Privacy Policy
Last updated: 10 October 2026 · Version 2.3
This Privacy Policy (the "Policy") describes how Finikos S.r.l. ("Finikos", "we", "us" or "our") collects, uses, discloses, transfers, retains and otherwise processes personal data in connection with the mobile application Space Context (the "App") and the related websites, interfaces and services that link to this Policy (together with the App, the "Service"), including the developer console and the Space Context API (the "developer platform"). It also explains the rights available to you under the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") and applicable Italian data-protection law (Legislative Decree No. 196/2003, as amended, the "Privacy Code").
This Policy forms part of, and should be read together with, our Terms of Service. Capitalised terms not defined here have the meaning given to them in the Terms of Service. By installing, accessing or using the Service you acknowledge that you have read and understood this Policy. Where we rely on your consent, separate consent will be requested in the App.
1. Data controller and contact details
The controller of your personal data is:
Finikos S.r.l.
Registered office: Via Francesco Ostermann 6/7, 33033 Codroipo (UD), Italy
VAT / Tax code: IT03189520301
Privacy contact: privacy@finikos.it
We have not appointed a Data Protection Officer where one is not mandatory under Article 37 GDPR. You may contact us in relation to any matter described in this Policy using the address above.
2. Definitions
- "Personal data" means any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.
- "Processing" has the meaning given in Article 4(2) GDPR and includes collection, storage, use, disclosure and deletion.
- "Content" means the videos of physical spaces that you record or upload, the audio you capture, and the frames, transcripts, inventories, condition assessments, reports, structured data and question-and-answer outputs generated from them.
- "Sub-processor" means a third party engaged by us to process personal data on our behalf and on our instructions.
3. Categories of personal data we process
We practise data minimisation and collect only the data we need to operate the Service. The categories below depend on how you use the Service.
| Category | Examples | Collected |
|---|---|---|
| Account and authentication data | Email address; display name and the link to your profile picture, where provided by the service you sign in with; the identifier given by Apple or Google; one-time codes sent by email. In the developer console you can also sign in with GitHub, from which we receive only your primary verified email address, your name or username and the link to your profile picture | On sign-up and sign-in |
| Content | Videos of spaces you record, extracted frames, audio track and its transcript, generated inventories, condition assessments, reports and Q&A answers | When you use the capture and analysis features |
| Profile data | Avatar image, where you choose to upload one | Optional |
| Transaction and subscription data | Purchase and subscription status, plan, credit balance, renewal status. Purchases in the App are processed by Apple, and their card data is not accessible to us | On purchase and renewal |
| Usage and product data | Number of scans and questions performed, features used, in-App events necessary to deliver and maintain the Service | While using the Service |
| Developer platform data | API keys, stored only as a hash, with their name, prefix, permissions and the dates they were created and last used; console sessions, stored as a hash, with your browser's user-agent string; the spaces and scans you create through the API, including the photos and videos you upload, their audio track and its transcript, and the documents generated from them; the addresses of your webhook endpoints and the events sent to them; a log of the actions taken on your account in the console (sign-ins and the method used, keys, webhooks, payments and cards); daily usage counters and a record of each API request (key, operation, outcome and duration) | When you use the developer console or the API |
| Developer payment data | Balance and ledger of top-ups, scan charges and refunds; the identifiers Stripe gives to your customer record, your payments and any saved card; the invoice details you give, as an individual or a company, in the console or on Stripe's payment page: your name or company name, billing email, address and VAT number and, for Italy, the SDI recipient code or PEC address and the codice fiscale, which are kept at Stripe with your customer record; the record of your acceptance of the billing terms (time, terms version and IP address); a pseudonymous code derived from each card you use (see Section 10). Card details are entered on Stripe's pages and processed by Stripe: we never see or store full card numbers | When you add funds or a card, or give invoice details, in the developer console |
| Agent payment data | If an AI agent pays for credit through the x402 protocol: the address of the paying wallet, the network, the amount and the transaction identifier | When the payment is made |
| Referral data | Your personal referral code, the link between you and the user who invited you or whom you invited, and the status of any reward earned | When you take part in the referral programme |
| Device and technical data | Device type and model, operating-system version, App version, language and region settings, a stable installation identifier and device token used to deliver push notifications, and diagnostic data essential to operation, stability and security | While using the Service |
| Advertising attribution data (only with your consent) | Whether you installed the App after tapping or viewing an Apple Ads advertisement and, if so, the identifiers of the campaign, ad group, keyword and ad, the country or region, the type and date of the interaction, and the date and version of your consent | Only if you allow campaign measurement in the App |
| Website usage data (only with your consent) | The pages of our website and developer console you visit, the site that referred you, the campaign tags of the link that brought you (such as the name of the campaign), your approximate location derived from the network, the type of device and browser, the steps you complete (such as creating an API key, adding a card or starting a top-up) and a random identifier kept in a cookie. Never your email address, keys, card details or the content of your spaces | Only if you accept analytics in the cookie banner |
| Communications | The content of, and metadata relating to, messages you send to support | When you contact us |
We do not intentionally collect special categories of personal data (Article 9 GDPR). You are responsible for ensuring that the Content you capture does not contain such data unless you have a valid legal basis for it. See Section 7.
