Privacy Policy

1. Who we are (data controller)

The Spatial Brief is operated by MEIJE, société à responsabilité limitée registered with the Paris Trade and Companies Register under number 985 281 633 R.C.S. Paris. MEIJE is the data controller for account, contribution, and Chrome extension data processed by this service. For any privacy request, contact us at thespatialbrief+support@studiomeije.com.

2. What data we collect

• Public ecosystem data: public professional information about companies, apps, people, news, and source links that are curated for the archive under our Data Policy.
• Account data: your email address, authentication provider, account identifiers, sign-in timestamps, and, for email sign-up, a password handled by Supabase authentication.
• Session data: first-party browser storage used to keep you signed in on the website, plus Chrome extension local storage used to keep the extension connected to your account.
• MCP access data: hashed API keys, key labels, scopes, key prefixes, creation dates, revocation dates, and last-used timestamps.
• Chrome extension contributions: active tab URL, canonical URL, page title, selected page metadata, captured text or description, optional author handle/display name, timestamp, user agent, submitter email, and a visible-tab screenshot when Chrome allows one.
• Review data: review status, duplicate/submission counts, reviewer decisions, and accepted public bookmark data derived from submitted sources. Submitter identity, reviewer notes, and screenshots are not published in the public archive.

3. Why we use it

• To authenticate you and operate your account.
• To provide account-gated MCP access to the public ecosystem dataset.
• To let signed-in contributors submit source captures through the Chrome extension.
• To review, deduplicate, accept, or reject contributed sources for the public Bookmarks archive.
• To keep the service secure and prevent abuse.

4. Legal bases (GDPR Art. 6)

• Performance of a contract — authentication and account features.
• Legitimate interests — operating a curated public ecosystem archive, reviewing submitted sources, securing the service, and preventing abuse.
• Consent — optional Google sign-in and any optional browser permission you grant to the Chrome extension.
• Legal obligation — responding to valid rights requests and keeping limited records of account deletion.

5. Service providers (processors)

We share data only with processors that help us run the service:

• Supabase — hosting, authentication, and database (privacy / DPA).
• Vercel — website hosting and operational logs (privacy / DPA).
• Google — optional sign-in (privacy).
• Chrome Web Store / Google Chrome — distribution of the browser extension.

We do not sell personal data and we do not use it for advertising, creditworthiness, or unrelated profiling.

6. International transfers

Some processors may process data outside the EU/EEA (e.g. the United States). Where they do, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.

7. How long we keep it

• Account and profile data: until you delete your account or ask us to delete it.
• MCP keys: until revoked or account deletion.
• Contribution and review records: kept while needed to review, deduplicate, and document source decisions for the archive.
• When an account is deleted, submitted captures and submissions are kept only in anonymized form: submitter email, user agent, and screenshots are removed, and the account link is cleared.
• Account deletion records: limited, privacy-preserving records such as a hashed email and deletion timestamp are kept to document erasure requests.

8. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and object to processing of your data, and to data portability and to withdraw consent. You also have the right to lodge a complaint with your supervisory authority — in France, the CNIL. Public archive correction and removal review requests are handled under the Data Policy.

9. How to exercise your rights

From your Account page you can download all your data (“Download my data”) and permanently delete your account (“Delete account”). For anything else, email thespatialbrief+support@studiomeije.com and we’ll respond within one month.

10. Cookies & local storage

We use only a strictly-necessary first-party session in your browser to keep you signed in. The Chrome extension stores your Supabase session locally in Chrome so it can submit captures when you choose to save a page. We do not use analytics, advertising, or third-party tracking, so no cookie-consent banner is shown.

11. Children

The Spatial Brief is a professional ecosystem archive and contribution service. It is not directed to children. If you believe a child has provided account or contribution data, contact us at thespatialbrief+support@studiomeije.com.

12. Changes to this policy

We may update this policy; we’ll revise the date below when we do and, for material changes, notify you.