This Privacy Policy explains what personal data Vaia Space collects, why we collect it, how we use it, with whom we share it, and the rights you have over it. It applies to the website at vaia.space, the application at app.vaia.space, and any related services (collectively, the "Service"). The same policy is published at both vaia.space/privacy and app.vaia.space/privacy.

We aim to be specific rather than open-ended. Where this Policy lists the OAuth scopes or integration permissions we request, we request only those scopes and will update this Policy before requesting additional ones.

1. Who is responsible for your data

Vaia Space is operated by Engineers Space LLC, a Wyoming limited liability company with a registered address at 75 E 3rd St, Sheridan, WY 82801, USA ("Vaia", "we", "us"). Our contact address for privacy matters is hello@vaia.space.

Vaia plays one of two roles depending on the data:

Controller for account-level data (your name, email, sign-in identifiers, billing-related data, support correspondence, telemetry of the website and app).
Processor for workspace data your organization records in the Service (time logs, projects, notes, leave records, HR records, integration content). For this data, your organization is the controller and instructs us through its use of the Service and through any data processing agreement we have signed with it.

2. Information we collect

2.1 Information you provide directly

Account information: name, email address, optional profile photo, language and timezone preferences, optional position, short bio, and phone number.
Workspace content: records your organization or its members enter, including time logs, projects and tasks, notes, reminders, leave dates and categories, compensation and billing information, employee records, candidates and CVs, evaluations and survey responses, company procedures, workflow activity, documents, comments, and attachments. Leave records may reveal health information. Your organization decides which records to collect and who is authorized to access them.
Communications: messages you send us by email or via in-product feedback.
Waitlist: new sign-ups are paused. Previously submitted email addresses and optional company names may remain in our historical waitlist records in Airtable. You can ask us to remove your entry.

2.2 Information from your sign-in provider

When you choose to sign in with Google or Microsoft, the provider shows you a consent screen listing exactly what we receive for identity. Sign-in is a separate consent from calendar access (section 2.3). For sign-in we request only:

Sign in with Google — OAuth scopes openid, email, profile. Vaia Space receives your Google account identifier, primary email address, name, profile picture, and locale. This sign-in consent does not include Gmail, Google Drive, Contacts, or Calendar. Calendar access is requested only if you or an administrator later connect a calendar (section 2.3).
Sign in with Microsoft — OAuth scopes openid, email, profile, User.Read. Vaia Space receives your Entra ID object identifier, primary email/UPN, display name, and profile photo. This sign-in consent does not include Outlook mail, OneDrive, Teams messages, SharePoint, or Calendar. Calendar access is requested only if you or an administrator later connect a calendar (section 2.3).

Sign-in is passwordless. We send a one-time code to your email, or you use Google or Microsoft as above. We do not store a password for your Vaia Space account.

You can revoke our access at any time from Google Account permissions or Microsoft Account permissions.

2.3 Calendar integrations

Vaia Space can read personal busy time and, when an administrator chooses, write team-leave events. Google and Microsoft each have one OAuth client. There are three distinct consents:

Sign-in — identity only, as in section 2.2. Members who only sign in never see a calendar write consent.
Personal calendar — any member who clicks Connect. Google scope calendar.readonly; Microsoft scope Calendars.Read. We read events on the default calendar (incremental sync, about ±90 days) so coworkers can see busy time in Vaia Space. We do not write to a personal calendar.
Team leave — members with the integrations:manage permission. Google scope https://www.googleapis.com/auth/calendar; Microsoft scopes Calendars.ReadWrite and offline_access. We list calendars, create a Vacation Tracker calendar if chosen, and create, update, or delete all-day leave events titled {Name} — Unavailable, marked free/transparent, with a private vaiaLeaveRequestId. Sharing that calendar is done by the administrator in Google or Outlook; Vaia Space does not set calendar ACL. Ordinary members never see this write consent.

The write scope is a superset of read, so one administrator consent can also enable personal pull for that account. Calendar tokens are encrypted at rest and are never written to application logs. Disconnecting in Vaia Space or revoking access at the provider stops sync.

2.4 Slack

When your administrator installs the Vaia Space Slack app, we receive your Slack workspace identifier, the bot token issued to Vaia Space, and the names and IDs of users we resolve in order to route deliveries. We request only commands, chat:write, users:read, users:read.email, and views:open. We post messages and resolve users by email. We do not request history scopes (channels:history, groups:history, im:history, mpim:history) or channel-list scopes (channels:read, groups:read), and we therefore cannot read the contents of any channel. Uninstalling the Slack app revokes the bot token immediately.

2.5 Information collected automatically

Technical data: IP address, browser and device type, operating system, language, referrer URL, timestamps of requests, and error logs. We use this to operate, secure, and debug the Service.
Cookies and storage: on the marketing site, a language-preference cookie and — only after you consent — a Google Analytics cookie used to measure aggregate site usage. The consent banner is shown on first visit and your choice is stored locally. The application at app.vaia.space does not keep you signed in with a session cookie. Access and refresh tokens are stored in the browser's localStorage, as are preferences such as theme, last route, and onboarding state.
Website assistant: the marketing site loads the Konvuno chat widget, also operated by Engineers Space LLC. Loading a page creates no identifier. If you open the chat, a random session identifier is kept in that tab's sessionStorage, and the conversation is cached in the widget's own sessionStorage; both expire after 30 minutes of inactivity. Your messages are processed by Konvuno and its AI provider (OpenAI) to answer you, as described in the Konvuno Privacy Policy. Please do not share sensitive personal data in the chat.

2.6 Files

Documents and hiring files are stored on Cloudflare R2 under a private prefix. Avatars and organization logos are stored on the public media prefix.

3. How we use information

Provide the Service — authenticate you, maintain your account, render the workspace you belong to, process the actions you take, including calendar busy time and team-leave events you authorize.
Operate and secure the Service — detect abuse, prevent fraud, rate-limit and block automated attacks, investigate incidents, maintain backups.
Communicate with you — send sign-in codes, transactional notifications, in-product messages, and (where permitted) product announcements you can unsubscribe from at any time.
Improve the Service — analyze usage patterns and limited crash diagnostics to identify bugs and improve features.
Comply with the law — meet legal obligations (for example, tax records or responding to lawful requests from authorities).

We do not sell personal data. We do not use Customer Content to train Vaia's own artificial intelligence or machine learning models. When the assistant module is on, a member's message is sent to the deploy's model provider as described in section 11.

4. Legal bases for processing (EEA / UK)

If you are in the EEA or UK, the lawful bases we rely on are:

Performance of a contract — providing the Service to you and to your organization (Article 6(1)(b) GDPR).
Legitimate interests — securing the Service, preventing abuse, debugging, and limited product analytics (Article 6(1)(f) GDPR). You can object at any time.
Consent — for optional analytics cookies and for marketing communications, where applicable (Article 6(1)(a) GDPR). You can withdraw consent at any time.
Compliance with legal obligations — Article 6(1)(c) GDPR.

We share personal data only with:

Your workspace. Members and administrators of the workspace you belong to can see the workspace data you contribute, in accordance with the role assigned to them.
Providers and integrations used to deliver the Service, including:
- DigitalOcean — hosts the API;
- Cloudflare — hosts the marketing site and application (Pages) and stores files (R2);
- PostgreSQL — primary database;
- Valkey (Redis-compatible) — cache, queues, and short-lived coordination;
- Resend — transactional email delivery;
- Sentry — application error tracking;
- authentication providers you choose to use (Google, Microsoft);
- integration providers your organization installs (Slack; Google Calendar and Microsoft Outlook when connected);
- Anthropic or Google — the deploy's assistant model provider, only when the assistant module is on for your organization (section 11);
- Airtable, which may retain historical marketing waitlist records;
- Konvuno (Engineers Space LLC), with OpenAI generating its replies — the website assistant on the marketing site;
- Google Analytics, used only after you consent, on the marketing site.
Contact us about the processor terms, provider identities, and processing locations applicable to your workspace at hello@vaia.space.
Legal and safety. Authorities or other third parties when we believe in good faith that disclosure is required by law, or necessary to protect the rights, property, or safety of Vaia, our users, or others.
Corporate transactions. A successor entity in the event of a merger, acquisition, or sale of assets, subject to commitments at least as protective as this Policy.

6. International data transfers

Engineers Space LLC is based in the United States. Information may be processed by providers in other countries whose data-protection laws differ from your own. Your organization should review the processing locations and transfer arrangements applicable to its workspace before authorizing use. Contact us for those details and the applicable contractual terms. This Policy does not itself execute a data processing agreement or transfer agreement.

7. How long we keep data

Account data: kept while needed to provide and secure your account. You can request account export or deletion through the contact address below. Requests are reviewed for identity, organizational responsibilities, and applicable retention requirements; account closure does not automatically erase employer-controlled records.
Workspace data (Customer Content): retained under your organization’s instructions and applicable recordkeeping requirements. Removing a member or archiving a workspace does not itself erase its records. Workspace erasure requires a separate authorized action. There is no guaranteed recovery window after erasure.
Assistant conversations: retained for ninety (90) days from last activity, then purged.
Backups: copies in backups are separate from primary storage. Backup expiry and any restoration must be handled under the applicable hosting and recovery procedures. Contact us for the schedule applicable to your workspace; this Policy does not promise a fixed backup expiry period.
Operational logs: used for security, reliability, and incident investigation. Their retention depends on the deployment and logging provider. Contact us for the applicable schedule; this Policy does not promise a fixed log retention period.
OAuth refresh tokens: retained only while the corresponding sign-in or integration is active. Tokens are encrypted at rest and are never written to application logs.
Waitlist entries: pausing registration does not automatically erase historical entries. Contact us to request removal; existing records remain subject to the applicable retention and deletion review.

We may retain information longer where required by law (for example, accounting and tax records) or where reasonably needed to resolve disputes and enforce our agreements.

8. Your rights

Subject to applicable law (including the GDPR), you have the right to:

access the personal data we hold about you;
request correction of inaccurate or incomplete personal data;
request deletion of your personal data ("right to be forgotten");
request a copy of your data in a portable, machine-readable format;
request that we restrict or object to certain processing;
withdraw any consent you previously gave us;
lodge a complaint with a data-protection supervisory authority in the country where you live or work.

If your data sits in a workspace administered by your organization, we will route requests to your administrator where appropriate, since they are the controller for that workspace. To exercise your rights, write to hello@vaia.space.

9. Security

We take reasonable and appropriate technical and organizational measures to protect personal data, including encryption in transit (TLS), encryption at rest for stored credentials and OAuth refresh tokens, scoped access tokens that we do not log, access controls and least-privilege principles for our staff, and routine vulnerability and dependency scanning. No system is perfectly secure; we will notify affected users and relevant authorities of any personal-data breach in line with applicable law.

10. Children

The Service is intended for professionals aged eighteen (18) or older. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with personal data, please contact us and we will delete it.

11. Automated decisions and the assistant

We do not use personal data for solely automated decision-making that produces legal or similarly significant effects on you.

The assistant is an optional organization module. New organizations are seeded with the assistant off. When an administrator turns it on, a member's message is sent to the deploy's model provider — Anthropic (Claude) or Google (Gemini), selected by the ASSISTANT_PROVIDER setting — so the assistant can route the request to capabilities the member already has. The assistant is not an authorization boundary: it cannot do anything the member cannot do themselves. Conversation messages are retained for ninety (90) days from last activity and then purged. We do not use Customer Content to train Vaia's own models.

External AI clients can also connect through personal MCP keys, separately from the built-in assistant. A connected client can receive data through capabilities allowed to the member who owns the key. Turning off the built-in assistant does not disable MCP keys. Key owners can revoke their keys; your organization should authorize any external client before workspace information is shared with it. That client’s own privacy and retention terms also apply.

Leave-health indicators and workload views summarize recorded activity and may be visible to authorized managers. They are advisory information for human review, not instructions to make employment decisions automatically. Ask your organization about its use of these features and its employee notices.

12. Changes to this Policy

We may update this Policy from time to time. Material changes — in particular, any expansion of OAuth scopes, integration permissions, sub-processors, or retention windows — will be announced by email or in-product notice. The most current version is always available at https://vaia.space/privacy and https://app.vaia.space/privacy.

13. Contact

Questions about this Privacy Policy, or requests to exercise your rights, can be sent to hello@vaia.space, or by post to Engineers Space LLC, 75 E 3rd St, Sheridan, WY 82801, USA.