4. Sources of personal data
We obtain personal data: (a) directly from you, when you create an account, capture or upload Content, configure the App, make a purchase or contact us; (b) automatically, when you use the Service, through your device and the App; (c) from third parties, namely the identity providers you choose to authenticate with (Apple, Google and, for the developer console, GitHub), Apple in relation to your purchases in the App, Stripe in relation to payments on the developer platform (payment status, invoices, the code by which it recognises a card, refunds and disputes) and, for payments made through x402, the payment facilitator and the public blockchain; and (d) only if you consent, from Apple, the attribution data on our Apple Ads campaigns described in Section 5.
5. Purposes of processing and legal bases
We process personal data only where a lawful basis under Article 6 GDPR applies. The table sets out each purpose, the categories involved and the corresponding legal basis.
| Purpose | Categories | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Create and administer your account; authenticate sign-in | Account and authentication data | (b) performance of a contract |
| Provide the Service: capture, AI analysis, generation of inventories, assessments, transcripts and reports, storage, synchronisation and export | Content, profile, usage, technical | (b) performance of a contract |
| Process purchases, manage credits and subscriptions, and meet tax and accounting obligations | Transaction and subscription, account | (b) performance of a contract and (c) compliance with a legal obligation |
| Provide the developer platform: console, API keys, spaces and scans uploaded through the API (including the transcription of their audio), search, webhooks, usage limits and the log of the actions taken on your account | Account, developer platform data | (b) performance of a contract |
| Process top-ups, automatic top-ups and card checks through Stripe; issue invoices made out to the invoice details you give, as an individual or a company, and meet the related tax and accounting obligations; keep the ledger; accept payments made by AI agents through x402 | Developer payment data, agent payment data, account | (b) performance of a contract and (c) compliance with a legal obligation |
| Answer chargebacks and payment disputes. Before a payment page opens, we record when, from which IP address and under which version you accepted the billing terms; the time, the version and the IP address are also stored at Stripe with the payment or the card. If a payment is disputed, we send Stripe, which passes it on to the card issuer, that record together with your email address and name, the payment and the activity of your account from 30 days before the payment onwards (sign-ins, keys created, payments and cards, scans charged and refunded). If the account has been deleted, we use only what Stripe keeps with the payment and the deletion record described in Section 10 | Developer payment data, developer platform data, account | (f) our legitimate interest in defending ourselves against unfounded chargebacks and in establishing, exercising or defending legal claims |
| Prevent abuse of free offers: recognise a card that has already unlocked the free scan of the developer platform, and an identity whose account was deleted and opened again, so that free credits, the free scan and referral rewards are granted only once | Developer payment data (the pseudonymous card code), the deletion record described in Section 10 | (f) our legitimate interest in preventing abuse of free offers |
| Provide customer support and handle your requests and complaints | Account, usage, communications | (b) performance of a contract and (f) our legitimate interest in assisting users |
| Operate the referral programme: generate your referral code, attribute invitations between users and grant the related rewards or credits | Referral, account, transaction | (b) performance of a contract and (f) our legitimate interest in operating an invitation feature |
| Send service (transactional) push notifications, for example when your analysis is ready | Account, device | (b) performance of a contract and (f) our legitimate interest in keeping you informed about the Service |
| Send optional promotional push notifications about new features or offers | Account, device | (a) your consent (opt-in, off by default; you can withdraw it at any time in the App) |
| Measure the effectiveness of our Apple Ads campaigns: find out which campaigns and keywords lead to installs and purchases, so that we spend our advertising budget where it works | Advertising attribution, transaction and subscription, account | (a) your consent, requested in the App before any processing (opt-in; refusing has no effect on the Service; you can withdraw it at any time in Settings, which deletes the data collected) |
| Measure, in aggregate, how our website and developer console are used, to improve them and to understand which pages and channels bring visitors | Website usage data | (a) your consent, given in the cookie banner before any measurement (refusing has no effect on the website; you can withdraw it at any time from "Cookie preferences") |
| Maintain security, prevent and detect fraud, abuse and misuse, ensure stability, and debug | Technical, usage | (f) our legitimate interest in protecting the Service and its users |
| Comply with legal obligations and respond to lawful requests of competent authorities | As required | (c) compliance with a legal obligation |
| Establish, exercise or defend legal claims | As relevant | (f) our legitimate interest in protecting our rights |
Where we rely on legitimate interests, we have carried out a balancing assessment to ensure that those interests are not overridden by your rights and freedoms, and you may object as described in Section 12. We do not use your personal data to show you advertising, for profiling or for cross-app tracking, and we do not sell your personal data. Only if you consent, we measure which of our own Apple Ads campaigns led to your installation of the App: to do so the App obtains an attribution token generated by Apple on your device, which requires your prior consent under Article 122 of the Italian Privacy Code (implementing Article 5(3) of Directive 2002/58/EC). We use the result solely in aggregate to evaluate our campaigns; it is not used to target you and is not shared with anyone. We send promotional (marketing) push notifications and emails only if you have explicitly opted in; this is based on your consent, it is off by default, and you can withdraw it at any time in the App or through the unsubscribe link in any email, without affecting service messages about your account.
