Its own terms and privacy policy apply.

Legal, safety and business reasons

We may share personal information with government authorities, industry peers or other third parties if we believe in good faith that it is necessary to: (a) comply with the law or legal process; (b) protect and defend our rights or property; (c) enforce our terms and policies; (d) detect or prevent fraud or other illegal activity; (e) protect the safety, security and integrity of the Services, our users, our employees or the public; or (f) protect against legal liability.

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, or transfer of the Services to another provider, personal information may be shared during due diligence and transferred to a successor or affiliate, which will take on the obligations in this policy. We may also share personal information with our affiliates and with our auditors and professional advisers, share aggregated or de-identified information for the purposes in this policy, and share personal information for other purposes with your consent.

8. Calls, recordings and other participants

Spacebar shows participants when an AI agent is in a call and when a call is being recorded. If you invite people to a space, record a call, turn on transcription, or add an AI agent to a call, you are responsible for letting the other participants know and for obtaining any consent the law requires, including telling them if your organization allows Content to be used to improve AI or licensed.

When you join a space owned by another organization, that organization's settings apply to what you contribute there, including its settings for improving AI and data licensing. What you share in a space can be seen, copied or recorded by the other people in it. Share only what you are comfortable sharing with them and with the agents working in that space.

9. Google user data

When you connect a Google account, Spacebar's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalized AI or machine-learning models, or license it to others, even if the organization that owns a space allows these uses for other Content. You can remove Spacebar's access at any time from your Google account's security settings.

10. Cookies and similar technologies

We and our service providers use cookies, local storage and similar technologies for these purposes:

• Strictly necessary: keeping you signed in, protecting your account, and making the Services work. For example, wl_session is set when you join or sign in to the waitlist. It keeps you signed in to your waitlist status in that browser for up to one year, is limited to the waitlist pages, and can't be read by scripts on the page.
• Preferences: remembering choices such as your language and device settings. For example, wl_ref is stored in your browser's local storage and remembers the referral link you arrived from until you sign up.
• Analytics and error monitoring: helping us understand how the Services are used and find problems.
• Bot protection: Google reCAPTCHA sets cookies and collects device and interaction data to tell people from bots. Its use is subject to the Google Privacy Policy and Terms of Service.
• Third-party content: the Site loads Google Tag Manager, Google Fonts, and embedded content from YouTube and Calendly. These providers may receive your IP address and set their own cookies under their own privacy policies.

You can block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the Services won't work, and you may need to sign in every time you visit. If you block the wl_session cookie, use the sign-in link we email you to see your waitlist status.

11. Data controls

You and your organization have controls over how personal information is used and kept:

• Organization administrators can turn the use of Content to improve AI on or off and, on plans that include it, turn data licensing on or off, for all of the organization's spaces. They can also manage members, connected apps, recordings and transcripts. Until these settings are available in the app, administrators can make these choices by emailing privacy@spacebar.ai.
• In a space, you can turn off your camera or microphone, mute or remove an AI agent, and delete content you have permission to delete.
• In your account, you can update your profile, disconnect connected apps, and delete your account.
• Copies of your data: you can ask for a copy of your personal information by emailing us.
• Marketing and cookies: you can unsubscribe using the link in any marketing email, and block or delete cookies in your browser.
• Your legal rights: depending on where you live, you can ask us to stop using your personal information to improve AI or to stop selling it, as described in section 13.

12. How long we keep information

We keep personal information only for as long as we need it to provide the Services or for other legitimate business purposes, such as resolving disputes, safety and security, and complying with the law. How long depends on the type of information, how we use it, and the settings you and your organization choose.

Information we keep until it's deleted

Account information, Content, recordings and transcripts are kept until you, someone with permission in the space, or the organization deletes them, or the account is closed. When they are deleted, we remove them from our systems within 30 days, unless we need to keep them longer for a reason described below, or they have already been de-identified and separated from any account for use under section 5.

Information we delete automatically

• Shared browsers: shared browsers are temporary. When one is closed or expires, its browsing session, including any sign-in cookies, is discarded.
• Camera images for agents: each still image is kept only until a newer one replaces it.
• Logs and analytics data: kept for limited periods, then deleted or aggregated.

Information we keep longer for safety, security or legal reasons

• If Content or an account is removed for violating our terms, we may keep the related information to protect the Services from fraud, abuse and further violations.
• If the law requires us to keep information, for example because we receive a lawful subpoena, we keep it for as long as that obligation lasts.
• We keep payment and transaction records for accounting, dispute resolution and regulatory compliance.
• When you ask us to delete personal information, we keep a record of the request so we can show that we completed it.

Other information

We keep waitlist information while the waitlist is active and for as long as we need it to offer you access to Spacebar, or until you ask us to delete it. Our service providers may keep limited records, such as email delivery logs, under their own retention policies.

