Privacy Policy — Create The Space

Create The Space, LLC ("CTS")

2323 Broadway, Oakland, California 94612

Operating address: 3851 Market Street, Oakland, CA

App: Community Hub Spot — app.createthespace.com

Contact: team@cr8thespace.com

Effective date: April 1, 2026

Last updated: April 1, 2026

---

Who we are

Create The Space is a community platform built for wellness practitioners, community organizations, and the people who seek them out. We run a mobile and web app (Community Hub Spot) and a physical wellness space in Oakland open to Concierge-tier members. We are a California LLC. This policy explains what data we collect, how we use it, and what rights you have over it.

The short version: your data belongs to you. We collect only what we need to run your account and improve your experience. We do not sell your data. Ever.

---

What data we collect

Account data

When you create an account, we collect your name, email address, and a hashed password. We never store your password in plain text.

Profile data

You can add a bio, city and state location (we do not collect precise GPS coordinates), a profile photo, links, and — for practitioners — professional credentials. Practitioner profiles are publicly visible by design; practitioners consent to this directory visibility during onboarding.

Activity data

We record the things you do inside the app: posts, comments, saves, event check-ins, community channel joins, event RSVPs, connections, and referral activity. This data is what makes the community work — it powers your feed, the directory, and event features.

Presence data

We track a last-seen timestamp and a general activity status (online, offline, idle, active). This is used only for the in-app presence indicators other members see. You can set your status to "invisible" at any time in Settings. We do not use presence data for advertising or share it outside the app.

Payment data

Payments are processed entirely by Stripe, a PCI-DSS compliant payment processor. CTS never sees your full card number or CVV. We store only what Stripe returns to confirm a successful transaction (subscription tier, renewal date, Stripe customer ID).

Device and session data

Our servers log standard technical data: IP address, device type, and app version. This is routine infrastructure data used for security, debugging, and spam prevention. We do not build advertising profiles from it.

Still Waters data (opt-in only)

Still Waters is our in-app journey reflection feature. If you turn it on, we read a summary of your in-app activity — posts, saves, check-ins, connections — to generate a personal reflection for you. All language processing for Still Waters runs entirely on CTS-owned infrastructure. Your activity data never leaves our servers, and no outside vendor ever sees it. This feature is strictly opt-in. You can turn it on or off at any time in Settings → Privacy. Still Waters data is never sold, never shared with third parties, and does not include any health or clinical information.

---

How we use your data

To run your account and deliver the features you signed up for

To show your profile in the community directory (with your consent)

To process payments and manage your membership tier

To send you transactional emails: account confirmations, event reminders, and receipts

To generate your Still Waters reflection, if you have opted in

To monitor for abuse, fraud, and security threats

To improve the app based on aggregate usage patterns

We do not use your data to build advertising profiles. We do not sell your data to anyone.

---

Third-party services

We work with a small number of trusted providers to operate the platform:

Service	Purpose	Standard
Supabase	Database, file storage, authentication	US-based, SOC 2
Stripe	Payment processing	PCI-DSS compliant
Google / Gmail	Transactional email delivery	Standard TLS

Still Waters, our opt-in reflection feature, processes an anonymized summary of your in-app activity on CTS-owned infrastructure to generate your personal journey reflection. Your data never leaves CTS servers, and no outside vendor is involved at any step. We do not send your name, email, health data, or any clinical information through this feature, and Still Waters data is never sold or shared with advertisers.

---

Practitioner records and the trusted messenger model

CTS is not a HIPAA covered entity, and we do not market ourselves as a clinical record system. We are something different — a trusted messenger. Practitioners on the platform can keep session notes, intake forms, and care records for the people they work with, and the platform is built so the person being served always sees what their practitioner sees.

You own your record. If a practitioner writes a session note about you, you have visibility into it through the two-sided mirror. You can request a copy. You can request changes. You can request deletion at any time, and CTS will honor that request — even if the practitioner pushes back.

In-house clinical liaison. CTS retains an in-house clinician to handle record requests, sensitive disputes, and any situation where a member needs help navigating their own care record. You can reach the clinical liaison at team@cr8thespace.com with the subject line "Record request" — we will respond within 14 days.

What this means in practice:

Practitioners are independent contractors, not employees of CTS. Their clinical decisions are their own.

CTS is the secure messenger and record holder, not the provider.

Encryption at rest applies to all session notes and care records.

No advertiser, no insurer, no data broker, and no AI training pipeline ever sees your records.

You can export everything we have on you at any time. You can also delete everything.

If you ever feel a practitioner has misused the platform, contact team@cr8thespace.com. We take it seriously.

---

What we do not do

We do not sell your personal data to any third party

We do not share your data for advertising or targeting purposes

We do not share clinical records, session notes, or care data with insurers, advertisers, or data brokers

We do not use your records to train AI models

We do not collect precise GPS location — only city and state if you choose to provide it

We do not track you across other apps or websites

We do not knowingly collect data from children under 13. The platform is for users 13 and older. If we learn that a user under 13 has created an account, we will delete it.

---

Your rights

You are in control of your data.

Access: View your profile and activity data at any time inside the app.

Correction: Edit your profile information at any time.

Deletion: Email us at team@cr8thespace.com to delete your account and all associated data. We will process your request within 30 days.

Data export: Email us at team@cr8thespace.com to request a copy of your data.

Still Waters opt-out: Turn off the feature at any time in Settings → Privacy. We will stop generating your Still Waters reflection immediately.

Marketing opt-out: Every marketing email includes an unsubscribe link. Transactional emails (receipts, confirmations) cannot be turned off while your account is active.

Presence visibility: Set your status to "invisible" in Settings to hide your online presence from other members.

---

California residents — CCPA rights

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

Right to know: You can request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for which it is used, and whether it has been shared or sold (it has not been sold).

Right to delete: You can request deletion of your personal information. We will honor this request subject to any legal obligations that require us to retain certain records.

Right to opt out of sale: We do not sell personal information. There is nothing to opt out of, but we will confirm this in writing upon request.

Right to non-discrimination: Exercising your CCPA rights will not affect your access to the platform or your membership tier.

How to submit a request: Email team@cr8thespace.com with the subject line "CCPA Request." We will respond within 45 days.

---

Security

We use industry-standard encryption in transit (TLS) and at rest. Passwords are hashed before storage using a one-way algorithm — we cannot see your password, and neither can our engineers. We conduct regular security reviews and work with SOC 2-certified infrastructure partners.

No system is perfectly secure. If we become aware of a breach that affects your data, we will notify you as required by California law.

---

Data retention

We retain your data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where we are legally required to retain records (for example, payment transaction records, which Stripe retains under financial regulations).

Anonymized, aggregate usage data (e.g., "how many people attended an event") may be retained indefinitely as it cannot be linked back to you.

---

Changes to this policy

If we make material changes to this policy, we will notify you by email or via an in-app notice before the changes take effect. The "last updated" date at the top of this document will always reflect the most recent version.

---

Contact us

Questions, requests, or concerns — reach us at:

Create The Space, LLC

team@cr8thespace.com

2323 Broadway, Oakland, California 94612

We are a small team and we read every email. We will do right by you.

---

*Your data belongs to you. The space is held.*