Privacy notice
This notice explains how portaficta handles personal data for its public site, founder service, experiments, and support operations.
Privacy notice active
The required legal facts, counsel approval, and overall launch approval are configured.
Controller and operator
Space Island Ltd, at 71-75 Shelton Street, Covent Garden, London, United Kingdom WC2H 9JQ, operates portaficta and is the controller responsible for the personal data described in this notice.
Who this covers
This notice covers visitors to portaficta, founders who submit ideas or operate experiments, and people who submit their details on an experiment site.
Data we collect
We may collect account and contact details, submitted idea and business information, approvals and edits, payment and order identifiers, experiment configuration, campaign evidence, support messages, security events, and lead details.
How we use it
We use data to screen and run an approved experiment, create and version its materials, process separate purchases, prevent abuse, collect leads, report evidence, provide exports and deletion, secure the service, keep required financial records, and communicate about the service.
Why we process it
We process founder and order data to provide the requested service and take pre-contract steps; financial records to meet legal duties; security and service records for our legitimate interests in operating a safe, accountable service; and the details people submit on an experiment site because they asked to be contacted about the founder's offer or to take a step toward it.
Processors, regions, and transfers
We use Hetzner (Germany) for hosting and storage, Cloudflare for network delivery and security, AI model providers for generating page text, images and transcribing voice notes, Resend for email delivery, Stripe for payments, and Google for sign-in with Google. Where the related features are turned on, we also use Sentry for error reporting and Meta for measuring ad conversions. Processing may take place in the United Kingdom, the European Union and the United States. These providers describe their international-transfer safeguards, including applicable contractual clauses, in their data processing terms. Contact space.island.limited@gmail.com for details about the providers and safeguards relevant to your data. These providers may process data only for their contracted work. Where data crosses jurisdictions, the stated approved transfer safeguards apply. We do not sell personal data.
Retention and deletion
Account information and saved projects are kept for as long as needed to provide the service. Unsaved drafts expire under the Builder session policy. Details people submit on a founder's page are kept until the founder deletes them or their account is deleted; they have no fixed retention period. You can request access, export or deletion by emailing space.island.limited@gmail.com. Information needed to meet legal obligations, resolve disputes or prevent abuse may be retained for those purposes. At the end of each period, data is deleted or irreversibly anonymised unless a longer period is required for tax, payment, fraud-prevention, or a legal claim.
Your choices and rights
Where applicable, you may request access, correction, deletion, restriction, portability, or a copy of your data; object to processing based on legitimate interests; and withdraw consent at any time without affecting earlier lawful processing. You may also complain to a supervisory authority. We verify requests, respond within the legally required period, and explain any lawful refusal.
Questions and complaints
Contact us first if you want us to address a privacy concern. You may also complain to the UK Information Commissioner’s Office (ICO), ico.org.uk, or the data protection authority where you live or the competent authority where you live or work, without losing any other remedy.
Security
Production is required to encrypt sensitive application data, restrict operator access, keep generated experiment sites isolated from the control plane, avoid storing card numbers, record audited interventions, and maintain tested takedown, backup, and restore procedures.
Changes to this notice
Material changes receive a new effective date and, where required, direct notice or renewed consent. Earlier processing remains governed by the notice and consent wording recorded at that time.