Privacy policy

1. Controller

The controller for data processing on ourlittlespace.co is Romel Estate Beteiligungs GmbH, Meinekestr. 5, 10719 Berlin, Germany, represented by its managing director Vladimir Petrov. Email: hello@ourlittlespace.co, phone: +49 176 60934222.

We have not appointed a data protection officer, as we are not legally required to. For any privacy question, contact us at the email address above.

2. What Our Little Space is

Our Little Space is a private online space for two people, opened with a keychain carrying a QR code. Couples can share messages, memories and photos there. Content is visible only to the two members of a space. We show no ads, sell no data and use no analytics or tracking tools.

3. Data we process

Account: email address, password (stored only as an encrypted hash), display name, optionally a profile photo and your chosen board colour.

Shared space: both names, optionally the date you met, messages, sealed letters, memories with caption, date and photos.

Invitation: name and email address of the invited person, entered by the member. We use them to send a single invitation email.

Technical data: when pages are opened, our hosting provider processes technically necessary data (e.g. IP address, time, browser). To prevent abuse we also store an encrypted fingerprint of IP address and browser from which the IP address cannot be recovered, and a security log of important events (e.g. activation or deletion of a space) without any content.

4. Purposes and legal bases

Providing the account and shared space, storing content and sending system emails (confirmation, password reset, invitation, deletion request): Art. 6(1)(b) GDPR (contract).

Protection against abuse, attacks and guessing links or passwords: Art. 6(1)(f) GDPR (legitimate interest in a secure service).

Data of the invited person: Art. 6(1)(f) GDPR (the member's legitimate interest in inviting their partner). Once the invitation is accepted, Art. 6(1)(b) GDPR applies.

5. Recipients and service providers

We use carefully selected processors (Art. 28 GDPR) who process data only on our instructions:

Vercel Inc. (USA) – website hosting. Data processing servers are set to London (United Kingdom). Access from the USA cannot be ruled out; it is safeguarded by the EU-US Data Privacy Framework or EU standard contractual clauses.

Supabase Pte. Ltd. (Singapore) – database, sign-in and photo storage. Location: London (United Kingdom), covered by an EU adequacy decision. Access from outside the EU (e.g. from Singapore or the USA for maintenance and support) cannot be ruled out; it is safeguarded by EU standard contractual clauses under Supabase’s Data Processing Addendum.

Plus Five Five, Inc. (Resend), USA – sending system emails via servers in Ireland (EU). Access from the USA cannot be ruled out; it is safeguarded by the EU-US Data Privacy Framework or EU standard contractual clauses.

We do not pass data to any other third parties unless required by law.

6. Retention

We keep your account and content until you delete them. You can delete individual messages, memories and photos at any time.

When a member deletes their account, their account, messages, memories, photos and profile photo are deleted immediately. The space and the other person's content remain. When the last person deletes their account, or both agree to delete the space, the whole space including all photos is deleted.

Encrypted abuse-protection fingerprints: at most 24 hours. Security log: 90 days. Unfinished sign-ups: 7 days after expiry. Invitations (name and email of the invited person): 30 days after expiry.

Data in our providers' automatic backups is overwritten as part of their regular rotation.

7. Cookies and local storage

We only use technically necessary cookies and browser storage (§ 25(2) no. 2 TDDDG). No consent is required. There are no advertising, analytics or tracking cookies.

Sign-in cookies (sb-…): keep you signed in until you sign out. ols_last_space, ols_board_theme and ols_locale: remember your space, colour and language, so that e.g. emails arrive in your language (up to 1 year). Short-lived cookies (ols_auth_…, ols_pending_…, ols_email_confirmed): for sign-in, invitations and confirmation, from a few minutes up to 24 hours. Your browser also stores locally (localStorage) your chosen language and whether date ideas are shown; this never leaves your device.

Your browser's local storage keeps your language and, if chosen during sign-up, a profile photo until the board is opened for the first time (at most 7 days).

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR).

Much of this you can do yourself: in Settings you can download your data (a copy of all messages, memories and photos) and delete your account. For anything else, write to hello@ourlittlespace.co.

You also have the right to lodge a complaint with a supervisory authority. Ours is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany.

9. Security

The connection is always encrypted (HTTPS). Photos are kept in private storage and can only be opened by the members of the space. Passwords are stored only as hashes. Sign-in attempts and link requests are limited to prevent abuse.

10. Minimum age

Our Little Space is intended for people aged 16 and over.

11. Changes

We update this policy when the service or the law changes. The version published here applies.