Your workspace. Your data.
A detailed explanation of the information Rest processes, who can access it, how it is protected, and the choices available to you and your organization.
Who operates Rest and what this policy covers
Rest Workspace (also called “Rest”, “we”, or “us” in this notice) is the service name used for the virtual office at restworkspace.com. Our published privacy and service contact is santus@restworkspace.com. Rest Workspace is a service name; this notice does not identify it as an incorporated company or imply that it holds a security certification.
This policy covers our marketing website, account portal, installed progressive web app (PWA), and company offices, including invitations, profiles, presence, messages, whiteboards, attachments, audio recordings, and live media. It also covers information you send when requesting a demo or support. It does not govern an employer’s separate systems, a participant’s own recordings or exports, or third-party websites you visit.
The descriptions below reflect the application’s current design. Some storage, backup, or administration functions depend on the configuration of your workspace. A feature being available in the product does not mean your company has enabled it. Ask us to confirm the configuration and processing arrangements for your company before relying on a particular safeguard or location.
Your organization’s role and our role
Your organization decides why it uses a workspace, which people it invites, what content it shares, and how it uses member information. For that company-directed processing, it will generally act as the data controller and Rest will process workspace information to provide the service on its instructions. The actual allocation of responsibilities depends on the arrangement and applicable law.
Rest determines the processing needed for its own account administration, service security, abuse prevention, support correspondence, and business enquiries. Where applicable, Rest acts as controller for those purposes. Cloud infrastructure and communication providers also process information under their relevant terms and roles.
If you use Rest through an employer, request its workplace privacy notice, recording policy, retention settings, and any employee-monitoring policy. Your employer must establish its own lawful basis and provide required notices. This public notice is not a signed data processing agreement (DPA), transfer agreement, or service-level agreement. Contact us if your procurement process requires those documents.
Information we process
| Category | Examples and source | Purpose |
|---|---|---|
| Account and authentication | Email, account ID, profile name, authentication-factor enrollment, session identifiers, and sign-in events, supplied by you and Supabase Auth. | Verify identity, maintain sessions, apply MFA and account restrictions. |
| Company and membership | Company name, invited email, role, membership status, invitation metadata, workspace settings, and access decisions supplied by administrators. | Set up offices, approve access, separate companies, and administer the service. |
| Profile and presence | Name, optional photo, job title, bio, office and room location, avatar position, availability, connection status, and last-seen time. | Show colleagues, route collaboration, and preserve profile preferences. |
| Work-time summaries | Account-linked time segments with connection and availability status, derived from office presence. | Let the account holder and company admins review estimated presence over time. |
| Workspace content | Room chat, direct messages, whiteboard items, room layouts, uploaded files, filenames, size, type, authorship, recipient scope, and timestamps. | Deliver and retain collaboration content and apply its access rules. |
| Live media and recordings | Microphone audio, camera video, shared screen or tab content, connection metadata, and an audio recording when an authorized admin starts one. | Enable calls and screen sharing; create and share requested room recordings. |
| Technical and security data | IP address, browser/device information, approximate IP-derived location, challenge results, request metadata, error codes, counters, and audit events. | Protect sign-in, troubleshoot, issue account alerts, and monitor service usage. |
| Correspondence | Demo requests, support emails, contact details, company requirements, and information you choose to include. | Respond to requests and provide service support. |
Some information comes from your company administrator or another workspace member, rather than directly from you. Files, messages, and shared screens can contain information about customers or other people. Share only information you are entitled to disclose, and avoid unnecessary personal data.
Why information is processed
- Provide a company office, authenticate invited users, maintain sessions, and deliver communications to the appropriate company, room, or recipient.
- Save and retrieve profiles, messages, boards, layouts, files, and requested audio recordings.
- Apply company membership, employee/admin roles, revocation, session policies, and usage limits.
- Provide presence and work-time reports to the people authorized to access them.
- Detect automated abuse, limit requests, investigate faults or suspected misuse, and support recovery.