In setting retention periods, we consider why we hold the information; its amount, nature and sensitivity; the potential risk of harm from unauthorized use or disclosure; and our legal obligations.

13. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, to opt out of the sale of your personal information, to withdraw your consent, and to appeal our decision on a request.

• Making a request: email privacy@spacebar.ai from the address on your account. Tell us (i) which personal information your request concerns and (ii) which right you want to exercise.
• Verification: to protect your information, we may act only on requests about the personal information associated with the email address you write from, and we may ask for more information to verify your identity. If we can't verify it, we can't complete the request. You don't need an account or to verify your identity to opt out of the sale of your personal information. We ask only for what we need to find it.
• Authorized agents: depending on where you live, someone you authorize can make a request for you. They must show your signed permission, and we may ask you to confirm your identity with us directly.
• Appeals: if we decline your request, you can appeal by replying to our decision or emailing us.

We will respond as soon as reasonably practicable and within the time the law requires. We may need to keep some information for recordkeeping or to complete transactions you started before your request. We won't treat you differently for exercising your rights. If you use Spacebar through an organization, we may refer requests about its Content to that organization and help it respond.

A note about accuracy

AI agents generate output by predicting what is most likely to come next, which is not always what is most accurate. If an agent's output contains inaccurate information about you, you can ask us to correct or remove it by emailing us. We will consider your request under applicable law and what is technically possible.

If you are in the EEA, the UK or Switzerland

Pencil Learning Technologies, Inc. is the controller of the personal information we process for our own purposes, including improving AI as described in section 5. For Content we process to provide the Services to a Customer, the Customer is the controller. We rely on these legal bases:

• to perform our contract with you or take steps you ask for, such as providing the Services or adding you to the waitlist;
• our legitimate interests in operating, securing and improving the Services, developing and improving AI models, preventing abuse, and marketing to business customers, balanced against your rights;
• to comply with our legal obligations;
• to protect someone's vital interests; and
• your consent, including for licensing Content to other AI developers, which you can withdraw at any time.

You can object at any time to processing based on our legitimate interests, including the use of your personal information to improve AI, and to direct marketing. You can also complain to your local data protection authority. In the UK, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

If you live in the United States

Some U.S. state privacy laws require additional disclosures. In the last 12 months we have collected these categories of personal information, from the sources and for the purposes described in sections 3 to 6: identifiers (such as your name, email address and IP address); customer records and commercial information (such as billing details and purchase history); internet and other electronic network activity information (such as usage and interaction data); general geolocation (based on your IP address); audio, electronic and visual information (such as call audio and video, recordings, and camera images you share with an agent); professional information (such as your company and role); and account login credentials for apps you connect.

We disclose these categories to the recipients described in section 7. On plans that include data licensing, we may sell audio, electronic and visual information and internet activity information contained in Content, along with any identifiers or professional information that appear in it, to AI developers, as described in section 5. You can opt out of this sale as described above. We do not knowingly sell or share the personal information of anyone under 16.

We do not share personal information for cross-context behavioral advertising, use it for targeted advertising, or use sensitive personal information to infer characteristics about you. We use account login credentials only to provide the Services.

14. International transfers

We are based in the United States, and the Services run on servers in the United States. If you are outside the US, your information will be transferred to, stored and processed in the US and in other countries where we or our service providers operate, where data protection laws may differ from those in your country. We apply the protections in this policy wherever your information is processed, and where the law requires, we transfer it only under legally valid transfer mechanisms, such as standard contractual clauses.

15. Security

We use reasonable organizational, technical and administrative measures designed to protect personal information from loss, misuse, and unauthorized access, disclosure, alteration or destruction, including encryption in transit, access controls, and monitoring of our systems. Within our team, access to personal information is limited to the people who need it to provide and support the Services, respond to your requests, keep the Services secure, or comply with the law.

No transmission or storage system is completely secure, so we can't guarantee the security of your information, and you should take care in deciding what information you share in the Services. If you believe your account has been compromised, contact us right away.

16. Third-party websites and services

The Services link to third-party websites and let you open websites, apps and agents run by others. This policy does not cover their privacy practices. They have their own privacy policies, and we are not responsible for them. Please read their policies before you share information with them.

17. Children

The Services are not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

18. Changes to this policy

We may update this policy from time to time by posting a new version on this page and changing the date at the top. If the changes are material, including changes to how we use Content to improve AI, we will tell you by email or in the Services before they take effect, unless the law requires a different kind of notice. If you don't agree with the changes, you can stop using the Services and close your account.

19. Contact us

Pencil Learning Technologies, Inc. is responsible for your personal information under this policy. For questions, requests or complaints about your personal information, email privacy@spacebar.ai or write to Pencil Learning Technologies, Inc., 45 Miguel St, San Francisco, CA, USA.

We will reply to complaints as soon as we can, and within 30 days. If you feel we haven't resolved your complaint, you can contact your local data protection authority.