Privacy Policy

Michalis Delianidis trading as STARITT, Nicosia, Cyprus, is the controller for information used to run STARITT’s own accounts, business enquiries, commercial relationships, billing administration and platform security. Contact: staritt.cy@gmail.com.

For visitor interactions and private feedback processed on a customer business’s instructions, that customer business is the controller and STARITT acts as its processor. The business associated with the experience you use determines why it collects that information and how it handles your feedback. Its own privacy notice may also apply. STARITT’s separate service-security and operational processing remains subject to STARITT’s own controller responsibilities.

For visitor requests, contact the business identified in the experience, using its own contact details or website where provided. If its contact route is unclear, email staritt.cy@gmail.com with the business name, location and touchpoint link; we can help route your request to the responsible business. Do not include unnecessary sensitive information.

Account and business information: names, email addresses, sign-in and authentication information, invitation and acceptance records, business memberships, assigned roles and locations, business contact details, website, timezone, logos and uploaded content, touchpoint/card configurations, and related administrative history. Passwords and authentication credentials are handled through our authentication service; do not send them to support.

Enquiries and communications: the public request form collects your name, business name, email, message, optional phone and business type, and whether the request came from the website or demo. We also process support correspondence, prospect business/contact information, CRM notes, follow-up status, and outreach sending history and opt-out records where relevant to a business relationship.

Visitor information: a touchpoint’s business, location and identifier, recorded NFC/QR or unknown channel, time, event or action, destination/redirect URL, action metadata, and, where recorded, browser user agent, referrer and a random session identifier. The channel comes from the link parameter and is not proof of the physical method used. Not every field is recorded on every event. A random identifier is pseudonymous, not necessarily anonymous, and events can be associated within a tab session.

Private feedback: a rating, optional comment and optional contact email, with the relevant business, location, touchpoint and submission time. A related interaction records the submission event and rating. Private means it is directed to the relevant business team rather than publicly posted; authorised STARITT staff and service providers may process it to operate and support the service. Avoid including health information, payment details or other sensitive information in comments.

AI Assistant (only on experiences where a business has switched it on): your question is processed within STARITT using deterministic matching against the latest knowledge that business has published for the scanned business, location and exact touchpoint. This mode does not send questions, conversation history or knowledge to an AI model provider or embeddings service; it quotes matching approved text rather than generating or automatically translating answers. Conversation history is not used to select answers. STARITT does not save your question or the answer in its database. To limit misuse, a pseudonymous key derived from a random browser-tab identifier, your IP address and the touchpoint is kept with a request count for up to about one day, and the business's monthly request and usage totals are counted. When the assistant cannot answer, a short topic summary of the question and its language may be kept so the business can add missing information; it is shown to that business's authorised team. These topics are removed after the business's retention period (90 days unless the business changes it) or sooner if the business deletes them. If you type personal details into a question, they may appear in that topic, so please avoid doing so. Earlier versions used an AI gateway and model provider; those providers may retain technical records from earlier processing under their own terms. Switching to knowledge matching does not delete or change those historical records.

Billing and operational information: offers, acceptance time and accepting user, and, for new offer agreements, the Terms version and fixed document reference; subscriptions, trial dates, invoices, amounts, payment status and payment-provider references, plus administrative, security, error and email-delivery records. Stripe handles full payment-card details through its payment form; STARITT does not store full card numbers or security codes in its application database. Hosting, authentication, email and payment providers may process request/network information, including IP addresses and technical logs, as part of delivering and securing their services.

For STARITT’s controller activities, we use account, enquiry and commercial information to respond to requests, set up authorised access, supply the agreed service, communicate about it and administer billing. The legal basis is performance of a contract or steps requested before a contract where the individual is a party; for a customer business’s representatives, it is our legitimate interest in managing that business relationship.

We use relevant billing and accounting information to comply with legal obligations where applicable. We use authentication, access, audit, error and anti-abuse information for our legitimate interests in securing the service, preventing misuse, resolving disputes and maintaining reliable operations, balanced against individuals’ rights. We use relevant business contact and outreach records for legitimate business communication where permitted; where consent is legally required for a communication or technology, that requirement applies separately. You can object to direct marketing at any time by contacting us, including by replying to an outreach email.

Customer businesses determine the lawful basis for their visitor analytics and feedback, such as a properly assessed legitimate interest in understanding service use and responding to feedback, or consent where required. STARITT processes this data on their instructions; this notice does not choose a basis or obtain consent on their behalf. Technical or legal requirements may require consent for some analytics/storage uses. The current experience does not offer a visitor consent-choice control for its interaction/session reporting, and this notice is not consent to that reporting.

We do not treat reading this policy, accepting service terms, submitting an enquiry or using private feedback as blanket consent or a marketing subscription. If we rely on consent for a particular activity, it must be separately obtained and can be withdrawn without affecting processing that was lawful before withdrawal.

Account details are needed to create and authenticate authorised business access. Required enquiry fields let us identify your request and reply; optional phone and business type can be left blank. If you reach the trial form from a link carrying campaign tags (for example from one of our ads), we save those tags (source, medium, campaign, content, term) and the page you first landed on with your enquiry, to understand which campaigns bring requests; this uses the link itself, not cookies or browser storage, and is not shared with advertising platforms. Billing details and payment authorisation are needed for paid services. Without necessary information, we may be unable to provide the requested access, response or payment service.

Visitors do not need a STARITT account to use a public experience. Sending private feedback is voluntary; the form uses a rating, while comment and contact email are optional. Without an email, the business may be unable to reply personally. Touchpoint and action reporting occurs when the relevant links and experience are used, independently of whether you send feedback.

Information is available to authorised people according to their role: the relevant business team for its visitor and business records, and authorised STARITT personnel for administration, support and security. Manager access is restricted to permitted locations. Operational support access and administrative changes may be logged.

We use Lovable Cloud for application hosting and service infrastructure, including its managed backend authentication, database and file storage services. Lovable’s email service handles configured transactional and authentication messages. Google Gmail, connected through Lovable, is used for business correspondence and CRM outreach. Stripe processes payments and provides payment, invoice and subscription information. The Assistant now matches knowledge within STARITT without sending questions to AI model or embeddings providers. Earlier Assistant versions used Lovable's AI gateway and OpenAI; their terms may still govern historical processing. These providers and their relevant service providers process data needed for their respective functions; their terms and privacy policies apply to their own controller activities.

We may share information with professional advisers or competent authorities where necessary for compliance, a legitimate dispute or a lawful request. We do not publish private feedback as a public review. If you choose an external review, booking, ordering, app, telephone, email or other link, you interact with that independent service. Customer-selected externally hosted images and fonts may also receive ordinary browser request data when loaded. Those third parties have their own privacy practices.

STARITT uses browser storage as well as provider technologies. On public experiences, session storage holds a random staritt_session identifier to associate interaction events within a browser tab. Another session-storage entry, staritt:lastExperience, remembers the touchpoint code, channel and time for return navigation; return logic ignores entries older than two hours. These entries normally last for the tab session, subject to the browser’s session-restoration behavior.

Signed-in account sessions are persisted and refreshed using local storage. Local storage also remembers the selected business; session storage holds authorised support context. These serve sign-in, navigation and account-operation purposes. Clearing storage can sign you out or reset selections.

The application records touchpoint openings, action clicks, review-related events, redirects and private-feedback submissions for business reporting. This is tracking even where a visitor’s name is not collected. It is not described here as anonymous or consent-gated.

Lovable’s published-site visitor analytics can also measure site usage. Lovable describes this built-in feature as using a temporary visit identifier without setting cookies or storing it in the visitor’s browser. That does not mean the whole STARITT service is cookie-free or tracking-free: STARITT’s session reporting is separate, and payment/authentication providers have their own technologies. This policy does not represent platform visitor analytics as consent-gated.

Stripe’s embedded payment form may use cookies, local storage and device/network information for payment operation and fraud prevention. Read Stripe’s Privacy Policy for its practices. Your browser settings can control cookies and storage, but blocking them may affect sign-in, navigation or payments.

We retain information for as long as it is needed for the relevant service, business instructions, support, security, billing/accounting obligations or the establishment, exercise or defence of legal claims. The appropriate period depends on the category, purpose, relationship, applicable legal requirements and provider arrangements. We do not promise one fixed period or automatic deletion of all data after service ends.

Removing a business, location or touchpoint from active use is archival, not destruction of its history. Interaction, feedback, billing, card and audit records can remain associated with archived records. An interaction marked invalid for reporting is not thereby erased.

Deleting a login ends that account’s access and removes its active memberships, but does not automatically erase associated business records. The current administrative deletion process retains a historical audit record including the former user’s name, email and business-role associations. Deletion is handled through authorised administration rather than a self-service erase-everything control.

Erasure and retention requests are reviewed against the applicable rights, legal duties and, for visitor data, the responsible business’s instructions. Where retention remains necessary, we will explain the relevant basis rather than treating archival as erasure. Providers’ operational logs, backups and payment records may follow separate retention arrangements.

Our hosting, authentication, storage, email and payment providers operate internationally, and information may be processed outside Cyprus and the European Economic Area depending on the service and provider arrangements. We do not represent all processing or hosting as EU-only. Applicable data protection law requires an appropriate lawful transfer mechanism where a restricted international transfer occurs; this notice does not certify a specific vendor region, adequacy decision, contractual safeguard or contract as applying to every provider. Contact us for information about the arrangements relevant to your request.

We use reasonable organisational and technical measures, including authentication, role/location-based access controls, controlled administrative operations and audit records. No system can guarantee complete security. Keep credentials secure, report suspected misuse, and avoid sending passwords or full payment details by email. Operational error and provider logs may contain technical information needed to investigate issues.

Subject to applicable conditions and exemptions, you can request access to your personal data, correction, erasure, restriction of processing, and portability. You may object to processing based on legitimate interests and to direct marketing. Where processing relies on consent, you can withdraw it at any time. These rights are not all absolute; for example, information may need to be retained for a legal obligation or claim.

For STARITT-controlled data, email staritt.cy@gmail.com. For customer-controlled visitor or feedback data, contact the relevant business; STARITT can help route a request using the business name, location and touchpoint link. We may ask for proportionate information to verify identity and locate the data, especially where a pseudonymous session record is not readily attributable to you. We do not ask you to email your password or full card details.

You can complain to the Cyprus Commissioner for Personal Data Protection at www.dataprotection.gov.cy, or to another competent supervisory authority. You do not have to contact us first to exercise that right.

We may update this policy to reflect service or legal changes. The effective date and version are displayed above. We will communicate material changes appropriately; publication of a policy is not consent to a new purpose or permission to apply contract changes retrospectively.

Privacy questions or requests: contact STARITT at staritt.cy@gmail.com. Include only the information needed to identify your request. For a customer experience, the relevant business remains the point of responsibility for its visitor and feedback processing.