Ir para o conteúdo
StarIn

Política de privacidade

StarIn is operated by Bosio UG (haftungsbeschränkt), Kolonnenstraße 8, 10827 Berlin, Germany, registered at Amtsgericht Berlin (Charlottenburg) under HRB 275598 B, managing director Lorenzo Bosio. We are the controller for the personal data described here. For anything to do with your data, write to finance@starin.pro.

This policy covers starin.pro and everything you do inside your account. It describes what we collect, why, on what legal basis, and who else sees it.

When the product changes, this page changes with it. What is published here is the version in force — we do not operate a delay, a version number or a separate notice, and we would rather say so than promise a process nobody runs.

Information We Collect

Grouped by what it is, rather than by the table it sits in:

  • Your account: your email address and how you sign in — a password, a magic link, or the email address and basic profile Google or LinkedIn return to us if you use one of those buttons. Your account type, and your photo if you upload one.
  • About you: name, surname, date of birth and nationality; gender, address and phone number if you choose to fill them in.
  • Your career: work history with skills and achievements, education, languages, and the behavioural profile — values and traits — if you complete it.
  • What you upload and paste: the CV you import and what we extract from it, including the field-by-field review that keeps what you kept and what you discarded; job postings you paste; the notes you write after an interview.
  • Your questionnaire answers: what you answered and the visa route they produced.
  • What you write for other Stars: your comments and replies in the Stars Academy, and your reactions to other people’s.
  • Your job search: the alerts you save, the status of each application you track, your notes on contact with an employer, your reminders, and the outcome if you tell us you were hired.
  • Your calendar, only if you connect it: the email address of the Google account, the permissions you granted, and when the connection was made, last synced and — if it happens — revoked. The credential itself is kept in a vault our own web code cannot read; the table holds a pointer to it, not the token.
  • How you use the product: which step of the funnel you reached, where you arrived from, your chosen language, and the feedback you send us, with the page and browser it came from.
  • When you buy: your IP address and the country derived from it at the moment of a purchase, and the payment method type, its issuing country and billing country, from our payment provider. No card number ever reaches us — the card is typed at the payment provider, not here.
  • If you book the mentoring call in your plan: your first and last name, your email address and the time you chose, plus anything else the booking form asks. You type these on a booking page provided by Google, not on StarIn, and Fernanda sees them in her calendar.
  • Marketing consent, if you give it: your email address, the version of the notice you agreed to, and your IP address at that moment. Art. 7(1) DSGVO requires us to be able to show we had your permission, and that is what those three things are for.

How We Collect Your Information

From you, and from what you do on the site. You type it, upload it, paste it, or click something that records it — and our payment provider tells us how a payment was made.

We do not buy data about you, and we do not build a profile of you from public sources. The job postings on the board come from public sources; those are facts about employers, not about you.

How We Use Your Information

Every purpose we have, and the legal basis for each. The full register behind this list is our Art. 30 record of processing activities.

  • Create and keep your account, and sign you in — Art. 6(1)(b), the contract. A free account is a contract too.
  • Answer the visa questionnaire and keep your result — Art. 6(1)(b).
  • Build and store your professional profile, and import your CV — Art. 6(1)(b).
  • Generate a CV, a cover letter and a job-fit analysis, and prepare you for an interview — Art. 6(1)(b).
  • Run the job board, send the alerts you asked for, and track your applications and reminders — Art. 6(1)(b). These are the service, not marketing.
  • Connect your calendar, if you turn that on — Art. 6(1)(b).
  • Arrange and hold the mentoring call, if your plan includes one — Art. 6(1)(b). See “Booking your mentoring call” below.
  • Run the Stars Academy, including comments you publish to other Stars — Art. 6(1)(b).
  • Record the outcome when you get hired — Art. 6(1)(b). Using your story to promote StarIn is separate and needs your consent, Art. 6(1)(a), which you can withdraw.
  • Sell, charge and invoice — Art. 6(1)(b) for the sale, Art. 6(1)(c) for what tax and commercial law obliges us to keep.
  • Handle a cancellation or a withdrawal — Art. 6(1)(c). The button and the form exist because German consumer law requires them, and so does the proof that we handled your request.
  • Send transactional email — sign-in links, confirmations, receipts, alerts, reminders, a weekly progress summary — Art. 6(1)(b). This is not marketing and does not depend on consent.
  • Send marketing email — Art. 6(1)(a), your consent, or § 7(3) UWG where it applies. Every message carries an unsubscribe link, and refusing changes nothing about your account.
  • Measure whether the product works and what it costs us — Art. 6(1)(f). See the section on measurement below.
  • Stop abuse and runaway cost — Art. 6(1)(f). We count requests against a hashed IP address, never a readable one, and throw the counters away after two hours.
  • Answer a request about your own data — Art. 6(1)(c).
  • Run, log and protect the service — Art. 6(1)(f).

