Privacy Policy

1. Who we are

xspaces.io ("we", "us") operates the School360 platform available at tour.xspaces.io. School360 allows schools to create and share immersive 360° virtual campus tours. This Privacy Policy explains how we collect, use, and protect personal data when you use our platform.

2. Information we collect

• Account information: email address and password when you register as a school administrator.
• School content: 360° panoramic photos, scene descriptions, and hotspot data you upload.
• Google account data (optional): if you choose to connect your Google account to publish content to Google Street View, we receive and store an OAuth refresh token scoped only to streetviewpublish. We use this token solely to publish your school's 360° photos on your behalf. We do not access any other Google data.
• Usage data: page views and tour interactions, collected in aggregate to improve the platform. We do not track individual visitor identities.
• Enquiry submissions: name, email, and message when a visitor submits an enquiry through the tour.

3. How we use your information

• To provide and maintain the School360 virtual tour service.
• To publish 360° panoramic content to Google Street View on your behalf (only when you have connected your Google account and requested a publish action).
• To forward enquiry submissions to the school's designated email address.
• To send transactional emails (e.g. account confirmation, subscription receipts).
• To improve platform features using aggregated, anonymised analytics.

4. Google user data

When you connect your Google account, xspaces.io requests access to thehttps://www.googleapis.com/auth/streetviewpublishscope only. This allows us to publish 360° photos to Google Street View on your behalf. We store only the OAuth refresh token required to perform this action. We do not sell, share, or use your Google data for any other purpose. You can revoke access at any time via your Google Account permissions page or by disconnecting from within the School360 admin dashboard.

5. Data sharing

We do not sell your personal data. We share data only with the following third-party services necessary to operate School360:

• Supabase – database and authentication hosting.
• Vercel – application hosting and content delivery.
• Google Street View Publish API – to publish 360° photos when authorised by the school administrator.
• Stripe – payment processing for subscriptions.
• Resend – transactional email delivery.

6. Data retention

We retain your account data for as long as your account is active. If you close your account, we delete your personal data within 30 days, except where retention is required by law. Google OAuth tokens are deleted immediately when you disconnect your Google account.

7. Security

We use industry-standard security practices including encrypted data storage, HTTPS transport, and row-level security on our database. OAuth tokens are never exposed to client-side code or third parties beyond the authorised API endpoints.

8. Your rights

Depending on your location, you may have the right to access, correct, or delete the personal data we hold about you. To exercise these rights, please contact us at privacy@xspaces.io.

9. Cookies

We use strictly necessary cookies to maintain your login session. We do not use advertising or tracking cookies.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered administrators by email of any material changes. The "Last updated" date at the top reflects the most recent revision.

11. Contact

Questions about this policy? Contact us at privacy@xspaces.io.