Privacy Policy

1. Overview and Philosophy

This Privacy Policy explains how FINNOVA LTD ("we", "us", or "our") manages information in connection with the Pro Office Workspace productivity suite (including Docs, Sheets, Slides, Mail, Meet, Canvas, and Workspace Hub) and our website at ispacework.com.

Unlike cloud-first office suites that require permanent cloud storage, mandatory user accounts, and telemetry pipelines, our applications operate natively on your computer without phoning home.

2. What Information We Do NOT Collect

• Document Contents: We have zero access to the files you create, edit, open, or save in Pro Office Docs, Sheets, Slides, or Canvas. Your .docx, .xlsx, .pptx, and .pocanvas files remain on your local disk.
• Telemetry and Telemetry Analytics: Our desktop software contains no tracking SDKs, no behavioral telemetry, no usage analytics, and no advertising trackers.
• Email Contents: Pro Office Mail connects directly to your chosen email providers (such as IMAP/SMTP, Google Workspace, or Microsoft 365) via direct TLS connections. Your emails, messages, drafts, and attachments pass directly between your device and your email provider. We operate no intermediate relay or caching server for your emails.

3. Information Collected When You Use Online Services

When you explicitly use our networked services (such as Pro Office Meet or licensing verification), data is segregated and handled strictly as follows:

• Pro Office Meet (Video Meetings & Webinars):
  • Transient Signaling State (In-Memory): In-room presence, lobby status, and WebRTC signaling messages are processed in volatile memory by Cloudflare Durable Objects. This transient state is discarded when participants leave and the room terminates.
  • Media Routing: Meetings up to 6 participants connect directly peer-to-peer between client browsers. Meetings of 7+ participants and webinars route audio/video through Cloudflare's Realtime SFU infrastructure.
  • Zero Recording or Surveillance: Media streams are encrypted in transit via DTLS/SRTP. We do not record, store, transcribe, or analyze video, audio, or chat streams.
  • Optional End-to-End Encryption (E2EE): When enabled, client-side AES-GCM frame transformations encrypt all media before transmission. The 256-bit encryption key is stored strictly in the link's URL fragment (#key=...) and is never sent to our servers.
• License Verification & Service Databases (Cloudflare D1):
  • To validate access to meeting plans, our D1 database stores:
    1. Cryptographic SHA-256 hashes of license keys (original keys are never stored in the database).
    2. Assigned license plan tier (starter, pro, business, webinar) and status (active, revoked, expired).
    3. Anti-abuse failure counters (used to rate-limit brute-force attempts on the token endpoint).
• Infrastructure & Edge Logging:
  • As with any internet service routed through Cloudflare, standard HTTP connection metadata (IP addresses, request headers, Ray IDs, and timestamps) are processed at the network edge for DDoS mitigation, firewall enforcement, and uptime monitoring in accordance with Cloudflare's privacy practices.
• OAuth Authentication for Mail:
  • Direct authentication occurs exclusively between your device and Google or Microsoft. OAuth tokens are stored in your local macOS Keychain and are never visible to or stored by us.
• Commercial Licensing:
  • During pilot and pre-release phases, licenses are issued directly. For future public retail checkouts, payments will be processed by merchant-of-record partners. We do not store credit card numbers.

4. Data Storage and Security

All local application preferences, caches, and document metadata are stored in standard macOS Application Support directories (~/Library/Application Support/Pro Office */). Sensitive credentials such as email passwords and OAuth tokens are secured using the macOS Keychain.

Meeting infrastructure is hosted on Cloudflare's global edge network adhering to ISO 27001, SOC 2 Type II, and PCI DSS Level 1 standards.

5. Third-Party Disclosures

We do not sell, rent, monetize, or share your personal data with third-party data brokers or advertisers. We only engage infrastructure providers strictly necessary to deliver online functionality:

• Cloudflare, Inc.: For meeting signaling, Realtime SFU media routing, TURN relays, and edge hosting.
• Apple Inc.: For distribution and in-app transactions via the Mac App Store.

6. Compliance with Global Privacy Frameworks

Because we do not store personal document data or operate user tracking profiles, our architecture minimizes privacy risks by design under the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and the Australian Privacy Principles (APPs). You retain total custody and control of your files at all times.

7. Contact and Inquiries

If you have any questions or feedback regarding this Privacy Policy, please contact our privacy team:

FINNOVA LTD
Website: https://ispacework.com
Email: privacy@ispacework.com