1. Scope & our role
This notice applies to personal information we process when you visit our website, create a StellarReach workspace, or use the Service. It does not apply to the public marketing sites or demo sites our customers publish under their own brands.
For your account and workspace data, StellarReach is the controller. For the prospect and outreach data you load into or generate through the Service, you (our customer) are the controller and StellarReach acts as your processor, handling that data on your behalf and under your instructions. See Section 7. Where data protection laws apply to that processing, it is governed by our Data Processing Addendum (DPA).
2. Information we collect
Account & workspace information
When you create a workspace we collect your name, email address, workspace name, and a password. Passwords are stored only as a salted, memory-hard scrypt hash — we never store your password in plain text and cannot recover it. We also store the configuration you set up (scoring rules, target categories, pricing, email templates, signatures, and similar settings).
Billing information
Payments are processed by Stripe. We store your plan, subscription and usage status, and a Stripe customer reference. We do not collect or store full payment-card numbers — those are handled directly by Stripe.
Connected accounts & keys
To send email and run AI on your behalf, you may connect a Gmail account (via Google OAuth), a SendGrid account, and your own AI or Google Maps API keys. The resulting OAuth tokens and API keys are stored encrypted at rest (AES-256-GCM) and used only to operate the Service for your workspace.
Prospect & outreach data
Through the Service you collect and generate data about the businesses you prospect: business names, websites, publicly listed contact details, captured screenshots and page content, AI-generated scores and notes, the demo sites built for them, and email-engagement events (sends, opens, and clicks). You control what is collected and how it is used.
Usage, cost & technical data
We record usage and cost-metering data (for example, AI spend against your budget), plus standard technical data such as IP address, browser type, and timestamps in server logs. We use an essential session cookie to keep you logged in.
3. How we use information
We use personal information to:
- Provide, operate, secure, and improve the Service;
- Score prospect sites, build demo sites, and draft and send outreach on your behalf;
- Authenticate logins and protect against fraud and abuse;
- Process billing, meter usage, and manage your subscription;
- Provide support and respond to your requests;
- Send service and administrative messages (for example, verification, billing, and security notices);
- Comply with legal obligations and enforce our Terms of Service.
Where required by law, we rely on appropriate legal bases — performance of our contract with you, our legitimate interests in operating and securing the Service, your consent (where applicable), and compliance with legal obligations.
5. Email sending & tracking
The Service sends outreach and follow-up emails on your behalf, from your connected inbox. To help you measure engagement, those emails can include open-tracking pixels and click-tracked links. Because you decide who to contact and what to send, you are responsible for the lawfulness of your outreach — including consent, suppression, unsubscribe handling, and compliance with anti-spam and email laws (such as CAN-SPAM, CASL, and GDPR/PECR where applicable). See Section 7 and our Terms of Service.
7. Prospect data & your responsibilities
When you use StellarReach to prospect businesses, you are the controller of the personal information involved (for example, a business owner's name or email). You are responsible for having a lawful basis to collect and contact those individuals and for honoring their rights and opt-outs.
We process that data on your behalf to provide the Service, keep it within your workspace, and do not use it for our own marketing. If an individual contacts us about outreach they received, we will refer them to the customer responsible for that workspace. The terms on which we process this data as your processor are set out in our Data Processing Addendum.
8. Data retention
We retain personal information for as long as your workspace is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. When you close your workspace, we delete or anonymize associated personal information within a reasonable period, except where we must retain it (for example, billing records). You can also request deletion as described below.
9. Security
We use technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS), encryption at rest for connected API keys and OAuth tokens (AES-256-GCM), salted memory-hard password hashing (scrypt), authenticated access controls, and workspace-level data isolation. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
10. International data transfers
StellarReach is operated from the United States, and our providers may process data in the United States and other countries. Where personal information is transferred internationally, we rely on appropriate safeguards (such as Standard Contractual Clauses) where required by law.
11. Your privacy rights
Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights for data we control, email support@stellarreach.app. We will respond as required by applicable law. If your request concerns prospect data held in a customer's workspace, we will direct it to that customer as the controller.
We will not discriminate against you for exercising your privacy rights.
12. Children's privacy
The Service is a business tool intended for adults and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us and we will delete it.
13. Third-party links
The Service and our communications may link to third-party sites and services we do not control. Their privacy practices are governed by their own policies, and we are not responsible for them.
14. Changes to this notice
We may update this notice from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide additional notice. Your continued use of the Service after an update means you accept the revised notice.
15. Google user data & Limited Use
When you connect a Gmail or Google Workspace account, StellarReach requests only the access it needs to send email on your behalf:
-
https://www.googleapis.com/auth/gmail.send— to send the outreach and follow-up emails you author or approve, from your own connected inbox. We do not request read, modify, or full-mailbox access, so StellarReach cannot read your inbox or your existing messages through this connection. -
https://www.googleapis.com/auth/userinfo.email— to identify which Google account you connected and label it correctly in your workspace.
StellarReach's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through Google APIs is used only to provide and improve the email-sending features you have authorized; is not used for advertising; is not sold or transferred to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition; and is not read by humans unless we have your explicit consent, it is necessary for security purposes (such as investigating abuse) or to comply with applicable law, or the data has been aggregated and de-identified. The OAuth tokens that authorize this access are stored encrypted at rest (AES-256-GCM) and are used only to operate the Service for your workspace. You can revoke StellarReach's access at any time from your Google Account permissions page or by disconnecting the inbox in your workspace settings.
16. Contact us
Questions or requests about this notice or your personal information:
StellarReach.app LLC
Email: support@stellarreach.app
This notice is governed by the laws of the State of Texas, USA, consistent with our Terms of Service.
See also: Terms of Service · Data Processing Addendum · Home