- Send transactional messages such as sign-in codes, invitations, access changes, and enabled sign-in alerts.
- Respond to enquiries, administer customer relationships, and address legal requests or disputes where necessary.
We do not sell personal information or share it for cross-context behavioral advertising. Workspace information is processed to deliver and protect the service and for the purposes described in this notice.
The current application does not include advertising profiles, cross-site marketing trackers, automated AI meeting transcription, or a feature that sends office content to a generative AI model for training. Introducing a materially different use requires updated information and any permission or legal basis that applies.
Legal bases where data protection law applies
Where laws such as the EU or UK GDPR require a lawful basis, processing must have a basis appropriate to the purpose and the person’s relationship with us. We use contractual necessity to administer and deliver a service requested by a contracting individual, legitimate interests for proportionate service security, abuse prevention, support, and business enquiries, and legal obligation where a specific duty applies. A contract with an employer does not automatically make contractual necessity the basis for processing every employee’s data.
For company-directed content, presence reporting, and recordings, your organization determines its lawful basis and instructions. If processing requires consent, the responsible party must obtain it and explain how to withdraw it. Permission granted by your browser to use a microphone or camera is a device permission, not a substitute for every legal requirement concerning a recording.
When relying on legitimate interests, the interests are maintaining a functioning, secure service, supporting users, and managing business relationships, balanced against individuals’ rights. You may object to that processing by contacting us. This notice does not assert blanket compliance with every jurisdiction or authorize processing of regulated data.
Who can see workspace information
Other members: relevant profile details, online status, room location, room conversations, shared boards, and files are visible according to membership and room rules. Direct messages and their attachments are delivered through application access checks to the intended accounts. A recipient may retain, forward, or download information.
Company administrators: admins manage membership and configuration and can access available company activity, presence/work-time reporting, and administration functions. Room controls do not create a separate end-to-end cryptographic boundary against authorized administration or platform operation.
Platform operation: technical administration, support, recovery, or authorized company exports may require access to stored content. Office backups and platform recovery exports can include direct messages. “Private message” describes its ordinary recipient access; it does not mean that Rest’s servers, authorized platform operators, or recovery tools are technically unable to access it.
Service providers: providers receive the information needed for their role, as described below. Information may also be disclosed in response to a valid legal requirement or when reasonably necessary to investigate abuse or protect people and the service, subject to applicable law.
Microphone, camera, screen sharing, and network privacy
Live media starts through the controls you use and the permissions your browser grants. You can mute your microphone, stop your camera, stop sharing, leave a room, revoke device permissions, or leave the office. Screen sharing can reveal documents, notifications, customer details, and other applications; select a single tab or window when possible.
The hosted media integration supports Cloudflare Realtime SFU and TURN. WebRTC uses DTLS-SRTP for media transport encryption. In SFU mode, encrypted media connections terminate at provider infrastructure and are forwarded to authorized participants. Rest does not currently provide participant-to-participant end-to-end encryption that excludes the SFU provider.
The application also supports a mesh mode depending on deployment configuration. TURN relays help connectivity; they do not make a participant anonymous to Rest or its providers. IP addresses and network candidates may be processed during connection establishment. Do not assume that all modes hide your IP address from other participants.
The public 3D product preview does not join a live office or request microphone/camera access. A live office and its participants are separate from that illustrative preview.
Room audio recording and participant responsibilities
Rest does not automatically record every live call. A company admin can explicitly start a room-audio recording. The room shows a recording indicator, identifies the person recording, and receives start/stop chat notices. People entering while recording is active also receive the active recording state.
The recording is made in that admin’s browser by mixing their microphone and the audio tracks the browser receives from the room. The implemented recorder creates an audio file, not a video or screen recording. The completed file is uploaded as an attachment to room chat, where members with access can retrieve it. Temporary recording buffers exist in the recording browser; a failed connection or upload can prevent saving.
The current recorder limits each recording to approximately two hours or 24 MiB, whichever limit is reached first. These are operational limits, not a promise that every session will produce a complete recording. Uploaded recordings follow the attachment expiry assigned at upload; recipient downloads are outside server retention controls.
Your organization and the person initiating a recording are responsible for advance notice, any required consent, permitted use, sharing, and deletion. An on-screen indicator alone may not satisfy local recording laws. Participants can also capture information through operating-system tools or external devices; Rest cannot prevent all such capture.
Presence, last-seen information, and work-time reporting
To operate a shared office, Rest processes avatar positions, rooms, availability, connection heartbeats, and last-seen information. The people directory can show recent presence. In managed offices, the system also derives time segments showing connected availability such as Available, Busy, and Away.
Work-time reports are accessible to the relevant account holder and authorized company admins, rather than ordinary coworkers viewing every person’s report. Presence history is retained for 30 days; work-time segments are retained for 90 days through the application’s maintenance routines.
Connection gaps, a sleeping laptop, background browser restrictions, and manually selected status can affect these figures. Reports are not a verified timesheet, payroll calculation, or measure of productivity. The feature does not capture periodic desktop screenshots or the contents of other applications. Your organization must tell employees how it uses these reports and provide any required review or objection process.
Infrastructure and communication providers
| Provider | Role and information involved |
|---|---|
| Cloudflare | Website/Worker hosting, network delivery, Turnstile security challenges, per-office Durable Objects, D1 where used, R2 files, Hyperdrive where configured, and Realtime SFU/TURN. Processes requests, technical/network data, and the workspace content required by each service. |
| Supabase | Authentication, account IDs/emails, sessions, and authentication factors. Supabase Postgres can hold company/platform records and a separately encrypted central office copy when configured. |
| Brevo | Transactional email delivery where configured: sign-in codes sent through Supabase SMTP, invitations, enabled account-security alerts, and administrative notices. Receives destination addresses, message bodies, and delivery metadata. |
| Email and support systems | Your email provider and the mailbox service used to receive support/demo correspondence process the messages sent to or from those mailboxes. |
Provider privacy notices and service descriptions are available from Cloudflare, Supabase, and Brevo. Their policies describe their own processing; they do not replace Rest’s responsibilities. Contact us for a deployment-specific provider list and contractual review before onboarding where your organization requires one.
Storage locations and international processing
Rest uses globally operated services. Website requests, media relay, technical logs, support correspondence, and email delivery may be processed in countries different from your own. A selected database region does not, by itself, constrain the location of all other processing.
This notice does not promise that every data category remains in Indonesia, Singapore, the United States, the EU, or any one country. Database configuration, Cloudflare service behavior, email routing, and the workspace’s contractual setup determine the actual processing locations.
If your organization requires a specific residency boundary or an international-transfer safeguard, ask us to identify the relevant locations, provider arrangements, and available contractual safeguards before uploading that data. This page itself does not put standard contractual clauses, an adequacy decision, a local-hosting guarantee, or a regional processing agreement in place.
Encryption and security safeguards
In transit: hosted web/API connections use HTTPS/TLS; realtime signaling uses secure WebSockets in the hosted setup. Live media uses WebRTC DTLS-SRTP. Encryption protects the connection, while server authorization decides who may access a resource.
Stored data: the relevant Cloudflare or Supabase service supplies infrastructure-level storage protection. Records are available to the authorized application for processing. This is different from encrypting every field with a key known only to the user.
Additional encryption: when enabled, the central office-record copy is encrypted in the Worker with AES-256-GCM and record-bound associated data before being stored in Postgres. Password-encrypted recovery exports use AES-256-GCM in the exporting browser with a PBKDF2-HMAC-SHA-256 derived key. Neither feature means all live data or all files use user-held keys.
Access and browser controls: server-verified sessions, company membership/role checks, room-scoped media authorization, mandatory TOTP MFA for admin actions, request limits, same-origin/CSRF checks, a nonce-based Content Security Policy, and no-store headers on private API responses are implemented. Provider credentials are held server-side. Read the Security page for the standards and limits.
