Reports Privacy Policy
Version: 1.0
Last Updated: 2026-07-02
Effective Date: 2026-06-06
This policy covers one-off report purchases at starbind.me/reports ("StarBind Reports"). The StarBind app is a separate product with heavier account features and its own Privacy Policy. If you use both, each policy covers its own product; your data is not merged beyond what Section 7 describes.
1. Data Controller
- Controller: STORMVIBE Ltd. (EOOD), EIK 208809995, VAT BG208809995, 27E Srebarna Street, Bldg. 7, Entr. A, Apt. A2, Lozenets District, Sofia 1407, Bulgaria — legal@starbind.me
- The Company is established in the European Union (Bulgaria); a GDPR Article 27 representative is not required.
2. What We Collect and Why
StarBind Reports is deliberately light: no account, no password, no age verification, no advertising or cross-site tracking. We collect only what a purchase needs:
| Data | When | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Email address | At checkout (collected by Stripe), gift redemption, or library sign-in | Deliver your report, operate your library, send order emails | Art. 6(1)(b) contract |
| Birth data — date, time (or "unknown"), birth place and its coordinates; for compatibility reports, the same for the second person | Order form | Compute the chart and generate the report | Art. 6(1)(b) contract |
| Full birth name (Numerology report only) | Order form or gift redemption | Derive your numerology numbers (Life Path, Expression, Soul Urge, Personality, etc.). The name is processed transiently on our server to compute these integers and is never stored, logged, or sent to any LLM provider — only the resulting numbers are saved | Art. 6(1)(b) contract |
| Report preferences — report type, language, relationship flavor or focus area | Order form | Generate the right report | Art. 6(1)(b) contract |
| Consent record — your email, IP address, the terms version you accepted, timestamp | At checkout | Prove the contract and your withdrawal-waiver consent | Art. 6(1)(c) legal obligation + Art. 6(1)(f) |
| Payment data | Stripe checkout | Payment processing — handled by Stripe; we never receive card numbers | Art. 6(1)(b) contract |
| Gift details — recipient email (optional), your name and message (optional) | Gift purchase | Deliver the voucher and show your message to the recipient | Art. 6(1)(b) contract |
| One-time sign-in codes | Library sign-in | Passwordless access to your library | Art. 6(1)(b) contract |
| Share/download access events — hashed IP (SHA-256, daily-rotating salt — original IP unrecoverable), country code, browser user-agent, referrer, timestamp | When a report download link is opened | Fraud prevention, aggregated download statistics | Art. 6(1)(f) legitimate interest |
| Anti-abuse verification (Cloudflare Turnstile) | Checkout and data-deletion forms | Block bots and abuse — Turnstile is cookieless | Art. 6(1)(f) legitimate interest |
Birth-place autocomplete: when you type a birth place, the text is first matched against our own server-side place database; only if there is no match is it sent through our server to a third-party geocoding service (Photon, operated by Komoot GmbH in Germany) to suggest matching places with coordinates. No name, email, or other identifier accompanies these queries.
Order attribution. When you arrive via a tagged link (e.g. a shared link or a campaign), we record which channel the link came from and attach it to your order. This describes the link, not you; we do not track your browsing, set analytics cookies, or store per-visitor records. Aggregate daily arrival counts per channel are kept with no personal data at all.
What we deliberately do not do: no marketing or advertising trackers, no advertising cookies, no selling of data, no profiling, and no cross-site tracking. The only analytics we use is Cloudflare Web Analytics — cookieless, aggregate page-view statistics that store nothing on your device and cannot identify you (see Section 8). The only browser storage we use is also described in Section 8.
3. AI Generation
Report text is generated by Google Gemini (Vertex AI), pinned to Google's EU multi-region data-residency endpoint (enforced in our code, not configurable), under the Google Cloud Data Processing Addendum; the generation request includes the birth data and chart data needed to write the report. Google does not use this data to train its models. Any residual transfer outside the EU is covered by the EU-US Data Privacy Framework and Standard Contractual Clauses in the Google Cloud DPA. Reports contain no generated imagery — no image-generation provider is involved.
