Privacy Policy
How Spacemance collects, uses, and protects your personal data.
Covers GDPR, CCPA, and Australian Privacy Act rights in plain language.
Last updated: 9 October 2026
About This Policy
This Privacy Policy explains how Spacemance collects, uses, discloses, and protects your personal information when you visit spacemance.com or buy a Spacemance product.
It is written to comply with the European Union General Data Protection Regulation (GDPR) and the United Kingdom GDPR.
It also follows the Australian Privacy Act 1988 and Australian Privacy Principles, and the California Consumer Privacy Act as amended by the CPRA.
Where local privacy laws grant you additional rights, those rights apply in addition to this policy.
Who Is the Data Controller
Spacemance is operated by Integrate Your Marketing, PO Box 902, Paddington QLD 4064, Australia.
Starbound Press is our publishing imprint.
For all privacy enquiries, including exercising the rights described below, contact us at hello@spacemance.com.
We have not appointed a Data Protection Officer because our processing does not meet the GDPR Art. 37 thresholds.
We do not carry out large scale systematic monitoring, and we do not carry out large scale processing of special category data.
EU and UK Representative
Spacemance has no establishment in the European Union or the United Kingdom.
When you buy a product, Lemon Squeezy acts as the merchant of record and is the controller for that purchase.
It carries the associated European obligations for the transaction (see "Who Receives Your Personal Information" below).
The personal data we process directly is limited to website server logs, optional analytics that you can switch off at any time, and our mailing list.
We keep our obligation to designate a representative under GDPR Art. 27 and UK GDPR Art. 27 under review, and will appoint one where it is required for the personal data we process directly.
In the meantime, you can raise any EU or UK data protection matter with us, or exercise any of the rights described below, by emailing hello@spacemance.com.
You retain the right to complain to your local supervisory authority (see "Right to Lodge a Complaint").
Personal Information We Collect
We collect the following categories of personal information, only for the purposes described in the next section:
| Category | What it includes | When we collect it |
|---|---|---|
| Order data | Name, email address, billing address, country, payment confirmation token, transaction reference | When you purchase a Spacemance product |
| Mailing list data | Email address, subscription status, and the double opt-in confirmation timestamp | When you subscribe to our mailing list and confirm by email |
| Companion signup data | Email address, which of the two Starfall leads you were matched with, your confirmation that you are 18 or over, the wording you consented to, and the double opt-in confirmation timestamp | When you sign up for the Starfall companion and confirm by email |
| Customer support data | Name, email address, content of your message | When you contact us via hello@spacemance.com or the contact form |
| Server log data | IP address, browser type and version, referring URL, pages visited, request timestamp | Automatically, when you load any page on spacemance.com |
Some order data (your name and email address) is provided to us indirectly by Lemon Squeezy, our merchant of record, after you complete a purchase (GDPR Art. 14).
We receive it so that we can deliver your book and handle support and refunds.
We never receive your card details.
We do not collect special category data (Art. 9 GDPR / sensitive information under APP 3.3) and we do not knowingly collect personal information from anyone under 16 years of age.
If you believe a child has provided personal information to us, contact hello@spacemance.com and we will delete it.
The Starfall companion is a separate case and it is stricter.
It is for adults only, you are asked to confirm that you are 18 or over before anything is sent, and the conversation stops if a reader indicates they are under 18.
How We Use Your Personal Information
For each processing activity we identify the purpose and the lawful basis we rely on under GDPR Art. 6.
| Processing activity | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Selling and delivering ebooks | Fulfil your order, send purchase confirmation, provide download access, respond to refund requests, comply with consumer law obligations | Performance of a contract (Art. 6(1)(b)); compliance with a legal obligation (Art. 6(1)(c)) for tax and consumer guarantees |
| Mailing list | Send release announcements, bonus content, and behind the scenes updates about Spacemance titles | Your consent (Art. 6(1)(a)): separate, granular, freely given |
| Starfall companion, daily message | Send you one short in character message a day from the lead you were matched with, written and reviewed in advance | Your consent (Art. 6(1)(a)): a separate tick, given at signup, withdrawable in one click from any message |
| Replying to customer support | Answer your enquiry, resolve a complaint | Performance of a contract (Art. 6(1)(b)) for customers, or our legitimate interest in responding to enquiries (Art. 6(1)(f)) for people who are not customers |
| Operating the website | Deliver pages, prevent abuse and fraud, maintain security, monitor performance | Our legitimate interest in running a functional and secure website (Art. 6(1)(f)) |
| Measuring website usage (optional) | Understand aggregate site usage so we can improve the site, using Vercel Web Analytics and Google Analytics 4 | In the EEA and the UK, your consent (Art. 6(1)(a)): neither tool stores anything on your device until you switch the Analytics category on. Outside the EEA and the UK, our legitimate interest in understanding how the site is used (Art. 6(1)(f)), balanced by an opt-out that is always one click away |
Providing order data is required to enter into a purchase contract.
Subscribing to the mailing list is entirely optional and you can decline without affecting your ability to buy our products.
Withdrawing consent for marketing emails does not affect any processing carried out before you withdrew it.
We do not engage in profiling or automated decision making within the meaning of GDPR Art. 22.
The companion scene runs entirely on your own device.
The scene at /companion/ is fixed, written fiction, shipped with the page like any other part of the site.
It is AI assisted fiction, edited line by line, exactly as our books are, and that is disclosed in the footer of every page.
Nothing is produced while you read it, so you are not interacting with an AI system and no request goes anywhere when you choose what to say.
Choosing what to say sends nothing to us and nothing to anyone else, so there is no request to log, no third party involved, and nothing for anybody to store.
The characters are fictional and are not real people.
Cookies and Similar Storage
By default this website uses only strictly necessary and functional first party storage.
We do not load advertising cookies, social plugins, cross site tracking pixels, or any advertising or profiling tools.
The only optional, nonessential processing we offer is website analytics, described below.
Where you are reading from decides how it starts.
In the European Economic Area and the United Kingdom nothing runs until you switch it on.
Everywhere else it runs on notice, and you can switch it off at any time.
Specifically:
- The fonts used on this site are self hosted from our origin server. They do not call out to Google Fonts or any other third party CDN.
- The Lemon Squeezy checkout overlay script is not loaded on the marketing pages. It runs only on the Lemon Squeezy checkout page itself, after you follow a purchase link, and Lemon Squeezy presents its own privacy notice there.
- We use two analytics tools. A banner appears on your first visit, and it tells you which of the two arrangements below applies to you.
- The first is Vercel Web Analytics. It is served first party from our own domain, sets no cookies, reads nothing from your device, and builds no cross site or cross device profile of you. Because it stores nothing on your device, we treat it as not needing your permission before it runs, so it runs for everyone except a visitor who has told us not to. It is dormant until we enable it in the Vercel dashboard.
- The second is Google Analytics 4, which we added on 6 August 2026 so we can see which pages and links readers actually use. Unlike the first tool, this one can set cookies and does send information about your visit to Google, including in the United States. It is described in full in the cookie table and the international transfers section below.
- Google Analytics also records which links on a page are clicked: the page the link goes to, the wording of the link and where on the page it sits.
- If you are in the European Economic Area or the United Kingdom, Google Analytics sets no cookie and reads nothing from your device unless you switch the "Analytics" category on. Until you do, it runs in Google's cookieless mode: Google is told that a page was viewed, with no identifier that could single you out and nothing stored on your device. Switching the category on turns on the full version, cookies included. Switching it off, or clicking Reject, stops your browser contacting Google at all.
- If you are anywhere else, including the United States, Australia and Canada, Google Analytics runs in full from your first page view. We understand the law where you are does not require your permission before this kind of analytics runs, so we rely on clear notice and an easy opt out instead. You can switch it off at any time from the banner or the Cookie preferences link in the footer, and we will stop and delete the cookies.
- We changed this on 4 September 2026. Before that date the tag was held back from every visitor in every country until they clicked Accept. That was stricter than any law required, and it left us unable to see which pages were helping readers find the book. Nobody in the European Economic Area or the United Kingdom lost a protection in this change.
- You can withdraw consent at any time using the Cookie preferences link in the footer. Withdrawing stops collection immediately and also deletes the Google Analytics cookies already on your device, so withdrawing is as effective as consenting was easy.
- We have switched off Google's advertising features. We do not use Google Analytics for advertising, remarketing, or audience building, and we do not run ads.
- Your cookie choice is stored in first party local storage on your own device so we can honour it. You can change or withdraw it at any time using the Cookie preferences link in the site footer.
Before you make a cookie choice, and in the European Economic Area and the United Kingdom until you make one, we set only strictly necessary and functional first party storage.
This means the record of your consent choice, and small cookies that remember or suggest your language and region so the site can show the right localisation.
These exist only to deliver functionality you use, and none of them track you across other sites or build an advertising profile.
We never place advertising or cross site cookies at all. Analytics cookies are placed only where the law of your country allows it without asking first, and never once you have said no.
How the Language and Region Cookies Work
In particular, the country code in sm_geo_country is derived once from your connection's network region, never from a stored IP address.
It is never combined with your name, email, or any other identifier, and it is never shared with anyone.
It exists solely so the site can offer, never force, a language that might suit you.
If you dismiss the language suggestion, that choice is remembered (in sm_lang_banner_dismissed) and the suggestion is not shown again for up to 180 days.
The complete list of first party storage this site can set is:
| Name | Purpose | Type and duration |
|---|---|---|
| spacemance_consent | Remembers your cookie choice (consent receipt) | localStorage; until you change it, or 365 days |
| spacemance_tbr | Your to-be-read shelf in the Next Read Picker: the list of books you tap "Save to TBR" on. Stored only on your device, never transmitted to us or anyone else, and clearable with the "Clear shelf" button in the tool | localStorage; until you clear it |
| spacemance_sample_progress | Where you stopped in the free sample: the chapter, how far through it you were, and when, so the sample page can offer to take you back there. The saved place stays on your device. With analytics on, tapping a Continue link is counted like any other link click, including the chapter it opens | localStorage; up to 60 days, then removed the next time the site checks it |
| sm_geo_country | Coarse country code from your connection's region, used only to suggest a language | Cookie; up to 1 year |
| sm_suggest_locale | The language we would suggest for your region (a suggestion only, never a redirect) | Cookie; up to 1 year |
| sm_locale | The language you actively chose | Cookie; up to 1 year |
| sm_lang_banner_dismissed | Remembers that you dismissed the banner suggesting a language | Cookie; up to 180 days |
| sm_mt_cache | Caches machine translated text for the current tab so pages render faster | sessionStorage; cleared when you close the tab |
| sm_companion | Remembers that this browser may open the companion scene, and which of the two characters. Set when you open the link in your welcome email. Contains a character name and a timestamp, and is signed so it cannot be edited. It holds no email address and nothing you have chosen | Cookie; up to 1 year |
| Vercel Web Analytics | Cookieless, privacy focused usage measurement | No cookie and no device storage; runs unless you switch Analytics off |
| _ga | Google Analytics: tells apart one browser from another so repeat visits are not counted as new people | Cookie; up to 2 years. In the EEA and the UK, set only if you opt in to Analytics. Elsewhere, set unless you switch Analytics off. Deleted either way if you withdraw |
| _ga_F5HGFTCCD5 | Google Analytics: keeps the state of your current visit, so a session is measured as one visit rather than many | Cookie; up to 2 years. In the EEA and the UK, set only if you opt in to Analytics. Elsewhere, set unless you switch Analytics off. Deleted either way if you withdraw |
The companion cookie is strictly necessary for a feature you have asked for and switched on yourself, so it is set without a consent prompt (ePrivacy Art. 5(3)).
It is not used for analytics, advertising or tracking of any kind.
Deleting it signs this browser out of the conversation and nothing else.
Machine translation.
When you select a language other than English, the English text on the page is sent to a third party machine translation provider so it can be translated.
That provider is currently MyMemory by Translated, and the text reaches it through our own server.
Only page content is sent, never your name, email, or any account identifier.
Because the request is made by our server rather than your browser, the provider does not receive your IP address.
English pages, and our legal pages, are never sent for translation.
Who Receives Your Personal Information
We share your personal information only with the following recipients, each bound by a written agreement governing its role.
Processors such as Vercel and Resend operate under a data processing agreement.
Lemon Squeezy operates under controller to controller terms, acting as an independent controller and merchant of record for the purchase.
| Recipient | Role | Country | What they receive | Why |
|---|---|---|---|---|
| Lemon Squeezy (Lemon Squeezy LLC) | Merchant of record and payment processor; data controller for the checkout transaction | United States | Order data | They process the purchase, charge the card, calculate and remit applicable taxes, send the receipt, and provide the download. Spacemance never receives your card number. See lemonsqueezy.com/privacy. |
| Vercel (Vercel Inc.) | Hosting and CDN provider; data processor | United States | Server log data; cookieless analytics events | Delivers the website and provides cookieless first party analytics, which you can switch off at any time. See vercel.com/legal/privacy-policy. |
| Google (Google LLC, and Google Ireland Limited for EU and UK visitors) | Website analytics; data processor | United States and Ireland | Google Analytics 4 measurement data, only if you opt in: the pages you view, the links you tap, approximate location derived from your IP address, and general device and browser information. Google Analytics 4 does not store your IP address. We have switched off Google's advertising and personalisation features, so nothing here is used for ads | Shows us which pages and links readers actually use, so we can improve the site. In the EEA and the UK, no Google cookie is set and nothing is read from your device unless you switch on the Analytics category; until then Google receives only a cookieless signal that a page was viewed, carrying no identifier. Elsewhere the full measurement runs until you switch it off. Transfers are safeguarded by the Google Ads Data Processing Terms and the European Commission's Standard Contractual Clauses. See policies.google.com/privacy and business.safety.google/adsprocessorterms. |
| Resend (Resend, Inc.) | Email delivery and mailing list storage; data processor | United States | Mailing list data and companion signup data (email address, subscription and unsubscribe status, double opt-in confirmation timestamp) | Sends the signup confirmation, the welcome email, and the release announcements you have subscribed to, and stores the subscriber list. Transfers are safeguarded under Resend's data processing agreement, which provides appropriate international transfer safeguards (see resend.com/legal). Nobody is added to the list until they click the confirmation link we email them, and every email carries a one-click unsubscribe link. See resend.com/legal/privacy-policy. |
We do not sell or rent personal information to anyone, and we do not share it with advertising networks or data brokers.
CCPA "sale" and "sharing" status: we do not sell or share personal information.
International Data Transfers
Lemon Squeezy, Vercel, Resend and Google are all based in the United States, so personal information may be transferred from your country to the United States.
For the purchase transaction, Lemon Squeezy collects your order data directly at its own checkout as an independent controller.
It is responsible for that transfer and the safeguards it relies on, which are described in its own privacy notice at lemonsqueezy.com/privacy.
Spacemance never receives your card number.
For the personal information Spacemance processes directly (Vercel server logs, and analytics where you have consented), we rely on the following transfer mechanisms under GDPR Art. 45 (adequacy) and Art. 46 (appropriate safeguards):
- Vercel: adequacy under the EU-US Data Privacy Framework (Vercel Inc. is listed at dataprivacyframework.gov).
- Google: the European Commission's Standard Contractual Clauses, incorporated by the Google Ads Data Processing Terms, with Google Ireland Limited as the contracting party for visitors in the EU and the UK. Those clauses cover both the cookieless signal sent before you choose and the full measurement sent after you opt in.
If Vercel is not certified under the Data Privacy Framework, or ceases to be, we will rely instead on the European Commission's Standard Contractual Clauses.
Those are Module 2, controller to processor, Decision 2021/914.
UK and Australian Transfers
We combine those clauses with a Transfer Impact Assessment.
UK transfers rely on the UK International Data Transfer Addendum to the SCCs.
Australian transfers rely on Australian Privacy Principle 8.1.
For the purchase, Lemon Squeezy collects and discloses your order data as controller under its own privacy notice.
For the mailing list data we disclose to Resend, we rely on the EU-US Data Privacy Framework and its UK Extension.
Resend, Inc. states in its Data Processing Addendum that it complies with both (see resend.com/legal/dpa).
If Resend is not certified, or ceases to be, we rely instead on the European Commission's Standard Contractual Clauses (Module 2, controller to processor, Decision 2021/914).
Those clauses are combined with the UK International Data Transfer Addendum and a Transfer Impact Assessment.
You may request a copy of the relevant SCCs or the equivalent transfer mechanism by emailing hello@spacemance.com.
