privacy policy
1. who is responsible
for holdspace.live and your Holdspace account, the controller is DRMAMU LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA (“Holdspace” or “we”), whom you can reach at hello@holdspace.live. when you book sessions with a facilitator, that facilitator is responsible for your data as their participant, as described in the privacy policy on their page. Holdspace then processes your data on the facilitator’s behalf, and only in order to run the platform.
2. what we collect
what you give us. as a participant, we store your email address and first name, your tickets, memberships, 1:1 packages and their dates, and payments (the amounts only, because your card details stay with Stripe and we never store them), the email addresses and first names you enter when you buy tickets for friends, whether you joined a session, and your timezone. as an affiliate, we also store who joined through your link, your commissions and the payout details you enter (for example a PayPal email address, a Wisetag, a Revolut phone number or bank details). as a facilitator, we store your name, email address and business details, your legal name and address, your page texts, photos and videos, your prices and schedule, your team members, your Stripe account ID and your zoom connection. when you send us a message through “bugs, needs & help” in your dashboard, we receive your message, the screenshots you add, your email address and technical details of your browser (system and browser version, screen and window size, language, timezone, the page you were on and your IP address); we use them only to answer you and to fix or improve what you report.
what is collected automatically. when you use holdspace.live, we collect your IP address, information about your device and browser, the pages you view, your clicks and other interactions, and the page you came from. we do this with cookies and our product analytics, as described in sections 6 and 7.
3. what we use it for
we use your data to run the platform: to sign you in, to sell and deliver tickets, memberships and 1:1 sessions, to send confirmations, reminders and access to your sessions, to track affiliate commissions, to process payments and to help you when you write to us. once a facilitator’s page is live, we may also show their name, photo, what they do, the start of their intro and a summary of their sessions on holdspace.live, so that people can discover them (a facilitator who prefers not to be listed can write to us). we also use it to keep Holdspace secure and to prevent abuse, to understand and improve how Holdspace is used, to send facilitators news about Holdspace, and to meet our legal obligations, such as bookkeeping and tax. we never sell your personal data, and we never share it for advertising.
4. legal bases (GDPR)
where the GDPR applies, we process your data on the following legal bases: to perform a contract with you, such as your bookings, your account or your license (art. 6(1)(b)); our legitimate interest in securing, measuring and improving Holdspace and preventing abuse, which we always weigh against your rights (art. 6(1)(f)); your consent, where the law requires it, for example for non-essential analytics under the ePrivacy rules and, in Germany, §25 TDDDG (art. 6(1)(a)); and our legal obligations, such as bookkeeping, tax and fraud prevention (art. 6(1)(c)). you can withdraw a consent at any time with effect for the future.
5. who else receives it
the facilitator you book with sees your name, your email address and your bookings, because that is what the platform is for. apart from that, your data is only shared with the services we use to run Holdspace, which act as our processors under data-processing agreements. these are Stripe for payments (on the facilitator’s own Stripe account); zoom for the sessions, which receives your email address and first name when you get a personal link and shows your first name to the other participants (if a facilitator records sessions or turns on captions, the recording or transcript is kept in that facilitator’s zoom account or on their computer); our email provider Resend; our hosting provider in Germany; and our analytics tools, Amplitude and, where enabled, Plausible. each of these services also has its own privacy policy.
6. cookies and similar technologies
we use necessary cookies to keep you signed in, and to remember an affiliate link you followed (for 60 days); a discount code from a link is kept in your browser tab only, until you close it. for analytics, we use a first-party device ID as well as Amplitude’s pseudonymous device and session IDs, stored in cookies or local storage, so that page views can be connected (see section 7). where the law requires consent for non-essential cookies, we ask for it first, and you can withdraw it at any time. you can also delete or block cookies in your browser. our emails may contain a small pixel that measures whether they were opened; you can avoid it by blocking images.
7. product analytics and session replay (Amplitude)
we use Amplitude (Amplitude, Inc.) to understand how holdspace.live is used and to improve it. Amplitude collects pseudonymous data, namely a device and session ID, the pages you view, your clicks and other interactions, your device and browser type, and an approximate location derived from your IP address. we also send some events from our servers, for example when someone signs up or buys a ticket. Amplitude’s session replay reconstructs how you move through the pages (views, clicks and scrolling) so that we can find usability problems; it masks everything you type by default. we use Amplitude’s EU server zone, so this data is processed in the EU. you can object at any time by turning on “do not track” or global privacy control in your browser, or by blocking analytics scripts.
8. how long we keep it
we keep your data for as long as you have an account and for as long as it is needed to run your bookings, to settle disputes and to meet bookkeeping and tax obligations for payment records. we keep analytics data only for a limited time. you can ask us to delete your account at any time, unless the law requires us to keep certain data.
9. transfers outside the EU
DRMAMU LLC is based in the USA, and some of the services we use, such as Stripe, zoom and Resend, may process data outside the EU and EEA. whenever data leaves the EU or EEA, we rely on approved safeguards such as standard contractual clauses, adequacy decisions and data-processing agreements. our hosting is located in Germany, and Amplitude uses its EU server zone.
10. your rights
you have the right to receive a copy of your data, to have it corrected or deleted, to restrict or object to its processing, to withdraw a consent, to take your data with you (portability), and to complain to a data protection authority. similar rights exist, for example, under the UK GDPR and the CCPA. to exercise them, please write to hello@holdspace.live.
if you booked sessions with a facilitator, you can also ask that facilitator directly. they can delete your personal data from their records on Holdspace: your name and email address are then removed from their records, and only anonymised payment records remain for their bookkeeping. this only affects that facilitator’s records, so your bookings with other facilitators remain as they are.
11. security
you sign in with one-time links instead of passwords, and access to data is restricted to what each role needs. we use appropriate technical and organisational safeguards, but no system can be completely secure.
12. children
Holdspace is not intended for anyone under the age of 18, and we do not knowingly collect data of minors.
13. links to other websites
pages on Holdspace may link to other websites, for example a facilitator’s own links or videos. the privacy policies of those websites apply there.
14. changes
we may update this policy from time to time. the latest version is always published on this page, together with the date of its last update.
15. contact
DRMAMU LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA · hello@holdspace.live