Your data,
protected.

Orispace Studio SAS(“Orispace”, “we”, “us”, or “our”) is committed to protecting your personal data. This Privacy Policy explains what data we collect, why we collect it, how we use it, and what rights you have over it.

It applies to all services accessible via orispace.co, viewer.orispace.co and venue.orispace.co (collectively, the “Service”).

The data controller responsible for your personal data is:

One exception matters, and section 06 explains it: when you pay for a plan, the payment itself is not processed by us but by Link, which acts as the seller and as its own data controller for that transaction.

We never see or store your card number. Card details are entered on Link’s own checkout page and stay with Link.

We do not collect sensitive data (health data, political opinions, biometric data, etc.).

You can permanently delete your account and all associated data at any time from your account settings (Danger zone).

We use the following sub-processors to operate the Service. Each acts solely on our instructions and is bound by a data processing agreement.

We do not sell your data to any third party. Your files are never shared with third parties outside the providers listed above.

Payments are handled through Stripe Managed Payments, under which Link (Sold through Link, LLC) is the Merchant of Record: it is the seller for the transaction, not a service provider acting on our behalf. For the payment data it collects from you, Link is therefore an independent data controller, with its own privacy policy and its own legal bases, and not our sub-processor.

Link collects your payment details, name, billing address and the tax information it needs to invoice you and to remit VAT. It sends you the receipt and invoice directly. It returns to us only what we need to run your subscription: your billing email, the invoice and subscription references, and your plan.

You can manage your order history, payment method and billing address at link.com.

Deletion requests sent to Link. If you ask Link to delete your payment data, it will also cancel any subscription sold through it and erase the related billing records held in our payment account. That is a consequence of the request, not a separate decision by us. If you want to keep your subscription running, address your request to us instead, at contact@orispace.co.

Some of our sub-processors are based in the United States. These transfers are governed by either the EU-US Data Privacy Framework (an adequacy decision by the European Commission) or Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring a level of data protection equivalent to that in the European Union.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): obtain a copy of the data we hold about you
• Right to rectification (Art. 16): correct inaccurate or incomplete data
• Right to erasure (Art. 17): request deletion of your data (“right to be forgotten”)
• Right to restriction (Art. 18): request that we limit processing of your data
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interest
• Right to withdraw consent (Art. 7): where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at contact@orispace.co. We respond within one month. Where a request is complex or you have made several, we may extend that by up to two further months, and we tell you within the first month if we do.

For payment data held by Link as an independent controller, address your request to Link directly, and read section 06 first: a deletion request there also cancels your subscription.

You also have the right to lodge a complaint with the French data protection authority, CNIL(Commission Nationale de l’Informatique et des Libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.

We use no advertising, tracking or analytics cookies, and no analytics or audience-measurement service of any kind on orispace.co, viewer.orispace.co and venue.orispace.co.

Authentication sessions are maintained through the browser’s localStorage, which is local to your device and never transmitted to third parties. This token expires when you log out or clear your browser storage.

Checkout happens on Link’s own domain rather than ours, so no third-party payment cookie is placed on our sites either. Any cookie set during checkout is set by Link, on its own page, and is strictly necessary to process your payment securely.

Because nothing we place requires consent under applicable law, we do not show a cookie banner. If that ever changes, we will ask for your consent before setting anything.

We implement appropriate technical and organisational measures to protect your data against unauthorised access, disclosure, alteration or destruction. These include encryption in transit (TLS), encryption at rest, and access controls on all data stores.

In the event of a data breach likely to affect your rights and freedoms, we will notify you and the CNIL within the timeframes required by law.

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at contact@orispace.co and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we update the “Last updated” date at the top of this page and, where the change is material and affects you, we notify you by email or in the Service before it takes effect.

Where a change would require your consent, we ask for it rather than assume it. See also section 14 of our Terms of Service.

For any questions about this Privacy Policy or your personal data: