Privacy Policy

1. Who we are and what this covers

STARGA, Inc., a Delaware C Corporation ("STARGA", "we", "us"), is the controller of the personal data described in this policy. It covers the star.ga website, our communications with you, and the hosted parts of our products, including MIND and NAESTRO, where STARGA decides how personal data is used.

MIND and NAESTRO can also run entirely on your own infrastructure. When you run them there, they do not send personal data to STARGA unless you configure them to. Where STARGA processes personal data on a customer's behalf under a Separate Agreement, that agreement (including any data processing agreement) governs that processing and the customer is the controller.

2. Information we collect

Information you give us:

• your email address and the time you subscribed, if you subscribe to updates;
• your name, email, organization, role and the content of your message, when you email or call us or book a meeting;
• account details (name, work email, organization) for customer and partner accounts, which we provision;
• billing and contract details for paid services.

Information collected automatically:

• standard request data (IP address, browser and device type, pages requested, time and referrer), processed by our hosting and security provider to deliver and protect the site;
• a hash of your IP address, kept until about 10 minutes after your last sign-up attempt, to rate-limit sign-up requests;
• for hosted services: account activity, usage and diagnostic data needed to run, secure, support and bill the service.

The star.ga website shows no ads and loads no advertising or cross-site tracking scripts. It measures visits with cookieless Cloudflare Web Analytics and with Google Analytics 4, which in the EU/EEA, the UK and Switzerland runs only if you accept it (see Analytics and cookies). It stores your light or dark theme choice and your analytics choice in your browser's local storage. Apart from the Google Analytics cookies described below, it sets no cookies of its own. Our hosting and security provider may set strictly necessary security cookies to protect the site from abuse. We do not collect sensitive personal information.

3. How we use information and our legal bases

• Provide and support the services and accounts you request (performance of a contract).
• Respond to you and arrange meetings (legitimate interests, or steps before a contract).
• Send updates you subscribed to (consent, which you can withdraw at any time).
• Secure the site and services, prevent abuse and fraud, and keep them running (legitimate interests).
• Bill, keep records and meet legal obligations (contract and legal obligation).
• Improve our products using aggregated or de-identified information (legitimate interests).
• Measure how the website is used with cookieless, aggregate statistics (legitimate interests) and with Google Analytics (in the EU/EEA, the UK and Switzerland: your consent, which you can withdraw at any time; elsewhere: our legitimate interests, and you can opt out at any time).

We do not sell personal data, share it for cross-context behavioral advertising, or use it for automated decisions with legal or similarly significant effects. We do not use customer content to train models without written consent.

4. How we share information

We share personal data only with:

• service providers that host, deliver, secure and support our website, email and services (for example, our cloud hosting and content delivery provider, Cloudflare, which also provides our cookieless web analytics), under contracts that limit their use of the data;
• Google, as our processor for Google Analytics 4, when Google Analytics runs for you on star.ga (see Analytics and cookies);
• a scheduling provider, when you choose to book a meeting through it; its own privacy policy applies to what you give it;
• professional advisers, such as lawyers and accountants, under confidentiality obligations;
• authorities or other parties when required by law, or to protect the rights, safety and property of STARGA, our users or others;
• a successor in a merger, acquisition, financing or sale of assets, which may use the data only as described in this policy unless you are notified of a change.

5. Analytics and cookies

Cloudflare Web Analytics (always on). Every page loads Cloudflare Web Analytics, a measurement service of our hosting provider, Cloudflare. It sets no cookies and uses no local storage. It records page views and page-load performance (the page address, referrer, browser and device type, country and timing) and shows them to us only as aggregate statistics; it does not identify or follow individual visitors. We use it on the basis of our legitimate interest in understanding and improving the site.

