Skip to content
Slatespace logoSlatespace
Open App

Privacy Policy

Last updated September 19, 2026

This Privacy Policy explains how CDT Spotter PLT (“CDT Spotter”, “we”, “us”, or “our”) collects, uses, stores, discloses, and protects information when you use Slatespace, including the Slatespace web application, mobile applications, website (https://slatespace.app and https://slatespace.my), and related services (collectively, the “Service”).

By using Slatespace, you acknowledge the practices described in this Privacy Policy.

1. Who We Are

Slatespace is a client relationship and project management platform operated by:

For questions regarding this Privacy Policy or the handling of your personal data, please contact us at the email address above.

2. Information We Collect

We collect information that you provide directly to us, information generated through your use of Slatespace, and information necessary to operate and secure the Service.

2.1 Account Information

When you create or use a Slatespace account, we collect information such as:

  • Email address
  • First and last name
  • User ID or authentication identifier
  • Organization or company name
  • Account and workspace information
  • Profile avatar or photograph (if provided)
  • Authentication and account-related credentials

2.2 Workspace and Team Information

Slatespace allows users to create workspaces and collaborate with team members and clients. We process:

  • Workspace names, slugs, and settings
  • Team member names and email addresses
  • User roles and permissions (e.g., Owner, Admin, Member, Client roles)
  • Client organization names and engagement settings
  • Project and task collaboration structures

2.3 Customer Content

Slatespace allows customers to create, upload, store, and share content through the Service (“Customer Content”). Customer Content may include:

  • Projects, boards, lists, and tasks
  • Descriptions, notes, and rich-text documentation
  • Client details and onboarding responses
  • Comments, annotations, and timestamped video feedback
  • Uploaded media files, images, documents, and videos
  • Canvas drawings, cards, and collaboration layouts
  • Project dates, deadlines, shooting dates, and posting schedules
  • Other information that users choose to enter or upload to Slatespace

Customers are responsible for ensuring that they have the appropriate rights, permissions, and legal basis to provide Customer Content to Slatespace and to allow us to process it in connection with the Service.

2.4 Technical, Device, and Usage Information

When you access Slatespace, we automatically collect:

  • Internet Protocol (IP) address
  • Browser type and version
  • Operating system and platform
  • Device hardware model and unique device identifiers
  • Mobile push notification tokens (for delivering alerts via Firebase Cloud Messaging)
  • Pages, screens, features, and tabs accessed
  • Session timestamps, duration, and user interactions
  • Diagnostic, error, and crash logs

2.5 Mobile Device Permissions

When using our mobile application on iOS or Android, the application may request the following device permissions:

  • Camera: Used solely if you choose to take a photo directly for your profile avatar.
  • Photo Library: Used solely if you choose to select an existing image from your device for your profile avatar.
  • Push Notifications: Used to deliver real-time notifications regarding task assignments, comments, deadlines, and project updates.
  • Local Network: Used during local testing and development configurations.

You can modify or revoke these permissions at any time through your device operating system settings.

3. How We Use Information

We use information collected through Slatespace to:

  • Create, manage, and maintain user accounts
  • Authenticate user identity and prevent unauthorized access
  • Provide, operate, and maintain Slatespace web and mobile applications
  • Create and manage workspaces, projects, boards, and tasks
  • Enable collaboration and communication between agencies, creators, and clients
  • Store, process, and deliver Customer Content
  • Send automated push notifications and transactional service emails
  • Deliver customer support and respond to user requests
  • Process and administer subscriptions and payments where applicable
  • Monitor and maintain infrastructure security and integrity
  • Detect, prevent, and investigate fraudulent activity or terms violations
  • Diagnose errors, fix bugs, and optimize performance
  • Analyze product metrics and feature engagement to improve the Service
  • Comply with legal and regulatory obligations

We will not use Customer Content for purposes unrelated to providing, securing, maintaining, or improving Slatespace unless authorized by the customer or otherwise permitted or required by applicable law.

4. Customer Content and Workspace Administration

Slatespace is designed for organizations to collaborate with their teams and clients. Depending on their assigned roles and permissions, workspace administrators and authorized users may access, modify, export, share, or delete Customer Content within their workspace.

If you use Slatespace as a member or invited client of an organization, that organization controls access to the workspace and Customer Content. Questions regarding how an organization manages content within its workspace should be directed to that organization.

5. How We Share Information

We do not sell your personal information. We disclose information only in the following circumstances:

  • Workspace Collaborators: Information and Customer Content are shared with other members of your workspace or room according to the permissions and sharing settings configured by the customer.
  • Service Providers (Subprocessors): We share data with third-party service providers that provide essential infrastructure, storage, authentication, communication, and analytics services necessary to operate Slatespace.
  • Legal Requirements: We may disclose information if required to do so by applicable law, regulation, legal process, or lawful governmental request.
  • Protection of Rights and Safety: We may disclose information where necessary to enforce our terms, investigate security incidents, or protect the safety and property of Slatespace, our users, or the public.
  • Business Transfers: If CDT Spotter PLT is involved in a merger, acquisition, reorganization, or sale of assets, user data may be transferred as part of that corporate transaction under confidentiality terms.