How Long We Retain Personal Information
| Data | Retention |
|---|---|
| Order data and transaction reference | 7 years from the date of purchase, to satisfy taxation and consumer law record keeping obligations (Australian Taxation Office record keeping requirements; IRS retention guidance; ACL s51-59 consumer guarantees claim window) |
| Mailing list data | Until you unsubscribe, or 24 months of inactivity (no opens / clicks), whichever is sooner |
| Companion signup data | Until you unsubscribe, or 24 months of inactivity, whichever is sooner. Unsubscribing removes you from every list we hold, not only the character's |
| Customer support data | 24 months after the support thread is closed, then deleted unless still required for an active complaint |
| Server log data | 30 days, then automatically purged by Vercel |
Your Rights
Depending on where you live, you have some or all of the following rights in relation to your personal information.
Under GDPR (EU and UK residents), with Australian residents holding the access, correction and direct marketing opt out rights given by APP 12, APP 13 and APP 7:
- Access: ask us what personal information we hold about you and receive a copy.
- Rectification: ask us to correct inaccurate or incomplete information.
- Erasure / deletion: ask us to delete personal information that is no longer necessary, where you have withdrawn consent, or where you object and there is no overriding legitimate ground.
- Restriction: ask us to limit how we use your information while a dispute is resolved.
- Portability: receive your information in a structured, machine readable format, or have it sent directly to another controller where technically feasible.
- Object: object to processing based on our legitimate interests, including any direct marketing.
- Withdraw consent: withdraw consent for processing that relies on consent (e.g. mailing list) at any time, without affecting prior lawful processing.
- Not be subject to automated decision making: we do not carry out automated decision making, but you have this right if we ever did.
Under CCPA / CPRA (California residents):
- Right to know what personal information is collected and how it is used.
- Right to delete personal information we have collected.
- Right to correct inaccurate personal information.
- Right to opt out of the sale or sharing of personal information (we do not sell or share, but you have this right anyway).
- Right to limit the use and disclosure of sensitive personal information.
- Right not to be discriminated against for exercising any of the above rights.
To exercise any of these rights, email hello@spacemance.com from the address associated with your purchase or subscription so we can verify your identity.
We will respond within one month (GDPR), 45 days (CCPA), or such other period as the applicable law allows.
Right to Lodge a Complaint
If you believe we have not handled your personal information in accordance with this policy or applicable law, you can complain to a supervisory authority.
- EU residents: the data protection authority in the member state where you live, work, or where the alleged infringement occurred. A list is maintained at edpb.europa.eu/about-edpb/about-edpb/members_en. Spacemance has no establishment in the European Union, so the GDPR one stop shop mechanism does not apply; each EU member state authority retains competence over complaints from its residents.
- UK residents: the Information Commissioner's Office at ico.org.uk.
- Australian residents: the Office of the Australian Information Commissioner at oaic.gov.au.
- California residents: the California Privacy Protection Agency at cppa.ca.gov, or the California Attorney General.
You can also complain to us directly, including by email to hello@spacemance.com.
We will acknowledge your complaint within 30 days and respond without undue delay.
We would prefer to resolve any concern directly first, so please consider emailing hello@spacemance.com before lodging a formal complaint.
Security
We protect personal information with:
- TLS encryption in transit
- Encryption at rest, where supported by our processors
- Role based access control on internal systems
- Regular review of who has access
Lemon Squeezy states that PCI DSS compliance is built into its checkout for the payment data it handles.
Despite our efforts, no system is perfectly secure.
If we ever discover a personal data breach affecting your information, we will notify the relevant supervisory authority within 72 hours (GDPR Art. 33).
We will also notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms (Art. 34).
Children
We do not knowingly collect personal information from anyone under 16 years of age.
Spacemance titles are written for adult readers.
The Starfall companion is for adults only, 18 or over.
You are asked to confirm your age before anything is sent, the conversation stops if a reader indicates they are under 18, and it does not restart.
If we learn that a child under 16 has provided us with personal information, we will delete it as soon as we discover this.
To report such a case, email hello@spacemance.com.
Changes to This Policy
We may update this policy from time to time.
The current version is identified by the lastModified date at the top of the page.
Material changes that reduce your rights are notified by email to active mailing list subscribers.
They are also notified by a notice on this page, for at least 30 days before the change takes effect.
Contact
For privacy enquiries, including to exercise any of the rights described above, contact us at hello@spacemance.com.