Privacy Policy

We collect the following categories of personal information:

• Account Information — when you register, we collect your email address and password (stored as a bcrypt hash, never in plain text).
• Business Profile — information you voluntarily provide, including your business name, category, description, menu items, questions, and Google Review link.
• Usage Data — information about how you use the Service, including QR code scans, feedback submitted, and reviews generated.
• Scan Metadata — when a customer scans your QR code, we record the scan timestamp and browser/device type (from the user-agent string) to power your analytics dashboard. We do not collect the visitor's IP address or any other personally-identifying information from your customers during a scan.
• Session Data — to keep your account secure, we record the IP address and device/browser used to sign in, associated with your login session.
• Billing Information — plan, billing interval, and payment status associated with your subscription. We do not collect or store full payment card details ourselves.
• Communications — if you contact us for support, we retain the contents of those communications.

We use the information we collect to:

• Provide, operate, and improve the Service;
• Authenticate your identity and maintain your account and login sessions;
• Generate AI-powered review suggestions based on your customers' feedback;
• Track scan, feedback, and review analytics for your dashboard;
• Send transactional emails (e.g., password resets, team invites, billing receipts);
• Respond to your enquiries and provide customer support;
• Monitor and enforce compliance with our Terms of Service;
• Detect and prevent fraud, abuse, or security threats;
• Comply with applicable legal obligations.

If you are located in the European Economic Area (EEA), we process your personal data on the following legal bases:

• Contract Performance — processing necessary to provide the Service under our Terms of Service.
• Legitimate Interests — processing for our business operations, security, and analytics, where your interests do not override ours.
• Legal Obligation — processing required by applicable law.
• Consent — where we rely on your consent, you may withdraw it at any time.

We do not sell, rent, or trade your personal information. We may share your information with:

• Service Providers — we use Supabase (Postgres database hosting), Vercel (application hosting and infrastructure), and our AI providers (OpenAI and/or the Vercel AI Gateway) to generate review suggestions. These providers process data only on our behalf.
• Payment Processors — when live billing is enabled, secure third-party payment processors will handle checkout; we share only the minimum data necessary and never see or store full card details.
• Law Enforcement — we may disclose information if required to do so by law or in response to valid legal process (e.g., court orders).
• Business Transfers — if Starloop is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is subject to a different privacy policy.

We use cookies for:

• Essential Cookies — required for authentication and session management. These cannot be disabled without breaking core Service functionality.
• Preference Cookies — used to remember your settings and preferences.

You can control cookies through your browser settings. Blocking essential cookies will prevent you from using the Service.

We retain your personal information for as long as your account is active or as needed to provide the Service. If your account is deleted, we will delete or anonymise your personal data within 30 days, except where we are required to retain it for legal, tax, or compliance purposes. Anonymised and aggregated data (e.g., scan counts) may be retained indefinitely for analytics.

We implement industry-standard security measures to protect your personal information, including:

• Encryption in transit (TLS/HTTPS);
• Encrypted storage of passwords (bcrypt);
• Application-level access controls so each account can only access its own organization's data;
• Login sessions are tracked by hashed session token, IP address, and device for fraud detection.

However, no system is 100% secure. We cannot guarantee absolute security and encourage you to use a strong, unique password.

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request that we correct inaccurate or incomplete data.
• Deletion — request that we delete your personal data ("right to be forgotten").
• Portability — request a machine-readable export of your data.
• Objection/Restriction — object to or request restriction of certain processing activities.
• Withdraw Consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at support@starloop.in. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

To request deletion of your account, contact us at support@starloop.in from your registered email address. Once verified, we will permanently erase your business profile, review history, and analytics data, and remove your account from our authentication system, within 30 days. Any active subscription will be cancelled at that time (no refund for unused periods). Deletion is irreversible — we recommend exporting any data you need beforehand.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected information from a child under 18, we will delete it promptly. If you believe we may have collected information from a child, please contact us at support@starloop.in.

Your data may be processed in countries outside your own, including in countries where data protection laws may differ. When we transfer personal data internationally, we take appropriate safeguards, such as standard contractual clauses or relying on service providers with adequate data protection certifications.

The Service may contain links to third-party websites (e.g., Google). We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or a notice in the Service. The "Effective Date" at the top of this page indicates when this policy was last updated. Your continued use of the Service after changes are posted constitutes your acceptance.

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at:

Email: support@starloop.in
Website: starloop.in