Privacy Policy

Spacebackend S.a r.l. ("the Company," "we," "us," or "our") (Boulevard Grande-Duchesse Charlotte 22, 1855 Luxembourg) is the data controller for personal data processed through spacebackend.co (the "Service"). The Company provides an AI-based platform for spacecraft engineering teams. Users upload Interface Control Documents (ICDs) describing packet structures, field definitions, and interface parameters, and the Service generates flight software modules, TM/TC packet encoders, unit test suites, and requirements traceability matrices. This policy describes the personal data we process, our purposes and legal bases, and your rights under the General Data Protection Regulation (EU 2016/679) (GDPR) and applicable Luxembourg data-protection law.

1. Data Controller

The Company is the controller at Boulevard Grande-Duchesse Charlotte 22, 1855 Luxembourg. Send data-protection questions and rights requests to [email protected].

2. Personal Data

We process these categories of personal data:

• At registration or through the contact form: your name, work email address, job title, and employer organization;
• Interface Control Documents and technical specifications you upload. They may contain proprietary spacecraft subsystem design information. The Company uses them solely to generate requested software artifacts for your account;
• Generated artifacts in your account workspace, including flight modules and test suites created from uploaded documents;
• Communications, including support requests, inquiry-form submissions, and emails to the Company;
• Technical and operational data collected automatically: IP address, browser type, operating system, pages visited, and session identifiers;
• Usage and analytics data collected with your prior cookie-banner consent.

The Company does not use uploaded ICD content to train or fine-tune third-party machine-learning models, or share interface documents with other customers or organizations.

3. Purposes and Legal Bases

Purpose	Legal basis
Account registration and Service operation	Performance of contract (Art. 6(1)(b))
Processing ICD files and delivering generated artifacts	Performance of contract (Art. 6(1)(b))
Answering support requests and inquiries	Pre-contractual steps / legitimate interest (Art. 6(1)(b)/(f))
Security, fraud prevention, and service integrity	Legitimate interest (Art. 6(1)(f))
Legal compliance and record-keeping	Legal obligation (Art. 6(1)(c))
Analytics cookies and site-use measurement	Consent (ePrivacy Directive + Art. 6(1)(a))

4. Recipients and Transfers

We share personal data only with processors acting for us under Art. 28 GDPR data-processing agreements: hosting, email delivery, and self-hosted analytics. We do not sell or rent it. Where data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses (Art. 46 GDPR) and assess additional safeguards as required by the Schrems II ruling of the Court of Justice of the European Union.

5. Retention

We retain data only as long as needed for these purposes:

• Account and registration data: 3 years after account closure or last activity, for billing, legal, and contractual obligations;
• Uploaded ICD files and generated artifacts: during your active subscription and for 30 days after account closure to allow recovery, then deleted;
• Contact-form and inquiry data: 24 months after last contact;
• Server access logs: 90 days.

6. Your GDPR Rights

Under the GDPR you have the following rights:

• Right of access (Art. 15): obtain confirmation of whether we process your data and receive a copy;
• Right to rectification (Art. 16): have inaccurate data corrected;
• Right to erasure, known as the right to be forgotten (Art. 17), subject to limited legal exceptions;
• Right to restriction of processing (Art. 18);
• Right to data portability (Art. 20);
• Right to object (Art. 21), including to direct marketing at any time without further conditions;
• Right not to be subject to solely automated decision-making with legal or similarly significant effects (Art. 22). We do not engage in such automated decision-making.

To exercise any of these rights, email [email protected]. We will respond within one month of receipt, extendable by two further months for complex requests, and will notify you if an extension is required.

7. Right to Lodge a Complaint

You have the right to lodge a complaint with a national supervisory authority. In Luxembourg the competent authority is the Commission Nationale pour la Protection des Données (CNPD, cnpd.public.lu). A list of all EU/EEA supervisory authorities is available at edpb.europa.eu.

8. Cookies

See our Cookie Policy. We set non-essential cookies, including analytics and preference cookies, only with prior consent. You may accept, decline, or revisit your choice through the cookie banner.

9. Security

We use technical and organisational measures proportionate to risk, including TLS encryption in transit, restricted access controls, and regular security reviews. For spacecraft engineering documents, we take particular care with access logging and storage isolation between customer accounts.

10. Policy Changes

Material changes will appear with an updated "Last updated" date at the top of this page. Where the GDPR requires renewed consent, we will request it.

11. Contact

Spacebackend S.a r.l.
Boulevard Grande-Duchesse Charlotte 22
1855 Luxembourg
Email: [email protected]
Phone: +352 27 86 4120