Privacy Policy

1. Scope and our role

This policy applies to Xspace websites, workspace accounts, meetings, collaboration features, and support interactions operated by Cankonix Technology.

For account, website, security, billing, and direct support data, Cankonix generally acts as a personal data controller. For customer content processed on a business customer's instructions, the customer generally acts as controller and Cankonix as processor. Roles may differ under applicable law and the actual facts.

2. Data we process

• Identity and workspace data: name, email, username, role, profile image, organization, and account status.
• Collaboration data: meeting participation, messages, reactions, files, rooms, calendar events, recordings, and related metadata.
• Device, security, and usage data: IP address, user agent, session/device details, authentication events, audit records, diagnostics, timestamps, and service metrics.
• Commercial and support data: plan, entitlement, invoice and payment-provider references, support communications, and incident records. Xspace does not intentionally store full payment-card details.

3. Purposes and lawful grounds

• Provide, secure, administer, support, and improve the service; authenticate users; prevent abuse; and maintain tenant isolation.
• Perform a contract or take requested pre-contract steps; comply with law; protect legitimate security and operational interests; and process consent where consent is the appropriate legal basis.
• Generate recordings only when initiated by an authorized host and subject to workspace policy, visible indication, participant notice, and applicable law.

4. Sources and sharing

We receive data from users, workspace administrators, invited guests, connected identity providers, devices, and configured service providers. We disclose data only as needed to operate the service, follow customer instructions, complete configured billing, meet legal duties, protect rights and safety, or complete an approved corporate transaction.

• Infrastructure, storage, realtime media, email delivery, observability, and configured payment providers may process limited data for their service function.
• Workspace administrators can access tenant data according to their permissions and policies.
• We do not sell personal data or use customer content for third-party advertising.

5. Retention and deletion

Retention depends on data type, workspace policy, contract, security needs, and law. Customers can configure certain recording, message, file, and governance periods. Legal holds may pause deletion. Backups expire according to the backup lifecycle rather than immediate deletion.

Account and audit data may be retained as needed for security, dispute handling, compliance, and financial records. Data is deleted or de-identified when no longer required, subject to technical and legal limitations.

6. Security and international processing

Xspace uses tenant scoping, role-based access, MFA, signed secure sessions, encryption in transit, private object storage, audit trails, retention controls, monitoring, backups, and incident procedures. No system is risk-free.

If data is processed outside Indonesia or transferred across borders, we will use the notices, safeguards, contractual measures, and assessments required by applicable law and the customer agreement.

7. Your choices and rights

Subject to applicable law, individuals may request information, access, correction, completion, deletion, restriction, objection, withdrawal of consent, or other available rights. Requests should be sent to info@cankonix.com and may require identity and workspace verification.

Some requests must be handled by the workspace customer as controller. We will support verified customer instructions under the DPA. Withdrawing consent does not affect processing already lawfully completed.

8. Children, changes, and contact

Xspace is a business collaboration service and is not directed to children. A customer that permits minors must establish an appropriate lawful basis, notices, permissions, and safeguards.

Material policy changes will be dated and communicated through appropriate service or account notices. Privacy questions and requests: info@cankonix.com. The final policy must include the approved controller identity and registered address.