Privacy Policy

1. Information we collect

Information you provide directly

• Business name, type, and address
• Owner name, email address, and phone number
• Google Business Profile URL
• Payment information (processed securely by Stripe — we never store card numbers)
• Software integration credentials (Square, Jobber) — stored encrypted
• SMS message templates and customizations

Information collected automatically

• Dashboard usage data (pages visited, features used)
• SMS delivery and open rates
• AI feature usage counts for plan enforcement
• Browser type, device type, and IP address
• Login timestamps and session duration

Information about your customers

When you use MyStarsAI to send review requests, we collect and process your customers' phone numbers and names solely to deliver the SMS messages you have authorized. We do not use your customers' data for any other purpose, and we do not contact them for any reason other than sending the review requests you initiate.

Google Reviews data

We use the Google Places API to retrieve publicly visible reviews of your business from Google. This data is cached in our database to display in your dashboard and is refreshed every 4 hours.

2. How we use your information

• To provide and operate the MyStarsAI platform
• To send automated SMS review requests to your customers on your behalf
• To display your Google reviews and reputation analytics in your dashboard
• To enforce plan-based usage limits (SMS count, AI response count)
• To send you weekly reputation digest emails and platform notifications
• To process payments and manage your subscription via Stripe
• To provide customer support and respond to your inquiries
• To improve our platform based on usage patterns
• To comply with legal obligations

3. How we share your information

We do not sell, rent, or trade your personal information. We share data only with the following service providers who help us operate the platform:

• Twilio — SMS delivery service. Your customers' phone numbers are transmitted to Twilio to send review request messages.
• Stripe — Payment processing. Your billing information is handled by Stripe under their own privacy policy.
• Supabase — Database hosting. All platform data is stored in Supabase's secure cloud infrastructure.
• Anthropic — AI services. Review text and business context is sent to Anthropic's Claude API to generate AI response drafts and coaching content. No customer PII is sent.
• Google — Review data retrieval via Google Places API.
• Vercel — Application hosting and serverless infrastructure.

We may also disclose your information if required by law, court order, or government authority, or to protect the rights, property, or safety of MyStarsAI, our customers, or others.

4. SMS communications and TCPA compliance

MyStarsAI sends automated transactional SMS messages to end consumers on behalf of subscribing local service businesses. By using our platform you represent and warrant that:

• You have a pre-existing business relationship with each customer you add to the system
• Your customers have provided their phone numbers in the context of their business relationship with you
• You have a legitimate business purpose for contacting each recipient

SMS Non-Sharing Statement: MyStarsAI will not sell, share, or disclose consumer mobile phone numbers or SMS consent information to any third parties or affiliates for marketing purposes. Consumer phone numbers are used solely to deliver transactional review request messages on behalf of the subscribing business.

Message details:

• Message type: Automated transactional SMS review requests after completed jobs or appointments
• Sender: Your local business via MyStarsAI platform
• Frequency: One message per completed job or appointment. No marketing messages.
• Message and data rates may apply to recipients
• To stop: Reply STOP to any message for immediate removal
• For help: Reply HELP or email hello@mystarsai.com

Every SMS sent through MyStarsAI includes "Reply STOP to opt out" and "Msg & data rates may apply" as required by the Telephone Consumer Protection Act (TCPA). Opt-out requests are processed immediately and the affected number will not receive further messages through our platform.

For complete SMS consent information visit mystarsai.com/sms-consent.

5. Data retention

• Account data is retained for the duration of your subscription plus 90 days after cancellation
• SMS logs are retained for 12 months
• Private feedback submissions are retained indefinitely unless you request deletion
• Payment records are retained for 7 years as required by tax law
• After account deletion, all personal data is permanently removed within 30 days

6. Data security

We implement industry-standard security measures to protect your data:

• All data transmitted between your browser and our servers is encrypted using TLS/SSL
• Database access is protected by Row Level Security (RLS) — each customer can only access their own data
• API keys and sensitive credentials are stored as encrypted environment variables, never in code
• Payment data is handled entirely by Stripe and never stored on our servers
• Access tokens for Square and Jobber integrations are stored encrypted in our database

7. Your rights

You have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and all associated data
• Portability: Request an export of your data in a machine-readable format
• Opt-out: Unsubscribe from marketing emails at any time via the unsubscribe link in each email

To exercise any of these rights, email us at hello@mystarsai.com with the subject "Privacy Request." We will respond within 30 days.

8. Cookies

MyStarsAI uses minimal cookies and local storage to maintain your login session and remember your dashboard preferences. We do not use third-party advertising cookies. We do not track you across other websites.

9. Children's privacy

MyStarsAI is a business-to-business service intended for adults operating businesses. We do not knowingly collect personal information from anyone under the age of 18. If you believe we have inadvertently collected such information, please contact us immediately at hello@mystarsai.com.

10. California privacy rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect, the right to delete personal information, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your CCPA rights, contact us at hello@mystarsai.com.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the effective date at the top of this page. Your continued use of MyStarsAI after changes take effect constitutes your acceptance of the revised policy.

12. Contact us