Who we are
Spaicely is a service of Vuurpijl Beheer B.V., Lagedijk 11A, 2064 KV Spaarndam, the Netherlands, Dutch Chamber of Commerce number 34108141. We are the controller of your personal data. Send privacy questions to info@spaicely.com; we reply within a month, usually much sooner. We have no data protection officer; a company of our size is not required to.
Which data, and why
Each part says on which legal basis under the GDPR we process the data. Spaicely is still being built: what is described here runs today. When something is added, we update this policy first.
Waiting list
When you sign up, we keep your email address, the language and region of the page you signed up on, and when you confirmed. You first get an email to confirm; without confirmation we send nothing more. Every email has a link to unsubscribe. Basis: your consent.
Account
For an account we keep your email address, your name and your preferred language. You sign in with a passkey, a link by email or your account at Google, Apple or Microsoft; we have no passwords. When you sign in through Google, Apple or Microsoft, they give us only your name, your email address and a fixed number for your account there; we keep that number to recognize you. Apple may give a forwarding address instead of your own. We do not see what you do at those services. Of a passkey we keep only the public key, never anything that lets someone sign in. Per session we keep when you signed in and when you were last active. We also record which version of the terms of service you accepted, and when. Basis: our contract with you.
Holder details for a domain name
Registering a domain name requires a holder: name, organization if any, address, email address and phone number. We pass these to the registry of the extension and to the registrar, because registering is impossible otherwise. Some registries show a limited part publicly in WHOIS or RDAP; for private persons most extensions hide it. Basis: our contract with you.
Transfer codes
When you transfer a domain name to us, you give a transfer code (authorization code). We store it encrypted and delete it as soon as the transfer completes or is cancelled. Basis: our contract with you.
Payments and invoices
For payments we keep your account’s billing address, whether it is a business and, if you give one, the VAT number. We check a VAT number with the European Commission’s VIES; we keep the name VIES returns and when we checked. You pay at Stripe: your card or bank details only reach Stripe, we only see whether and when a payment was made. When you pay for a domain name or save a payment method, Stripe keeps the card or direct debit mandate for automatic renewal; we only keep a label such as the brand and the last four digits, and remove it at Stripe as soon as you delete it. For every payment we issue an invoice with your name, address and what you bought. Basis: our contract with you, and for invoices the legal duty to keep them.
Connected AIs
When you connect your own AI to Spaicely, we keep which application it is, for which account and sites, and which permissions you gave. The keys themselves we keep only as a hash. What a connected AI or a person does in your account is recorded in a log, so you can see later who did what. Basis: our contract with you and our legitimate interest in a secure service. An action your AI must ask your approval for first is kept encrypted, with everything the AI sent along, until 90 days after the request.
Domain search
You can search without an account. Your own browser does the quick check: it asks Cloudflare (DNS over HTTPS) whether the names have nameservers. Cloudflare sees your IP address and the names you search for; according to Cloudflare, your IP address is deleted within 25 hours and is not sold or used for advertising. We then look up the names that seem available in the registries' public lookup services (RDAP). We keep that answer for ten minutes, so we do not ask the registry again and again. We use your IP address only to stop too many requests. Basis: our legitimate interest in a fast, working and fairly shared service.
Visitor statistics
On spaicely.com we use Google Analytics, but only if you accept it in the cookie notice. Without your consent we do not load it. Your IP address is anonymized. Basis: your consent, which you can withdraw at any time with the Cookies link at the bottom of every page.
When you email us, for example at info@spaicely.com, we keep your message and our reply as long as we need to help you. Emails we send (confirmations, sign-in links, messages about your domain) go through our own mail service, Euromailing. Basis: our contract with you, or our legitimate interest in answering your question.
Notices of illegal content
If you report content on a site we host, through the notice form or abuse@spaicely.com, we keep the address of that content, your explanation, your name and email address, the language and our decision. A notice of child sexual abuse needs no name or email address. We use your details to assess the notice and to email you the receipt and our decision. The site owner does not get your name or address; we only give them to the police or the courts when the law requires us to. Basis: the legal duty under the Digital Services Act to handle notices.
Visitors of sites we host
When you visit a site that Spaicely hosts, the owner of that site is responsible for your data. We process it only on that owner's behalf and use it for nothing else. So please ask the owner of the site about your data; if such a request reaches us, we pass it on. We set this down in a data processing agreement with every customer.
The pages
Bunny (Slovenia) serves the pages from servers in many places around the world, so a site loads quickly everywhere. That needs your IP address, which Bunny keeps for a short time in a log for security and troubleshooting. We set no cookies of our own on customer sites. If the owner adds analytics or another service to their site, the privacy statement of that site covers it.
Forms
When you send a message through a contact form, we email it to the owner's address, with your address to reply to. By default we do not keep the message itself; we only count how many came in. When you sign up for a list, we keep your email address and, if you fill it in, your name. The owner only sees you once you have confirmed your address through our email, and gets a link for each address that lets you unsubscribe. If you do not confirm, or you unsubscribe, we erase your details after 30 days; if the site goes away, at once. If you ask for a download, we mail what you fill in to the owner in the same way and send you a download link. By default we do not keep that either; we only keep the link until it expires, without your details. A discount code works the same way: the owner gets what you fill in and which code you got, and you get the code. For a list of codes we only note when a code went out, not to whom. If the owner switched on keeping submissions for the form, we keep what you fill in (and which code you got) so the owner can see it again in our dashboard; the owner can remove it sooner, and we erase it after a year. We use your IP address only to stop abuse: it stays a few minutes in the server's memory and never goes into a database. Forms run at Hetzner in Germany, and the mail goes through Euromailing.
Orders
When you order from a web shop we host, you pay through Stripe (Ireland) straight to the owner of the shop; we never see your payment details. We keep what you ordered, the amount, and your name, email address and delivery address, and mail them to the owner so they can deliver. We erase your name and addresses 90 days after the payment; by then the owner has them in their mail and in Stripe, where they keep them as long as the law requires. An order you do not pay for is erased after 30 days. If you pay through a form for a download or code, it works the same way: what you filled in and the code you got are kept with the payment and erased after the same 90 days. If you donate through a donation form, it works the same way: you pay the owner through Stripe, we keep the amount, name, email address and message and erase name and email address after 90 days. If you check that your name and message may show on the site, they stay there until the form is gone, and at most one year after the form's last day.
Mail to a forwarded address
If you email an address on a customer's domain that we forward, such as info@, your mail goes through our mail service Euromailing to that customer's inbox. To do so we read the sender, recipient, subject and content, and check the mail for spam, fraud and risky attachments; such mail is not forwarded, and the customer can look at it and have it forwarded after all. We keep the mail for 30 days and then delete it; that we delivered it is kept for statistics, without the content. The customer is responsible for what happens to your mail; we are the processor. Basis: the customer's legitimate interest in receiving mail on their domain, and ours in preventing abuse.
Who we share data with
Only with parties needed to deliver the service, each bound to confidentiality. Hetzner (Germany) provides our servers and databases. Euromailing (our own mail service, servers in the EU) sends and receives email. Bunny (Slovenia) hosts customer sites. Realtime Register (Netherlands) registers and transfers domain names and receives the holder details for that. Stripe (Ireland) processes payments; your card details go only to Stripe, never to us. Google stores the backups of our databases (Google Drive) and, only with your consent, provides Google Analytics. Registries such as SIDN (.nl), EURid (.eu) and Verisign (.com) receive the names searched and, on registration, the holder details. The European Commission (VIES) receives VAT numbers we check. We sell no data and share none for advertising.
Outside the European Union
We keep data in the EU wherever we can. Google and Stripe may process data in the United States; that happens under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses. Registries of extensions outside the EU, such as .com, are themselves outside the EU; holder details only go there if you register such an extension.
How long we keep data
Waiting list: until you unsubscribe, and at most until November 1, 2027, a year after Spaicely opened to everyone. A sign-up you do not confirm is deleted after 30 days. Account: as long as your account exists; after that we delete it within 30 days. Holder details: as long as the domain name is with us. Notices of illegal content: one year after our decision, after which we delete them automatically. Invoices and what they require we keep for seven years, because the law demands it. Server logs we keep briefly, only for security and fixing faults. Backups are overwritten over time.
Cookies and local storage
In the app we set one cookie that keeps you signed in; the service cannot work without it. On spaicely.com your browser remembers your choice of language, light or dark mode and the cookie notice itself in local storage; that stays on your own device. Google Analytics cookies only come after your consent.
Your own AI
Spaicely works with the AI you choose, such as Claude, ChatGPT or Gemini. What you type in that conversation and what that AI does with it falls under that provider's terms and privacy policy, not ours. We receive only what the AI asks or passes on through our connection to Spaicely.
Security
Signing in uses passkeys or one-time links, so there are no passwords to leak. All connections are encrypted with TLS. Keys of connected AIs are stored as a hash and transfer codes encrypted. Spaicely administrators can only change anything shortly after signing in with a passkey.
Your rights
You may see your data, have it corrected or have it deleted. You can have processing restricted, object to it, receive your data in a common format and withdraw consent you gave. Send your request to info@spaicely.com; we may ask you to confirm that the request comes from you. If you disagree with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.
Changes
As Spaicely grows, this policy changes with it. The date at the top says when it was last updated. If something important changes for people with an account, we email them beforehand.