No system or encryption mechanism eliminates all risk. We do not claim that Rest has undergone independent penetration testing or obtained SOC 2 or ISO 27001 assurance. Infrastructure providers’ certifications do not automatically certify this application.
Cookies, local storage, and the installed app
| Storage | Purpose and duration |
|---|---|
rest_at and rest_rt cookies | Supabase access and refresh tokens. Set with HttpOnly, Secure on hosted HTTPS, and SameSite=Lax. The refresh cookie is scoped to the authentication API. Cookie maximum age is seven days when set or renewed; token validity and server revocation are checked separately. |
| Pending sign-in state | Tab/session storage remembers the email and code-entry step for approximately ten minutes. It does not store the typed one-time code as the saved pending state. |
| Office session and preferences | Session/local storage remembers office membership session details, including an office session token, and settings such as availability or device/UI preferences. Local storage may persist until cleared or removed by the relevant leave/logout flow; it has no browser-enforced automatic expiry. |
| PWA cache | The current service worker caches public offline/brand assets. Private APIs, account content, office sessions, and media are not intentionally put into its offline cache. Cached public assets remain until replaced, removed by the app/browser, or cleared by you. |
| Cloudflare security processing | Turnstile processes browser and network signals to distinguish people from automated traffic. Provider-managed security storage, if used, follows the provider’s behavior and policy rather than Rest’s account-cookie lifetime. |
Supabase authentication tokens in HttpOnly cookies are not readable by page JavaScript. Office session data is a different credential stored in browser storage and is readable by the application; protect shared devices and untrusted browser extensions accordingly. Signing out and clearing site data can remove local state, but does not itself erase server records or previously downloaded files.
The current application does not intentionally add marketing analytics or advertising cookies. Blocking necessary cookies or security scripts can stop sign-in and collaboration from working. Installing the PWA does not create a separate data-protection or offline-storage guarantee.
Retention periods and their limits
| Category | Current application behavior |
|---|---|
| Managed-office room chat and direct messages | Default 30 days, configurable from 1 to 365 days by authorized administration. Periodic maintenance applies deletion. |
| Attachments and saved audio recordings | Expiry is calculated using the office chat-retention setting at upload. Download access is checked by the app; storage cleanup may occur later. Changing a policy does not necessarily recalculate all existing expiry timestamps. |
| Recent presence / work-time segments | 30 days / 90 days respectively, subject to scheduled maintenance. |
| Office security audit events | Default 365 days, configurable from 30 to 730 days. Separate platform and provider logs can have different retention. |
| Internal office content snapshots | Up to seven snapshots within a seven-day window, when automatic backups are enabled and succeed. These do not contain attachment file bytes. |
| Short-lived operational records | Non-chat signaling/events and mutation receipt records are generally cleaned after one day. Presence can be marked offline sooner; this does not delete its history. |
| Profiles, whiteboards, room layouts, accounts and company records | Kept while needed to operate the account/workspace and until deleted or processed through a support/administration workflow. There is no single automatic purge period for all these categories. |
| Invitations, platform audit, and support correspondence | Access validity and record deletion are separate. Some records do not currently have a universal automatic purge schedule; contact us for the relevant category and a retention/deletion request. |
| Provider backups, logs, central copies, and exported files | Depend on configured services, replication, provider retention, and who controls the exported copy. Active-record deletion does not guarantee immediate removal from every backup. |
These periods describe application settings, not a guarantee of deletion at an exact second. Maintenance, failed jobs, active support incidents, legal retention needs, and provider backup cycles can affect completion. We should retain an exception only for its relevant purpose and applicable requirement. Ask us for the settings and outstanding deletion scope for your workspace.
Leaving, account deletion, and company content
Leaving a room, closing a tab, or signing out ends or expires relevant access; it does not automatically delete the profile, messages, files, or company records you contributed. Disabling a membership removes access while preserving records required to operate the company workspace.
Account settings provide an account-deletion flow with identity confirmation and role restrictions. A company must retain an administrator, so its only admin may need to transfer responsibility first. Deleting a sign-in account and deleting all company-held content are different operations: shared messages, records, attachments, audit entries, backups, and recipient copies may need separate handling.