6. Third-Party Services and Subprocessors

Slatespace utilizes trusted third-party service providers to deliver the Service. These providers process information on our behalf strictly to deliver their designated services:

  • Supabase: Authentication (including OAuth identity management), user accounts, and PostgreSQL database infrastructure.
  • Cloudflare (Cloudflare R2): Secure cloud object storage and global content delivery for user-uploaded media, video cuts, images, documents, and project assets.
  • Vercel: Web application hosting, serverless compute, edge networks, and deployment delivery infrastructure.
  • Firebase Crashlytics (Google LLC): Mobile application crash reporting, diagnostic error telemetry, stack trace analysis, and real-time app stability monitoring.
  • Firebase Cloud Messaging (Google LLC): Remote push notification delivery for task assignments, client feedback, comment mentions, deadlines, and project updates on mobile devices.
  • PostHog: Product analytics and user interaction telemetry to understand feature usage and improve user experience.
  • Enginemailer: Transactional email delivery for account verification, password resets, email authentication hooks, and collaboration alerts.
  • Google API Services (Google LLC): Google OAuth authentication, Google Calendar event synchronization (deadlines, shooting dates, posting schedules), and Google Drive file attachment integrations.
  • Apple Inc.: Sign in with Apple authentication on iOS devices and Apple App Store mobile application distribution and subscriptions.
  • Stripe: PCI-DSS certified payment processing for web platform subscriptions, invoices, and billing administration.

7. Google API Services User Data Policy (Google Drive & Google Calendar)

Slatespace allows users to optionally connect their Google Account to enable Google Calendar synchronization (for project deadlines, shooting dates, and posting dates) and Google Drive file attachments.

Slatespace’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, train, or improve machine learning or artificial intelligence models, nor do we transfer Google user data to third parties except as necessary to provide or improve user-facing features.

8. Cookies and Local Storage Technologies

Slatespace uses cookies, local storage, and software development kits (SDKs) to:

  • Keep you signed in securely across sessions
  • Maintain workspace state and user preferences
  • Deliver core collaboration features and canvas synchronization
  • Monitor performance and analyze aggregate usage trends

You may configure your browser or device settings to block cookies; however, essential cookies are required for authentication and core app functionality.

9. Data Security

We implement appropriate technical and organizational measures designed to protect your data against unauthorized access, loss, alteration, or disclosure. These measures include:

  • Encryption of data in transit using Transport Layer Security (TLS/HTTPS)
  • Encrypted storage for sensitive third-party integration tokens (e.g., OAuth tokens)
  • Role-based workspace access controls and database security policies
  • Continuous server-side validation and monitoring

While we take rigorous steps to protect your data, no internet transmission or electronic storage method is completely infallible, and absolute security cannot be guaranteed.

10. Data Retention

We retain personal information and Customer Content for as long as your account or workspace remains active, or as reasonably necessary to fulfill the purposes set out in this Privacy Policy, resolve disputes, enforce agreements, and comply with legal requirements.

Upon account deletion, personal data is permanently removed or anonymized from active databases, and backups are purged in accordance with standard backup rotation lifecycles.

11. In-App Data and Account Deletion

You maintain full control over your account and personal data:

  • Self-Service In-App Deletion: You can delete your Slatespace account and all associated personal data directly within the application at any time. Simply navigate to Settings > Account > Delete Account and confirm your email address. Your account and personal profile will be immediately scheduled for permanent deletion.
  • Deletion by Request: You may also request account or data deletion by emailing hello@slatespace.app (or darrelltwh@gmail.com). We will verify your identity and process your request within applicable statutory timeframes.

12. Your Privacy Rights

Depending on your jurisdiction, you may have rights regarding your personal information, including:

  • The right to access and receive a copy of your personal data
  • The right to rectify inaccurate or incomplete personal data
  • The right to request erasure of your personal data
  • The right to restrict or object to certain processing activities
  • The right to data portability
  • The right to withdraw consent at any time without affecting lawful prior processing

To exercise any of these rights, contact us at hello@slatespace.app.

13. Malaysia Personal Data Protection Act (PDPA 2010)

CDT Spotter PLT operates from Malaysia and complies with the Personal Data Protection Act 2010 (PDPA) and its regulations. Personal data is processed on the basis of your consent and as necessary for the performance of our contract with you to provide the Service. You have the right to request access to and correction of your personal data held by us, or withdraw consent, by contacting our Data Protection contact at hello@slatespace.app.

14. California Privacy Rights

If you are a resident of California, you may have statutory rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information is collected, the right to request deletion or correction, and the right not to receive discriminatory treatment for exercising your privacy rights. Slatespace does not “sell” personal information or “share” personal information for cross-context behavioral advertising as defined under California law.

15. International Data Transfers

Slatespace operates globally. Information we collect may be transferred to, stored, and processed in cloud data centers located in the United States, Singapore, or other countries where our cloud service providers (such as Supabase, Vercel, and Cloudflare) operate. Where transfers occur across borders, we ensure adequate protections and contractual safeguards are maintained.

16. Children’s Privacy

Slatespace is a professional business productivity platform and is not directed to individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that a child has provided us with personal information, we will delete such data immediately.

17. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect enhancements to Slatespace, changes in our data practices, or updated legal requirements. We will notify you of material changes by updating the “Effective Date” at the top of this policy and, where appropriate, providing prominent in-app notification.

18. Contact Us

For questions, feedback, or privacy-related requests, please contact: