Privacy Policy

Version: 1.2

Last Updated: 2026-09-18

Effective Date: 2026-09-18

STORMVIBE Ltd., a Bulgarian limited liability company (EOOD), EIK 208809995, VAT BG208809995 ("Company," "we," "us," or "our"), operates StarBind, including our website at https://starbind.me, our mobile applications for iOS and Android, and all related services (collectively, the "Service").

This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the Service. It also describes your rights and choices regarding your data.

One-off report purchases at the StarBind Reports storefront (starbind.me/reports) are a separate, account-free product covered by the Reports Privacy Policy. This policy governs the StarBind app and your StarBind account.

This Privacy Policy is a notice, not a contract. It tells you what we process and on which legal basis (Section 3); most of that processing rests on the contract you enter under our Terms of Service, on our legitimate interests, or on legal obligations, not on your consent. Where processing does depend on your consent, such as marketing messages, we ask for it separately and you can withdraw it at any time. When you create an account we record which version of this notice was shown to you.

1. Data Controller

For the purposes of applicable data protection laws:

• Data Controller: STORMVIBE Ltd. (EIK 208809995, VAT BG208809995), 27E Srebarna Street, Bldg. 7, Entr. A, Apt. A2, Lozenets District, Sofia 1407, Bulgaria, legal@starbind.me
• EU/EEA Representative (GDPR Article 27): Not required. The Company is established in the European Union (Bulgaria) and acts as data controller from within the EU.

2. Information We Collect

2.1 Information You Provide

Birth-place autocomplete: when you type a birth place, the text you type is first matched against our own server-side place database; only if there is no match is the text, with no name, email, or other identifier attached, sent to a third-party geocoding service (Photon, operated by Komoot GmbH in Germany) to find matching places and their coordinates.

Data about other people you add: Some features let you enter another person's birth details (date, time, place), to calculate a compatibility chart, or to save someone to your circle for quick access. You provide this data and are responsible for having the right to share it (see our Terms of Service). We use it only to compute the chart you requested and store it under your account; you can delete it at any time, and deleting your account removes it. Because we typically hold only a name and birth details for these people, with no way to contact them, we rely on the disproportionate-effort exception in GDPR Art. 14(5)(b) rather than notifying each person individually. If your birth details were entered by someone else and you want them removed, contact legal@starbind.me.

2.2 Information Collected Automatically

2.3 Information from Third Parties

We may receive information from:

• App stores: Apple App Store and Google Play share purchase, subscription, and refund events for the products you buy from us.
• Push notification providers: Firebase Cloud Messaging issues a device token we use to deliver notifications you have opted into.
• Sign-in providers: if you choose Sign in with Apple or Sign in with Google, we receive a signed identity token containing your email address and a stable account identifier, used only to create and authenticate your account. We never receive your password for those accounts and do not post to them.

You can create an account either with an email address and password or with Sign in with Apple or Sign in with Google. We do not support Facebook or other social-login providers.

2.4 Information We Retain After Account Deletion

When you delete your account, we hard-delete all of the data above except for one record: a counter of how many StarBind accounts have been created from your physical device (via the device identifier in §2.2). We keep only the count, not your account or any of its contents, in a separate table that has no link back to you. We rely on this counter under GDPR Art. 6(1)(f) (legitimate interests) to limit account-creation abuse.

We also retain anonymized audit-log entries (event type, hashed email, timestamp) sufficient to demonstrate that deletion, consent, and other security-relevant events occurred (GDPR Art. 5(2) accountability). These anonymized entries are retained for 24 months from the date of the event, after which they are deleted.

3. How We Use Your Information

3.1 Purposes and Legal Bases

We use your personal information for the following purposes:

3.2 Automated Decisions and Profiling

We will never use your birth data, account information, or content you submit to make decisions based solely on automated processing that produce legal or similarly significant effects on you (GDPR Article 22). The natal-chart calculations and automatically generated readings the Service provides are entertainment content; they have no legal or contractual consequences for you.

The remarketing audiences in Section 3.1 group website visitors by two actions (viewed a report, started checkout) for 30 days so the platform can show them a StarBind ad. That is the only profiling we do, it runs only with your consent to the Advertising category, it uses no account data, no birth data and no report content, and it has no legal or similar effect on you.

4. AI and LLM Data Processing

We use third-party large language model (LLM) providers to generate personalized astrological content such as daily horoscopes, readings and chat replies. We work with two LLM providers, each under its own data processing agreement, and may route any of the content below to either of them: OpenAI (OpenAI API) and Google (Vertex AI, which hosts Google's own models and third-party models on Google's infrastructure). Which provider serves a given feature is an operational choice we can change at any time; what data each kind of content carries does not change with the provider and is described here and in the table in Section 5:

• What we send: the astrological data a feature needs (planetary positions, aspects, sign placements), plus any free text you choose to submit to an AI feature (such as chat messages or dream descriptions) and the display nicknames you set for yourself or for people in your circle, where a feature uses them (for example, compatibility readings). These requests carry no account identifiers: we do not send your email, user ID, birth date, birth location or full birth name, with one exception limited to yearly readings: to place the day your astrological year turns (your solar return) and the annual "profection" that changes on your birthday, the yearly request includes that exact birthday-derived transition date and your age at that point. This is necessary for an accurate yearly reading and is not sent for any other app feature. Stripping account identifiers does not make the request anonymous: the text you write, a nickname, or the yearly date can still be personal data, and we treat every request as such under the provider's data processing agreement.
• Purchased astrology reports are a separate product. What a report request carries, and how a draft is checked before delivery, is described in the Reports Privacy Policy, which is presented at purchase, not here.
• Where processing happens: Google Vertex AI requests are pinned to Google's EU multi-region in our code. OpenAI requests use OpenAI's global endpoint, without a regional processing restriction, and may be processed in the United States and in other countries where OpenAI and its sub-processors operate. Any transfer outside the EU is covered by the Standard Contractual Clauses in each provider's data processing addendum.
• Data retention by LLM providers: each provider processes your data to produce the response and may hold it briefly in a cache; at Google, the default cache is disabled for our project, so prompts sent there are not cached. Beyond that, how long it keeps the request depends on the service and the controls in use: where a provider's zero-retention controls are enabled for our account, inputs and outputs are not stored for abuse monitoring; otherwise the provider may keep them for a limited period (at OpenAI, up to 30 days) for security and abuse monitoring, subject to its own legal and security exceptions, as set out in its data processing agreement. Until we have confirmed zero-retention controls for a provider, you should assume its default retention applies.
• No training: our agreements with both providers prohibit them from using your data to train their models.

5. Service Providers and Other Recipients

We do not sell your personal information. The recipients below operate the Service for us or, where the Role column says so, decide for themselves how they use what they receive. The four website-tag rows (Google Analytics, Google Ads, Meta, Reddit) receive data only after you accept the matching category in the website cookie banner (Section 6); they never receive anything from the app.

Processors act only on our written instructions, under confidentiality and data protection terms. Where a recipient is a joint or independent controller (Apple and Google for payments; Google Ads, Meta and Reddit for the advertising events you consent to), its own privacy notice governs what it does with the data after receipt, and we cannot recall data already sent. The consent banner software we use (CookieConsent by Orest Bida, self-hosted under the MIT licence) runs from our own servers and sends nothing to its author; it is not a recipient. We update this list before a new recipient receives your data.

For the joint processing described above, we and Meta have agreed how to divide our responsibilities under the Meta Controller Addendum. We provide the notice, obtain the required consent and are responsible for the correct, secure integration on our site. Meta is responsible for security of its own product and for enabling access, correction, deletion, restriction and portability rights for personal data it holds after the joint processing. Each party remains responsible for the lawfulness of its own processing. You may exercise your rights against either party: contact us at legal@starbind.me, or use the contacts and rights information in Meta's Privacy Policy. We forward requests requiring Meta's action.

6. Cookies and Tracking Technologies

6.1 The App and the Website Are Different

The app (iOS and Android) stores only what it needs to run: your sign-in token, your settings and cached content, in the app's own storage. It contains no analytics or advertising SDK, sets no tracking cookies and sends its first-party telemetry (Section 2.2) under a random per-session identifier. Nothing in this Section 6 beyond that paragraph applies to the app.

The website (starbind.me, including the reports storefront at starbind.me/reports) asks before it measures. On first visit a banner offers three choices of equal weight: Accept all, Reject all, or Manage (choose per category). Nothing optional is pre-ticked. No analytics or advertising tag loads until you accept its category, and the banner never shows on its own on the pages that carry no tags at all, whatever you chose elsewhere: this site's Big Three and free chart tools, the reports Big Three page, order form, library, download, redeem and deletion pages, and the legal pages. Every page you enter birth details on is one of them.

6.2 Categories

• Necessary (always on, no consent needed under ePrivacy Directive Article 5(3) and the Bulgarian Electronic Communications Act): your cookie choice itself, sign-in and session state, your report cart and promo code, checkout recovery, the birth details you hand from the free chart widget to the order form, dismissed notes, and Cloudflare Turnstile checks on forms.
• Analytics (off until you accept): Google Analytics 4 through Google Tag Manager; our own arrival and page-view counts, per-tab link attribution (sb:attr) and per-step funnel counters (report viewed, sample opened, cart add, store button); and the marker that stops a purchase being reported to Google Analytics twice. Until you accept this category your browser sends us no measurement request of any kind; if you accept it later in the same visit, that page is counted from then on.
• Advertising (off until you accept): the Google Ads, Meta and Reddit tags; the ad-click identifier the platform added to the link you arrived on (gclid, gbraid or wbraid for Google, fbclid for Meta); and the markers that stop a purchase being reported to each platform twice. TikTok is not enabled. Accepting Advertising does not switch on Analytics, and the other way round.

The tag container itself (Google Tag Manager) loads as soon as you accept either optional category, and fires only the tags of the categories you accepted. Loading it means your browser requests the container from Google, which sees your IP address, user agent and page address in that request.

What we deliberately send to a tag is limited to: page path (without query string), surface (site or reports), language, the SKU, name, price and currency of a report you view, a checkout start, which app-store button you clicked, and after a confirmed purchase the order value, currency, gift flag and an opaque order token. Never your email or a hash of it, your name, birth data, promo code, payment, access or download identifiers, or free text.

Every vendor tag, once loaded, also processes technical request data on its own: your IP address, user agent, the page URL and referrer, its cookie or click identifiers, timestamps and your consent state. Section 5 names the vendor, its role and its transfer basis for each tag.

Before any tag or even the banner runs, our own script removes the ad-click identifier and any unlisted query parameter from the page address. If you accept Advertising in that same visit, the Google or Meta identifier is written into that vendor's own cookie (_gcl_aw or _gcl_gb, _fbc) so the platform can attribute a later purchase to its ad; otherwise it is discarded when you leave the page. Reddit and TikTok click identifiers (rdt_cid, ttclid) are always discarded: neither platform publishes a cookie format or a browser interface that would let us hand one over without putting it back in the page address.

6.3 What Is Stored on Your Device

Purchase markers sb:mk:* are valid for 90 days. Expired entries are removed on the next use with consent for their category; withdrawal clears that category's markers. No deletion code runs while the site is closed, so entries may remain until such a return visit or browser clearing.

The vendor lifetimes are the values each vendor documents; we re-verify every row in a clean browser, for each consent combination, before the tags are enabled and again whenever a tag changes. Payment for reports happens on Stripe's own checkout pages (checkout.stripe.com), where Stripe's cookie policy applies.

6.4 Your Choices and Withdrawal

"Cookie settings" in the website footer, available in the site footer (static legal pages link back to the site's preferences), reopens the preference sheet. Withdrawing a category takes effect at once: the vendors are told the category is now denied, the items listed for that category in Section 6.3 are deleted from your browser as far as this site can reach them, and if code for the withdrawn category had already loaded on the page, the page reloads so the withdrawn tags stop running. A cookie a vendor set on its own domain rather than ours is not something a script on this site can delete; it stays until your browser or that vendor drops it, and you can remove it yourself in your browser settings. Withdrawal is as easy as consent and needs no email or account.

Withdrawal stops future collection. It cannot recall data a vendor already received; what a platform keeps after receipt, including your membership of a remarketing audience until it lapses after 30 days, is governed by that platform's own terms and by the rights you can exercise with it directly. If we change the banner wording, the categories or the vendors, the banner asks you again.

You can also block or delete cookies in your browser. Deleting sb_consent means the banner asks again; deleting the other necessary items signs you out of the reports library or empties your cart.

6.5 Consent Evidence

Whenever you make, change or withdraw a choice in the banner, your browser sends our server one record: a random receipt id, the wording revision you answered, the language you saw it in, your Analytics and Advertising answers, the kind of action (first choice, change, withdrawal) and the server's time. The receipt id is stored in sb_consent so the stored preference and the evidence can be matched; a granted category is activated only after the record is saved. The record holds no IP address, user agent, page address, email, account or order, and it is deleted 13 months after it is written. Rejections and withdrawals apply immediately whether or not the record is saved.

6.6 Global Privacy Control (GPC)

If your browser sends a Global Privacy Control signal, the website treats the Advertising category as refused on every page, whatever the banner or an earlier choice says, and no advertising tag loads. You can still accept Analytics.

7. Data Retention

We keep each category of personal data only for as long as it is needed to provide the Service to you. Where a fixed period isn't meaningful, we delete data after a defined period of inactivity. Specifically:

Account deletion removes your data from our live systems immediately (see Section 11.1). Copies in our encrypted database backups age out within 7 days. Anything we must keep by law is retained for the periods in the table above.

8. Data Security

We implement industry-standard technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS/HTTPS) and at rest.
• Salted password hashing (passwords are never stored in plaintext).
• Access controls limiting employee access to personal data on a need-to-know basis.
• Regular security assessments.

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

9. Access by StarBind Staff

We strictly separate the data our staff can routinely view from content you create inside the Service.

Operational metadata: Authorised staff can view your account email, account status, subscription tier and free-credit balances, transaction history (records of purchases, spends, and refunds, without the prompt or response text of any individual feature), device identifier, the IP addresses recorded on security audit events (consent records, password changes, failed device-attestation attempts), and audit-log events. We use this access to provide support, process billing and refunds, prevent fraud, and enforce our Terms.

User-generated content: Conversations you have through the Service, dream journal entries you write, custom names and birth data you save for other people in your circle, and image-generation prompts you submit are not routinely accessible to staff. Staff review such content only when:

• it is automatically flagged by our safety systems (for example, content blocked by the provider's safety classifiers or matched against patterns we use to detect prompt injection or abuse),
• you report it to us through an in-app or written report, or
• we are required to produce it under valid legal process.

Each instance in which staff access user-generated content is logged in our audit log and is auditable.

10. International Data Transfers

Your data is primarily processed and stored on servers located in the European Union. Some recipients listed in Section 5 process specific, limited data in the United States under the safeguards described there. The website tag vendors contract with us through their EU entities (Google Ireland Ltd, Meta Platforms Ireland Ltd, Reddit Netherlands B.V.); their onward transfers to the United States rest on the safeguards named per row in Section 5, and they receive data only after your consent. If you access the Service from outside the EU, your information may be transferred to and processed in a country with different data protection laws.

For EU/EEA/UK users: Where we transfer personal data outside the EU/EEA/UK, we rely on:

• EU-US Data Privacy Framework (where the receiving organization is certified under the Framework), or
• Standard Contractual Clauses approved by the European Commission.

You may request a copy of the applicable safeguards by contacting us.

11. Your Rights

11.1 For All Users

Regardless of your location, you may:

• Access your personal data through your account settings, including a full JSON export of everything we hold about you.
• Update or correct your information through your account settings.
• Delete your account and associated data through the Service. Deletion is hard: all account data is removed in a single transaction, except as described in §2.4.

11.2 For EU/EEA/UK Users (GDPR)

Under the General Data Protection Regulation, you have the following additional rights:

• Right of access: request a copy of all personal data we hold about you.
• Right to rectification: request correction of inaccurate data.
• Right to erasure ("right to be forgotten"): request deletion of your data.
• Right to restrict processing: request that we limit how we use your data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests, including profiling.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise these rights, contact us at legal@starbind.me. We respond without undue delay and at the latest within one month of receiving your request. For complex or numerous requests we may take up to two further months; if so, we tell you within the first month and explain why (GDPR Art. 12(3)).

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local supervisory authority. Our lead supervisory authority is the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни / КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria: https://www.cpdp.bg.

11.3 For California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act and California Privacy Rights Act, you have the right to:

• Know what personal information we collect, use, and share.
• Delete your personal information.
• Opt out of the sale or sharing of your personal information. We do not sell your personal information. The website's advertising tags (Section 6) may count as "sharing" for cross-context behavioural advertising; they run only if you accept the Advertising category, and refusing or withdrawing it via "Cookie settings" in the footer, or sending a Global Privacy Control signal, opts you out.
• Non-discrimination: we will not discriminate against you for exercising your rights.

To submit a request, contact us at legal@starbind.me. We will verify your identity before processing your request.

11.4 For Residents of Other US States

If you reside in Colorado, Connecticut, Virginia, Utah, or other states with consumer privacy laws, you may have similar rights to access, delete, correct, and opt out of certain data processing. Contact us at legal@starbind.me to exercise your rights.

12. Children's Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at legal@starbind.me, and we will promptly delete such information.

13. Changes to This Privacy Policy

We update this Privacy Policy when our processing changes and publish the current version with its effective date. Where applicable law requires consent for new processing, we request that consent before the processing begins. Where applicable law requires direct notice of a change, we provide it through an appropriate channel.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: legal@starbind.me
• Address: STORMVIBE Ltd. (EIK 208809995, VAT BG208809995), 27E Srebarna Street, Bldg. 7, Entr. A, Apt. A2, Lozenets District, Sofia 1407, Bulgaria

For EU/EEA data protection inquiries: contact us at the address above. The Company is established in the European Union (Bulgaria) and an Article 27 representative is not required.

This Privacy Policy was last updated on 2026-09-18.

← Back to StarBind · Cookie settings