If we ever want to use your information for something that is not on this list, we will ask you first, and use it only for what you agreed to.

Your visa questionnaire answers

When you complete the visa questionnaire we store your answers and the route they produced. If you create an account afterwards, those answers are attached to it, so you can see your result again and retake the questionnaire when your situation changes.

We also use those answers to decide what we send you. Someone whose answers point at the EU Blue Card and someone whose answers point at the Chancenkarte face different questions, and we would rather send each of them something useful than send everyone the same thing. This only affects messages you have agreed to receive, and you can stop them at any time using the unsubscribe link in any message. Stopping them does not affect your account or your saved answers.

You can delete your account at any time, which deletes your answers with it.

Comments in the Stars Academy

A comment is the one thing here you write for other people to read. Any signed-in Star can read it; nobody outside the product can. It shows your first name and the initial of your surname — never your email address — and “Star” if you have not filled in your name yet.

You can hide your own comment, which takes it and your name off the lesson. You cannot delete it yourself; our team can, and does when a comment breaks the rules of the community. Deleting your account deletes your comments and reactions with it.

When you buy something

When you start a purchase, we record your IP address, the country our hosting provider derives from it, and — once the payment is made — the payment method type, its issuing country and the billing country, as our payment provider reports them.

We collect this only when you start a purchase. We do not collect it when you browse the site.

The purpose is the tax record German law requires us to keep for the sale. We must be able to show where the buyer was, and a purchase record without it is incomplete. The legal basis is Art. 6(1)(c) GDPR, compliance with a legal obligation, read with § 22 UStG.

There are two retention periods, and which one applies depends on the sale:

  • If the purchase completes, we keep the record for ten years. We keep it even if you delete your account, because Art. 17(3)(b) GDPR says the right to erasure does not apply to data a legal obligation requires us to hold.
  • If the purchase does not complete, we delete the record within 90 days on the euro payment route. With no sale there is no tax obligation, so there is no reason to hold your address.

One honest difference: the 90-day deletion applies to the euro payment route today. On the Brazilian route we cannot yet match a purchase to its payment, so we keep those records for the same ten years. We will delete them on the same 90-day rule as soon as we can tell the two apart.

Booking your mentoring call

If your annual plan includes the 30-minute mentoring video call with Fernanda, you book it on a booking page provided by Google (Google Calendar appointment schedules), and the call itself runs on Google Meet.

Google receives what you type into that booking page: your first name, last name and email address, the time you pick, and anything else the form asks you. During the call, Google Meet processes your video, your audio and the name you join with. The confirmation email and the calendar invitation come from Google.

The purpose is to arrange and hold the call your plan includes. The legal basis is Art. 6(1)(b) GDPR, performance of our contract with you. You do not have to use the booking page: write to finance@starin.pro and we will agree a time with you by email instead.

The booking page runs on Fernanda’s own Google account, which she uses on our behalf, and we remain responsible for your booking. Google provides the page and Meet under its own terms, as a separate controller rather than as our processor, and what it does with this data on its side is described in Google’s privacy policy. Which Google company that is depends on where you are: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, if you are in the European Economic Area or Switzerland, and Google LLC, in the United States, if you are elsewhere, Brazil included.

Google also processes this data in the United States, through Google LLC. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Implementing Decision (EU) 2023/1795, Art. 45 GDPR).

The booking stays in Fernanda’s Google calendar until it is deleted. We have not set a period for that yet; when we do, it will be printed here. Deleting your StarIn account does not reach it, because it sits outside our systems: write to us and we delete it. What Google keeps on its own side follows Google’s privacy policy.

How We Share Your Information

We do not sell your personal data. We do not trade it, and we do not hand it to anyone to use for their own purposes.