Contact your company admin and santus@restworkspace.com for deletion of personal data from workspace content or closure of an entire company. We may verify identity, ask which company and categories are involved, and coordinate with the organization that controls the data. We cannot erase a recipient’s independent download, a recording outside Rest, or data in another system.
Backups, exports, and recovery
Rest has internal content snapshots, integrity checks, and recovery/export functions. An office snapshot can include room configuration, chat and direct messages, boards, profiles, attachment metadata, and a synchronized platform mirror. It excludes service credentials and the actual attachment bytes stored in R2.
Internal snapshots have record/size limits and can fail. They are not a replacement for a separately verified backup of files, provider resources, and configuration. Provider recovery features and the optional encrypted central copy depend on configuration. An internal test restore does not prove successful recovery from loss of an entire cloud account.
Password-encrypted exports are generated in the browser. Keep the password separately from the file; Rest cannot recover that export password. A downloaded or manually copied export is under the recipient’s control and is not subject to automatic service deletion. No recovery-point or recovery-time guarantee is made by this policy.
Your rights, choices, and complaints
Depending on the applicable law and the processing involved, you may have rights to access your information, correct it, request erasure, restrict processing, obtain a portable copy, withdraw consent, or complain to a competent data protection authority. These rights have conditions and may be limited by another person’s rights or a legal requirement.
You may object to processing based on legitimate interests. Send an objection to santus@restworkspace.com, identifying the processing and your circumstances. If your request concerns employer-directed workspace processing, also contact your organization; it may need to decide or instruct the response.
You can edit available profile/settings, stop sharing media, revoke browser permissions, leave the office, sign out, and use available account controls. To request a copy or a correction/deletion beyond those controls, email us with your account email, company/workspace, requested action, and relevant scope. Do not send a password, one-time code, recovery secret, or unnecessary identity document.
We may request proportionate verification and will handle requests within the time required by applicable law, explaining an extension, restriction, or inability to act where required. Contact us if you are dissatisfied; you may also raise a complaint with the appropriate authority for your jurisdiction without first obtaining our permission.
Security reports and incident communications
Report suspected unauthorized access, a lost admin authenticator, an unexpected sign-in alert, or a vulnerability to santus@restworkspace.com. Include the affected workspace, approximate time/time zone, a description, and sanitized evidence. Do not publicly post tokens or other people’s messages, and do not test against another company’s data.
We can use account, request, audit, and provider records to investigate and contain an incident, including revoking access or pausing affected functionality. Where a personal-data breach triggers notification duties, we will assess and communicate with the relevant organization, individuals, or authorities as required by the applicable law and arrangement.
This contact is not a guarantee of a staffed 24/7 security operations center, immediate response, or a contractual incident-response deadline. Enterprise response commitments must be agreed separately.
Sensitive information, minors, and automated decisions
Rest is a workplace collaboration service. It is not presented as a medical-record system, payment-card vault, password manager, or a certified environment for regulated or highly sensitive records. Do not upload payment-card credentials, government identity documents, health records, or other especially sensitive material without first establishing the required safeguards and written processing arrangements.
The service is intended for adult workplace use and is not directed at children. If you believe a child’s data has been provided inappropriately, contact us so we can investigate the context and required action.
The current application uses automated security checks and access rules but does not provide AI employee scoring or automated hiring/payroll decisions. Your organization remains responsible for any decisions it makes using presence reports or exported data.
Policy changes and how to contact us
We will update this page when the service or its processing changes and show the revised date. Material changes may also require a notice in the product or a message to the relevant company/account contact. An updated page does not replace a consent, contract, or other legal step that is required for a new purpose.
For privacy requests, security questions, provider details, or company onboarding, contact Rest Workspace at santus@restworkspace.com. Ask for the legal contracting identity, correspondence address, DPA, and deployment details if your procurement or jurisdiction requires them; no unverified corporate identity, postal address, DPO appointment, or regulatory representative is asserted on this page.