6. How we process your Content and the role of artificial intelligence
The videos, frames and audio you capture are processed, including through third-party artificial-intelligence services, solely to produce the outputs you request, namely inventories, condition assessments, transcripts, structured data and reports. This processing is necessary to perform the contract under which you obtain the Service.
The Service does not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. The outputs generated by the Service are informational tools intended to assist you, may contain inaccuracies, and are subject to your independent review and judgement.
7. Content depicting third parties; your responsibilities and warranties
The Content you capture may depict premises, objects and, potentially, individuals other than you, including their images, voices or personal effects. With respect to such third-party personal data, you act as an independent data controller (or, where applicable, you are responsible for the lawfulness of the recording under other legislation), and Finikos and its sub-processors act solely as processors that process such data on your instructions for the purpose of delivering the outputs you request.
You represent, warrant and undertake that, before capturing or uploading Content, you hold all rights, permissions, consents and lawful bases required to record the relevant premises and any persons or property appearing in the Content, and to have that Content processed as described in this Policy, and that the capture and processing of such Content do not infringe any third party's privacy, image, property, confidentiality or other rights. You are solely responsible for providing any notices and obtaining any consents required by applicable law. As set out in the Terms of Service, you agree to indemnify us in respect of claims arising from a breach of these warranties.
8. Recipients and sub-processors
We disclose personal data only to the recipients necessary to operate the Service. These recipients act as our processors under written data-processing agreements that meet the requirements of Article 28 GDPR, or as independent controllers where they determine the purposes and means of processing in their own right (for example, the identity and payment providers in respect of authentication and payment).
To operate the Service we rely on a limited number of trusted providers. We use Apple for Sign in with Apple and for processing purchases and subscriptions through the App Store and StoreKit, and, only if you consent to campaign measurement, for the attribution of our Apple Ads campaigns (we send Apple's attribution service the token generated on your device and receive the campaign data back; Apple acts as an independent controller for its advertising platform); where you choose it, Google for Sign in with Google; and, where you choose it in the developer console, GitHub (GitHub, Inc.) for Sign in with GitHub (we use the access token GitHub gives us once, to read your email address, name and profile picture, and then ask GitHub to revoke it); in respect of authentication and payment these providers also act as independent controllers.
For the developer platform we use Stripe (Stripe Payments Europe, Limited, Ireland) to process top-ups, automatic top-ups, card checks and invoices, to keep the invoice details you give with your customer record, and to handle refunds and disputes, including the evidence described in Section 5. Stripe processes card details on its own systems, and we never see or store full card numbers; depending on the processing, it acts as our processor or as an independent controller, for example for what it does to meet its own legal obligations and to prevent fraud. Payments made by AI agents through x402 are verified by a payment facilitator and recorded on a public blockchain.