4. Who We Share Data With
We do not sell personal data. We share data with the recipients below — processors acting on our instructions, plus Stripe, which as merchant of record is partly an independent controller:
| Recipient | Role | Data | Region / transfer |
|---|---|---|---|
| Stripe (merchant of record — see Terms of Sale §3) | Checkout and payment. For payment processing, fraud prevention, tax, and its own legal compliance, Stripe acts as the seller of record and an independent controller under its own Privacy Policy. For the order details we attach to the checkout session (including your birth data, so your report can be generated after payment), Stripe processes on our behalf until our systems consume them | Email, payment data, order details including birth data (held in the checkout session until payment completes) | Stripe Payments Europe, Ltd. (Ireland); transfers to Stripe, Inc. (US) covered by the EU-US Data Privacy Framework and SCCs under Stripe's DPA |
| Google LLC (Vertex AI / Gemini) | Report text generation | Birth/chart data and the generated report text | EU multi-region (Vertex AI data-residency endpoint, pinned in code); Google Cloud DPA with EU-US Data Privacy Framework + SCCs covering any residual transfer |
| Microsoft (Azure) | API, database, and infrastructure hosting | All stored data at rest, including birth/chart data and generated report content | European Union (EU Data Boundary) |
| Brevo (Sendinblue SA) | Email delivery — order confirmation, download links, sign-in codes, gift vouchers, deletion confirmations | Email address, message content | European Union (France) |
| Cloudflare | Website hosting/CDN, Turnstile anti-abuse, and cookieless website analytics (Cloudflare Web Analytics) | IP address and standard web request metadata; aggregate page-view and performance metrics | US with EU edge network; SCCs |
| Photon geocoder (Komoot GmbH) | Birth-place autocomplete (fallback after our server-side place cache) | The place text you type (no identifiers) | Germany (EU) — public photon.komoot.io instance; EU→EU, no third-country transfer |
5. How Long We Keep It
| Data | Retention |
|---|---|
| Report + its birth data | 24 months from purchase. The report then expires and its contents (birth data, chart data, generated text) are deleted. Download your PDF before expiry to keep it. |
| Purchase consent records | Kept as part of the order record for 10 years (Accountancy Act art. 12) — the same period as the transaction the consent evidences — to demonstrate consent (GDPR Art. 7) and defend legal claims |
| Accounting records | As required by Bulgarian tax and accounting law (typically up to 10 years) |
| One-time sign-in codes | Expire after 10 minutes; purged shortly after |
| Library sessions | Up to 24 hours (sign-in) / 60 minutes (post-checkout) |
| Payment-event records | 90 days, then deleted (Stripe retains its own records under its policy) |
| Share/download access logs | 90 days |
| Unredeemed gift vouchers | 12 months from purchase, then expire |
6. Your Rights — Including One-Click Erasure
You have the GDPR rights of access, rectification, erasure, restriction, portability, and objection. Two are built directly into the product:
- Erasure (Art. 17): use the Delete my data page. We email you a confirmation link (valid 24 hours); confirming permanently erases your purchased reports, gift vouchers you bought, sign-in codes, and your email address from our records. Retained afterwards, under legal obligation: purchase consent records and accounting entries, plus an anonymous, hash-only audit entry recording the erasure itself.
- Access/portability: your library lists everything we hold for your email; each report is downloadable as a PDF. For a structured data export beyond that, email legal@starbind.me.
For anything else: legal@starbind.me — we respond within 30 days. You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria — https://www.cpdp.bg.
7. Third Parties' Data, Gifts, and the StarBind App
- Someone else's birth data (compatibility reports, or redeeming a gift for another person's chart): the buyer confirms, when submitting it, that they are entitled to share it with us. It is used only to generate that report, is covered by the same 24-month retention, and is included in the buyer's erasure. Because we hold only the birth details for that person — no email or other contact details — we rely on the disproportionate-effort exception in GDPR Art. 14(5)(b) rather than contacting each chart subject individually. If your birth details were used in someone else's report and you want them removed, contact legal@starbind.me.
- Gift purchases involve two people: the buyer (payment, consent) and the recipient (their email and the chart's birth data at redemption). Each can erase their own data via the deletion flow.
- App crossover: report purchases may include a bonus for the StarBind app (a period of free subscription-tier access, if this feature is enabled at time of purchase) recorded against your purchase email. If you never use the app, this is never linked to anything else. If you have or later create an app account with the same email, the bonus attaches to it. The app's own Privacy Policy governs the app account.
8. Cookies and Browser Storage
StarBind Reports sets no cookies and uses no advertising or cross-site trackers. The only analytics we use is cookieless. We use:
| Item | Type | Purpose |
|---|---|---|
| Library sign-in token | localStorage (first-party) |
Keeps you signed in to your library — strictly necessary |
| One-time UI dismissal flag | localStorage (first-party) |
Remembers you dismissed an informational note |
| Cloudflare Turnstile | Embedded widget, cookieless | Anti-bot verification on forms |
| Cloudflare Web Analytics | Cookieless, no device storage | Aggregate page-view and performance statistics for the site |
The strictly necessary items above are exempt from consent under ePrivacy Directive Art. 5(3); Cloudflare Web Analytics is exempt because it is cookieless and stores nothing on your device. Payment happens on Stripe's own checkout pages (checkout.stripe.com), where Stripe's cookie policy applies. If we ever introduce non-essential cookies or analytics that require consent, we will ask first and update this policy.
9. Security
TLS for all transport; encryption at rest; access to production data restricted to authorized staff; unguessable single-purpose tokens for downloads, shares, sign-in, and erasure links; rate limiting and Turnstile on abuse-prone endpoints. No method of transmission or storage is 100% secure.
10. Children
StarBind Reports is not directed at children. Charts for minors may only be purchased by a parent or guardian. We do not knowingly process a child's data outside of birth data supplied by their parent/guardian for a report.
11. Changes
We may update this policy. Material changes will be posted on this page with a new date; the version you accepted at purchase is recorded with your order.
12. Contact
- Email: legal@starbind.me
- Address: STORMVIBE Ltd. (EIK 208809995, VAT BG208809995), 27E Srebarna Street, Bldg. 7, Entr. A, Apt. A2, Lozenets District, Sofia 1407, Bulgaria
This Reports Privacy Policy was last updated on 2026-07-02.