Google Analytics 4. Whether it runs depends on where you are and on the choices your browser sends:

• EU/EEA, United Kingdom and Switzerland: a notice asks whether you accept analytics. Until you choose "Accept analytics", Google Analytics is not loaded at all and no request goes to Google.
• Everywhere else: Google Analytics runs by default, with advertising purposes switched off, and you can opt out at any time with the "Cookie settings" link in the footer.
• If your browser sends a Global Privacy Control signal, we treat it as an opt-out in every region: Google Analytics is not loaded and no notice is shown.
• If we cannot tell where you are, we treat you as being in the EU and ask first.

To tell which rule applies, the page asks our own server for a yes/no answer derived from the country our hosting provider, Cloudflare, already sees for your connection. Only that yes/no answer is returned to your browser; your country and IP address are not stored or logged for this purpose. When Google Analytics runs, the site sends Google, acting as our processor:

• the pages you view, the referring page, and interactions such as scrolling, outbound clicks and file downloads;
• browser, operating system, device type, screen size and language;
• approximate location (country and city) that Google derives from your IP address; Google Analytics 4 does not log or store IP addresses;
• a random identifier kept in first-party cookies (_ga and _ga_<ID>) that expire after 13 months (395 days), so repeat visits can be counted.

Advertising features stay off: ad storage, ad user data and ad personalization remain denied, Google signals is disabled, and the data is not used for advertising. Google Analytics keeps event-level and user-level data for 14 months; after that only aggregated reports remain. The legal basis is your consent in the EU/EEA, the UK and Switzerland, and our legitimate interest in understanding and improving the site elsewhere.

Changing your mind. Use the "Cookie settings" link in the footer of any page to accept or reject at any time. If you reject while Google Analytics is running, the site stops sending data to Google and deletes the Google Analytics cookies. Your choice is stored in your browser's local storage, not in a cookie; clearing your site data resets it to the default for your region.

6. How long we keep information

• Subscriber emails: until you unsubscribe or ask us to delete them.
• Rate-limit hashes: until about 10 minutes after the last sign-up attempt.
• Correspondence and meeting records: as long as needed to handle your request and our business relationship, then deleted or anonymized.
• Account, contract and billing records: for the term of the relationship and as long as required by law afterwards.
• Request logs kept by our hosting provider: under its retention schedule.
• Cloudflare Web Analytics: aggregate statistics only, kept under Cloudflare's retention schedule.
• Google Analytics (only when it runs for you): event-level and user-level data for 14 months, then aggregated reports only; its cookies expire after 13 months (395 days) or when you reject or opt out.

7. Security

We use technical and organizational measures to protect personal data, including encryption in transit, strict security headers, access controls and least-privilege access. No method of transmission or storage is completely secure. If a breach affects your personal data, we will notify you and the authorities where the law requires.

8. International transfers

STARGA is based in the United States, and our providers may process data in the United States and other countries. Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we use a lawful transfer mechanism, such as the European Commission's Standard Contractual Clauses and the UK addendum, or rely on an adequacy decision.

9. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy in a portable format;
• correct inaccurate data, or have it deleted;
• restrict or object to our processing, including processing based on legitimate interests;
• withdraw consent at any time, without affecting earlier processing;
• opt out of the sale or sharing of personal data and of targeted advertising (we do neither);
• appeal our decision on your request, and lodge a complaint with your data protection authority.

To exercise a right, email info@star.ga or call 1-877-STARGA-1. We will respond within the period the law sets (generally one month in the EEA and UK, 45 days in US states). We may need to verify your identity, and an authorized agent may act for you with proof of authority. We will not discriminate against you for exercising your rights. California residents: the categories of personal data we collect, their sources, purposes and recipients are described in sections 2 to 5; we have not sold or shared personal data in the past 12 months.

To stop receiving updates, reply "unsubscribe" to any message or email info@star.ga. Because we do not sell or share personal data, a Global Privacy Control signal has nothing to opt you out of on this site; if that changes, we will treat it as a valid opt-out request.

10. Children

Our services are for businesses and professionals and are not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy. We will post the new version here with a new effective date and, for material changes, notify subscribers and account holders by email before they take effect.

12. Contact

Privacy questions and requests: