Controller
The controller is Light Star / Starlightselect, Starlight 67676 Starlight Germany, Germany. Privacy contact: support@starlightselect.com. Visible placeholders intentionally show information that must be completed before live trading.
Categories of personal data
- Account: email, username, internal account ID, password hash, authentication and session records.
- Orders: order number, products, options, amount, tax, payment and fulfillment status, and billing address.
- Payments: provider reference, status, amount, events, refunds and disputes; never complete card numbers or CVV.
- License security: license ID, pseudonymous device/profile identifiers, activation timestamps, limits, app version and necessary security events.
- Technical and security: IP where needed for transport, rate limiting or abuse prevention, timestamps, browser/app details and error events.
- Support: messages, voluntarily provided attachments, order references and history.
- Customer files: private save files and deliveries with access controls and configured deletion.
- Credentials: only exceptionally through a designated secure handover route; never in checkout notes, ordinary contact forms or logs.
Purposes and legal bases
Data is used to perform or prepare contracts, comply with legal accounting and recordkeeping duties, pursue legitimate interests in security, abuse prevention and reliability, and rely on consent only where consent is genuinely required.
Recipients and transfers
Cloudflare is used for hosting, databases, private object storage, CDN and security. Payment and email providers receive data only after they are actually configured and needed for a transaction. The provider list is reviewed before production payments. Any processing outside the EEA will be documented with the relevant transfer mechanism once a provider is selected.
Retention and deletion
Accounts remain until deletion or necessary restriction. Order, invoice, payment and consent evidence is retained for applicable legal duties. Uploads, delivery files and exceptional credentials use separate configurable periods; credentials receive the shortest technically practical period. Account deletion does not erase records that must legally be retained.
Your rights
Depending on the circumstances, you may request access, rectification, deletion, restriction, portability and object to processing. Consent can be withdrawn for the future. You may also complain to the competent data-protection supervisory authority.