To deliver the core functionality we additionally rely on infrastructure and processing providers, namely a cloud hosting and storage provider (Cloudflare), with files and the main database located in the European Union and encrypted at rest, which on the developer platform also transcribes the audio of uploaded videos, builds the search index and keeps the record of API requests, on its own network; a provider that performs the artificial-intelligence analysis used to generate inventories, assessments and transcripts; and a transactional email provider used to deliver sign-in verification codes. Only if you accept analytics on our website do we also use Google Analytics 4, provided by Google Ireland Limited as our processor (see Section 13). The artificial-intelligence provider is located outside the European Economic Area (in the United States), so its processing involves an international transfer as described in Section 9. We send content to that provider with retention disabled for the requests that generate text (a technical setting on each of them instructs the provider not to store the request or the response), and the content is not used to train its models; where the provider nonetheless retains limited data to monitor abuse and safety under its terms, this does not exceed 30 days before deletion. In the App, the audio you capture is converted to text on your device; that text, together with selected frames, is what may be sent to the artificial-intelligence provider. On the developer platform, the audio track of an uploaded video is transcribed by a speech-recognition model (Whisper) running on Cloudflare Workers AI, our hosting provider's network; the transcript and the frames may then be sent to the artificial-intelligence provider. The original video is deleted as soon as its frames and audio have been extracted. Data you ask us to send elsewhere, for example to your webhook endpoints or through an API key you give to an application or an AI agent, is sent on your instructions, and its recipients are your choice and your responsibility.
We may also disclose personal data: (a) to professional advisers (such as lawyers and accountants) under duties of confidentiality; (b) to public authorities, courts or regulators where required by law or to protect our rights; and (c) to a successor entity in the context of a merger, acquisition, reorganisation or sale of assets, subject to this Policy continuing to apply. We disclose recipients by category in this Policy; a current list of the specific providers we engage within each category is available on request at privacy@finikos.it, and that list may be updated from time to time as described in Section 16.
9. International transfers
Some of the providers described above process personal data outside the European Economic Area, among them the artificial-intelligence provider, GitHub and Stripe, which may transfer data to its affiliates in the United States. Where this occurs, we ensure that an appropriate transfer mechanism under Chapter V GDPR is in place, namely the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), supplemented where appropriate by additional technical and organisational measures, or, where the recipient is certified, the EU-U.S. Data Privacy Framework. You may request a copy of the relevant safeguards using the contact details in Section 1. A payment made on a public blockchain is different: the transaction is visible to anyone, wherever they are, and neither we nor anyone else can delete it.
10. Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, after which it is deleted or irreversibly anonymised.
| Data | Retention period |
|---|---|
| Account and Content (including videos, frames, transcripts, inventories and reports, and the spaces and scans of the developer platform) | For as long as your account or the related project or space remains active. Some pending items may also be stored locally on your device. You may delete individual items at any time in the App or through the API |
| Data following account deletion | Upon deletion of your account (in the App, Settings, then Delete account; or on request) the associated data, including that of the developer platform, is permanently deleted from our database and storage (this is not a soft delete), except: data we are required to retain by law (such as transaction records needed to meet tax obligations); the deletion record and the pseudonymous card code described below; and what Stripe keeps of your customer record (when you delete your account we ask Stripe to remove any saved card) and of the payments it processed, which Stripe holds under its own legal obligations and which we may consult to answer a dispute of one of those payments. Content stored locally on your device (videos pending upload and exported reports) is also removed when you log out or delete your account |
| Transaction, tax and accounting records, including the invoices of developer top-ups and the invoice details they carry | For the period required by applicable tax and accounting law, generally up to 10 years |
| Developer platform | Uploaded videos: deleted as soon as their frames and audio have been extracted. Scans that failed or were cancelled: 180 days; test-mode scans: 30 days, except the latest completed scan of each space. Events sent to your webhook endpoints: 30 days. Log of the actions taken on your account, including the record of acceptance of the billing terms: 400 days. Console sessions: deleted 7 days after they expire. Record of each API request: about three months. Everything else (keys, spaces, completed scans, balance and ledger): until you delete it or your account |
| Deletion record | A one-way hash (SHA-256) of your email address and, if you signed in with Apple or Google, of that identifier, with the date of deletion. It does not contain them in readable form, but recognises the same identity if it signs up again, and shows, if a payment made before the deletion is disputed, that the account was closed by its holder. Kept after the account is deleted, for as long as we offer free credits, a free scan or referral rewards to new accounts |
| Pseudonymous card code (developer platform) | A one-way hash of the code by which Stripe recognises a card within our Stripe account: it identifies no card outside that account and is not linked to any account of ours. Kept after the account is deleted, for as long as the developer platform offers a free scan to new accounts, so that each card unlocks the free scan only once |
| Agent payment data (x402) | Until the account opened by the payment is deleted; the transaction itself stays on the public blockchain, outside our control |
| Advertising attribution data | Up to 24 months from collection, or until you withdraw your consent or delete your account, whichever comes first |
| Website usage data (Google Analytics) | 14 months from collection, after which Google Analytics deletes them automatically; the analytics cookies in your browser last up to 12 months, or until you withdraw your consent or clear them |
| Support communications | Generally up to 24 months after the matter is resolved |
| Security and diagnostic logs | Generally up to 12 months, unless a longer period is required to investigate an incident or to establish, exercise or defend a legal claim |
11. Security
We implement technical and organisational measures appropriate to the risk, in accordance with Article 32 GDPR. These include encryption of data in transit and at rest, storage of authentication tokens in the device Keychain, storage of API keys and console session tokens only as hashes, encryption of webhook signing secrets, access controls and the principle of least privilege, segregation of environments, and contractual security commitments from our sub-processors. No method of transmission or storage is completely secure, and while we work to protect your personal data we cannot guarantee absolute security.
