Action Spaces — Privacy Notice

Updated: 6 October 2026

Who we are

Action Spaces is operated by Normtech Ltd, registered in England and Wales (company 17105378), at Castle House, Silver Street, Wethersfield, Essex, CM7 4BP. Contact us at [email protected].

ICO registration reference: ZC198640.

This notice covers our website and business AI workspace service for UK and EU users. We are the controller for account administration, customer relationships and service security. For customer workspace content, including copies used for support, we act as the customer's processor, or subprocessor where the customer acts for another controller. The customer decides why that content is processed and its lawful basis. Our Data Processing Agreement covers that processing.

Information we process

We receive information from you, your organisation and its authorised users, through authentication and invitations, and from use of the service. This includes:

• Names, email addresses, organisation membership, roles and account identifiers.
• Enquiries, support correspondence and relevant commercial records.
• Messages, documents, project context, saved agent memories and generated results supplied or created in workspaces.
• Ticket execution records, repository code and artifacts when customers authorise GitHub access.
• Temporary audio supplied for transcription, rather than a permanent voice recording library.
• Technical identifiers, usage, error and security information described below.

An administrator or colleague may provide your contact details to invite you. Providing account information is necessary to access the workspace; other content depends on what the customer chooses to supply.

Purposes and lawful bases

For information we control, our purposes and UK/EU GDPR lawful bases are:

We balance these interests against individuals' rights. A contract with your employer is not itself our contractual lawful basis for your personal data. Customer content is processed on the customer's instructions, not under an independent purpose of ours.

AI and access to content

We send the context needed for an AI task through our gateway to Baseten for inference. Separately, Voyage AI receives knowledge-base document excerpts and search queries for embeddings, and the query and candidate document text for search reranking. We do not use customer content to train models or for unrelated evaluation or product improvement, and require AI providers processing customer content to do so on a no-training basis. Staff access customer content only as necessary for service delivery and authorised support.

Do not submit special-category data, such as health, biometric identification, ethnicity or political beliefs, or criminal-offence data. AI outputs may be inaccurate; people should review outputs before making decisions affecting individuals.

We use access controls and separate customer workspaces to protect data. No service can guarantee absolute security.

Suppliers and international processing

We use DigitalOcean for hosting and storage in Frankfurt, Baseten for inference in the US, Voyage AI for knowledge-base embeddings and search reranking, Clerk for authentication and invitations, and Sentry for error reporting and performance diagnostics. Sentry is configured to remove or scrub sensitive fields; diagnostic records can still contain personal data. Umami analytics is self-hosted on DigitalOcean. See the DPA supplier list for roles and processing locations.

If signup alerts are enabled, we send a new user's name, email address and Clerk account identifier to Telegram for internal account administration. Telegram's processing may take place outside the UK or EEA.

Customer-authorised GitHub integrations exchange repository and workflow information with GitHub. The customer's arrangements with GitHub also apply. We may disclose information where legally required or necessary to establish or defend legal claims.

Frankfurt hosting does not mean all processing stays in Europe. Processing outside the UK or EEA, including in the US, requires applicable safeguards: an adequacy decision or appropriate contractual safeguards, such as EU Standard Contractual Clauses and a UK Addendum or International Data Transfer Agreement. We must put the relevant safeguards in place before a restricted transfer. Contact us for information or copies, subject to necessary confidentiality protections.

Cookies and diagnostics

We use necessary authentication cookies. Enabled Umami analytics uses cookie-free measurement of page views, browser and device information, referrers, coarse location and interaction events. Cookie-free measurement does not remove applicable privacy or tracking requirements. Sentry records errors and performance information to help us maintain the service. We do not use these systems for advertising. Contact us to exercise applicable objection rights.

Retention and deletion

Customer content is retained to provide the service. Customers can request a secure export at any time without closing their workspace. On deletion or termination, we arrange any requested return before erasure and delete live customer content within 30 days of an authorised deletion request or the agreement ending. Contact us to arrange this. Deletion is handled manually; archiving an item in the workspace is not complete erasure.

Protected backup copies expire on a separate provider cycle, which we document and agree with the customer before accepting their content. They are not used for ordinary processing, and we reapply deletions after a restore. Limited records required by law are retained only as necessary.

For account details, correspondence, security records and analytics, retention depends on the relationship, the purpose for which information is needed, security investigations and applicable legal retention periods. We review and remove information when those purposes no longer require it.

Your rights

Depending on the circumstances, you can request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Where we rely on consent, you can withdraw it without affecting earlier lawful processing. We normally respond within one month, subject to lawful extensions and identity checks.

For customer-controlled content, contact your organisation or the relevant controller; we help them respond. For our own processing, email [email protected]. You may complain to the UK Information Commissioner's Office or your EU supervisory authority.

We update this notice when our practices change and bring material changes to customers' attention.