What we do is narrower, and worth saying plainly: the companies that run the service for us — hosting, the database, email delivery, payments, the AI models — receive the data their part of the job needs. They act as our processors, on our instructions and under contract, and they may not use your data for anything else. This does not run on your consent and it cannot, because it is what makes the product work at all. The legal basis is Art. 6(1)(b) for the parts that are the service you asked for, and Art. 6(1)(f) for the parts that keep it running and safe. One exception is explained under “Booking your mentoring call” above: the booking page and Google Meet are provided by Google under its own terms, not as our processor.

Consent has exactly two jobs here: marketing email, and permission to tell the story of your hire. You give each separately and can withdraw either at any time. Nothing else on this page depends on it.

Beyond those processors, your information may be disclosed (1) to comply with applicable laws, regulations, court orders, or other legal processes; (2) to enforce agreements, including this Privacy Policy; or (3) to address claims that your use of the Service infringes upon third-party rights. In the event of a merger or acquisition involving the Service or our company, your information would be among the assets transferred to the new owner.

Who else processes your data

To run this service we use other companies as our processors: they store, transmit or compute your data on our instructions, for the purposes described above, and for nothing of their own. We name every one of them below, with the legal entity behind it, what it receives from us and whether your data stays inside the EU.

This list is not written by hand on this page. It is generated from the internal map we keep of every place personal data leaves our systems (the same map our engineering gates check the code against), and the wording of each entry is that map’s own wording — including where it records that we have not verified something. A page that re-writes the map in more comfortable words is a page that can drift away from it.