12. Your rights
Subject to the conditions and exceptions in the GDPR, you have the right to: (a) access your personal data and obtain a copy of it; (b) rectify inaccurate or incomplete data; (c) erase data ("right to be forgotten"); (d) restrict processing; (e) object to processing based on legitimate interests; (f) data portability, in a structured, commonly used and machine-readable format; and (g) where processing is based on consent, withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
You may exercise these rights by: deleting your account directly in the App (Settings, then Delete account); or contacting us at privacy@finikos.it. We will respond without undue delay and in any event within one month of receipt, a period that may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you. We may need to verify your identity before acting on a request, and we may decline or charge a reasonable fee for requests that are manifestly unfounded or excessive. You also have the right to lodge a complaint with a supervisory authority, in Italy the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your habitual residence or place of work.
13. Cookies, local storage and analytics
The App stores limited data locally on your device, including authentication tokens and items pending processing, in order to function, together with your campaign-measurement choice. Only if you allow campaign measurement does the App access the Apple Ads attribution token on your device (see Section 5); you can change this choice at any time in Settings.
Our website (spacecontext.app, including the developer console) uses strictly necessary technical cookies and local storage to deliver the pages you request, to keep you signed in to the console and to remember your language and your cookie choices; these do not require consent. It also uses Cloudflare Web Analytics, which counts visits and measures page performance without cookies and without identifying you. We do not use profiling or advertising cookies.
Only if you accept analytics in the cookie banner do we also measure how the website is used with Google Analytics 4, loaded through Cloudflare Zaraz. The measurement is sent by Cloudflare's servers, not by your browser: your IP address is not passed to Google, and the query strings of our pages are removed before anything is sent, except the campaign tags in the link you arrived from (utm_source, utm_medium, utm_campaign, utm_content and utm_term, which we add to our own links), sent with the measurement so that we know which campaign brought you; values that do not look like a campaign tag, such as an email address, are discarded. If you arrive through such a link and have not yet answered the cookie banner, the tags are not stored anywhere: the page keeps them in memory and sends them only if you accept analytics before leaving it. The data collected are those listed in Section 3 as "Website usage data". We use them only in aggregate, to understand which pages and channels work and to improve the website, never for advertising or to profile you, and we have not enabled Google's advertising features. Google Ireland Limited processes them as our processor and may transfer them to Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework (see Section 9). Google Analytics keeps them for 14 months.
| Cookie | Purpose | Duration |
|---|---|---|
zaraz-consent | Technical: remembers your cookie choices | 12 months |
cf_zaraz_client | Technical: lets Cloudflare Zaraz apply your choices on every page | 12 months |
cfz_google-analytics_v4 | Analytics, only with your consent: a random identifier that recognises your browser across visits | 12 months |
cfzs_google-analytics_v4 | Analytics, only with your consent: the current visit | Until you close the browser |
All of these cookies are set on spacecontext.app by Cloudflare Zaraz; Google does not set cookies in your browser. Refusing analytics has no effect on the website. You can change or withdraw your choice at any time from "Cookie preferences" at the bottom of every page; withdrawing stops the measurement from that moment, without affecting what was measured before.
14. Children
The Service is not directed to, and is not intended for, children under the age of 13 (or any higher age of digital consent under applicable national law), and we do not knowingly collect their personal data. If you believe that a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.
15. Third-party services and links
The Service relies on, and may contain links to, third-party services and content (including those of the recipients listed in Section 8). Those third parties process data under their own privacy policies, over which we have no control and for which we are not responsible. We encourage you to review their policies.
16. Changes to this Policy
We may update this Policy from time to time, for example to reflect changes to the Service, to our sub-processors, or to legal requirements. We will update the "Last updated" date above and, where the changes are material, provide additional notice within the App or by other appropriate means. Your continued use of the Service after the changes take effect constitutes acceptance of the updated Policy, to the extent permitted by law.
17. How to contact us
For any question or request concerning this Policy or your personal data, contact us at privacy@finikos.it or by post at the registered office indicated in Section 1.