What we collect and why
Spacestation Labs Ltd is based in Toronto and handles personal information under Canada's PIPEDA. This page says what actually happens on this site. Last updated 7 October 2026.
The short version
We collect what you type into our forms, statistics about how people move through the site, and for some visits, which company or person is behind them. We use it to run the site and to find businesses we might work with. We do not sell any of it.
If you want your information gone, email us and it is gone. No process, no forms.
What you give us
The application form collects your name, work email, company, website, and your answers about the business. The careers form collects your Reddit handle, email, a link to a post, and the subreddits you care about. Both are stored in our own database, and applications are also copied into ClickUp, the CRM we run our pipeline from. If your answers show we could be a fit, the page then loads Paul's calendar from Cal.com with your name and email filled in, so you can book the call there.
We use all of it for one thing: deciding whether to work together, and talking to you about it. Paul reads applications himself. Nothing is passed to a third party for their own purposes.
The email box on the home page doesn't send anything anywhere. It holds your email in your browser and fills it into the application form.
The Reddit post tester takes a subreddit, a title and a body. The draft goes to an AI model running on Cloudflare, gets scored and is dropped. We do not store or log it. To count your free tests we set a cookie and keep a salted hash of your IP address for 30 days, never the address itself.
What we collect automatically
Google Analytics 4, loaded through Google Tag Manager, tells us how many people visit, which pages they read, which site or AI assistant sent them, and how far people get through the application. Your answers themselves never go to Google. Microsoft Clarity records anonymised sessions and heatmaps so we can see where a page confuses people. Google Signals and ad personalisation are switched off in Analytics.
The Reddit Pixel tells Reddit when someone lands here after seeing or clicking one of our Reddit ads, so we can tell which ads work. Reddit can also use it to decide which of our ads to show you on Reddit.
Analytics, Clarity, the Reddit Pixel and Syft (below) all use cookies.
Our host, Cloudflare, keeps short-lived server logs including IP addresses, which is ordinary infrastructure security. The forms and the post tester are protected by Cloudflare Turnstile, which checks that you are not a bot without the puzzle-solving and without tracking you across sites.
Who is visiting
We use Syft to see which companies visit the site. It matches your IP address and cookies against business data that Syft and its partners hold. Usually that gives us a company name. Sometimes it gives us a person: their name, work email, job title, LinkedIn profile, and the pages they looked at.
When Syft identifies a person, we file them in ClickUp as a possible client and may email them about working together. If you would rather not be on that list, email us and we will delete the record and leave you alone.
Cookies and your consent
Under Canadian law your consent to analytics is implied once it is disclosed, which is what this page does. So you will not see a cookie banner here. We think a banner everyone dismisses without reading is theatre, not consent.
If you are visiting from the EEA, the UK or Switzerland, your own law applies to you regardless of where we sit. Analytics storage is denied by default for those regions, so Google Analytics and Clarity fall back to cookieless measurement, and the Reddit Pixel and Syft do not load at all.
Who processes it
Cloudflare for hosting, our database, the post tester's model and bot protection. Google for Analytics, Tag Manager and our email. Microsoft for Clarity. Reddit for the pixel. Syft for identifying visiting companies. ClickUp for our CRM. Cal.com for booking calls.
None of them buys data from us, and most act only on our instructions. Reddit also uses pixel data under its own privacy policy, and Syft's matching relies on data that it and its partners hold under theirs.
Some of them store data outside Canada, mainly in the United States. Sending your details through this site means accepting that, and it also means the laws of those countries can reach that data.
How long we keep it
Applications, careers submissions and visitor records in our CRM stay for two years, because a bad fit today is often a good fit later. Analytics data expires on Google's rolling window, currently fourteen months. Clarity keeps most recordings for 30 days, and a small sample plus heatmaps for up to nine months. The post tester's IP hashes go after 30 days and its cookie after a year. Server logs are measured in days.
Ask us to delete something sooner and we will.
Keeping it safe
Form submissions sit in a database behind a login, and only the people who need them can see them. No system is perfectly secure, so if a breach ever puts you at real risk of significant harm, we will tell you and the Privacy Commissioner, as PIPEDA requires.
Children
This site is for businesses. It is not meant for anyone under 18, and we do not knowingly collect information from them.
What you can ask for
PIPEDA gives you the right to see the personal information we hold about you, to have mistakes in it corrected, and to withdraw consent. If you are in Quebec, Law 25 adds the right to have it ported to you in a portable format. In the EEA and the UK you can also object to how we use it and complain to your local data protection authority.
Email us and we will answer within thirty days. We will not ask you why.
Opting out
Google publishes a browser add-on that blocks Analytics on every site you visit. Any content blocker will stop Analytics, Clarity, the Reddit Pixel and Syft together. Or email us and we will exclude you by hand and take you out of our CRM.
Changes and contact
If this page changes in a way that matters, the date at the top changes with it. We will not quietly broaden what we collect and leave the date alone.
Paul Xue is responsible for privacy here. Questions, requests, or complaints: team@spacestationlabs.ai. If we handle it badly you can escalate to the Office of the Privacy Commissioner of Canada.