  • Supabase — Supabase, Inc. We have not verified which contracting entity covers our account, the US company or its EU subsidiary. What it receives: Everything you give us: your profile, your CV, your applications, your questionnaire answers and your login. Where it processes: Frankfurt, Germany. Both of our databases sit there, the live one and the one we test on. Processes your data inside the EU.
  • Vercel (hosting/execution) — Vercel Inc., United States. We have not verified whether an EU subsidiary or a specific set of standard contractual clauses covers our account. What it receives: Any personal data passing through while a page or a form submission runs. Vercel keeps none of it. Storage is the database's job. Where it processes: Frankfurt, Germany (fra1). Processes your data inside the EU.
  • Vercel (execution logs) — Vercel Inc., United States. The same company as the line above, listed separately because a log is a different thing from a running function: it is kept, and it can be read later. What it receives: Diagnostic messages our software writes while it runs. Risky fields we know about, such as an email address, a name or a token, are masked before the message is written. Where it processes: The United States, inferred from where our functions run. Vercel documents no separate region for logs. We have not confirmed where this one processes your data, and we make no claim that it is inside the EU.
  • Azure (our database, login and file services) — Microsoft Ireland Operations Ltd., Ireland. We have not verified which set of standard contractual clauses covers our account. The database, login and file services are software we run ourselves on our own Azure account; Microsoft supplies the infrastructure. What it receives: Everything you give us except the files themselves: your profile, your applications, your questionnaire answers and your login. The file service runs here too, and the files it stores sit at Cloudflare R2, listed below. For a short time after the move the same data is also still held at the company listed as Supabase. Where it processes: Sweden Central, Sweden, inside the EU. The live database, the login service and the file service all run there. Processes your data inside the EU.
  • Azure Container Apps (hosting/execution) — Microsoft Ireland Operations Ltd., Ireland. The same company as the line above, listed separately because this is the part that runs a page or a form submission. What it receives: Any personal data passing through while a page or a form submission runs. The site keeps none of it. Storage is the database's job. Where it processes: Sweden Central, Sweden, inside the EU. Processes your data inside the EU.
  • Azure Front Door (the edge in front of the site) — Microsoft Ireland Operations Ltd., Ireland. The same company as the lines above. What it receives: Every request to our site, on its way to our servers: your IP address and whatever the page or form request carries. Where it processes: We have not confirmed where the edge that first receives your request runs. Azure Front Door is a global edge network, and we make no claim that it is inside the EU. We have not confirmed where this one processes your data, and we make no claim that it is inside the EU.
  • Azure Monitor logs (execution logs) — Microsoft Ireland Operations Ltd., Ireland. The same company as the lines above, listed separately because a log is a different thing from a running function: it is kept, and it can be read later. What it receives: Diagnostic messages our software writes while it runs. Risky fields we know about, such as an email address, a name or a token, are masked before the message is written. Where it processes: Sweden Central, Sweden, inside the EU. The log workspace sits in the same region as the site. Processes your data inside the EU.
  • Stripe — Stripe. We have not verified which contracting entity covers our account, Stripe, Inc. or Stripe Payments Europe, Ltd. What it receives: Your payment details, plus the least we need to charge you: your email address, your name and the amount. Where it processes: The United States. Stripe processes payments outside the EU and we know of no EU residency option for it. We accept that, because taking payment is what it does and we have no EU alternative that does it. Processes your data outside the EU. This is a permanent exception: we accepted that this one stays outside the EU because we have no way to run the service without it, and we say so here rather than in a footnote.
  • Anthropic (the AI in the product) — Anthropic PBC, United States. What it receives: Nothing today. No feature calls this provider, so nothing from you is sent to it. It would receive what the other AI lines here receive (your profile, your CV, the job ad you paste in, and the text we write for you from them) only if we explicitly switched it on. Where it processes: The United States. If we switched it on, we would call the company interface directly, under a data processing agreement that carries standard contractual clauses. Processes outside the EU. Whatever this provider receives from us leaves the EU, and we are working to end that.
  • OpenAI (the AI in the product) — OpenAI, L.L.C., United States. What it receives: Nothing today. No feature calls this provider, so nothing from you is sent to it. It would receive what the other AI lines here receive (your profile, your CV, the job ad you paste in, and the text we write for you from them) only if we explicitly switched it on. Where it processes: The United States. If we switched it on, we would call the company interface directly, under a data processing agreement that carries standard contractual clauses. Processes outside the EU. Whatever this provider receives from us leaves the EU, and we are working to end that.
  • LangWatch (AI usage telemetry) — Bosio UG itself. It is our own copy of the open-source LangWatch software, running on our own Google Cloud machine; no analytics company receives it. What it receives: Which AI tool ran, which model answered, how many tokens it used and what it cost, tied to a scrambled code in place of your account. Never your profile, your CV, your prompts or the AI's answers. Where it processes: The EU. The machine runs in Google Cloud's Netherlands region (europe-west4). On the way there the data crosses Cloudflare's network, which carries it without keeping it. Processes your data inside the EU.
  • Brevo (transactional email) — Sendinblue SAS, trading as Brevo, 17 rue Salneuve, 75017 Paris, France. We contract with the European entity. What it receives: Your email address and the contents of the email we send you: a sign-in link, a confirmation, a receipt, and a weekly summary of your own activity (counts, the names of companies in your tracker, your next step). Where it processes: The EU. Its core infrastructure runs in France, with one server in Belgium. The way we use it reaches five of its own processors, none of them infrastructure outside the EU. Processes your data inside the EU.
  • Google Calendar (the calendar sync you authorise) — Google LLC or Google Ireland Limited. Which one applies depends on your own Google account rather than on ours, and we have not verified which one processes in each case. What it receives: The title, time and description of an interview or application event that you choose to sync to your own Google calendar, using access you grant us. Where it processes: Not determined. The Calendar interface publishes no region, and we have not verified it. We have not confirmed where this one processes your data, and we make no claim that it is inside the EU.
  • Google Workspace (our own company email) — Google LLC or Google Ireland Limited. Which one applies depends on the plan we sign up to, and we have not verified it. What it receives: Correspondence with you: support, and our answer when you ask us what we hold about you, received in our company mailbox. Where it processes: Not confirmed. Three questions about it are open, and we answer none of them from memory. We have not confirmed where this one processes your data, and we make no claim that it is inside the EU.
  • Google Calendar appointment page (booking your mentoring call) — Google Ireland Limited, Dublin, for people in the European Economic Area or Switzerland, and Google LLC, United States, for people elsewhere. While the page runs on a personal Google account, Google acts under its own terms as a separate controller, not as our processor. What it receives: Your first name, last name and email address, the time you pick, anything else the booking form asks, and, during the call, the video, audio and name you join Google Meet with. Where it processes: Not determined, and it includes the United States. Google publishes no region for appointment pages or Meet on a personal account; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023). We have not confirmed where this one processes your data, and we make no claim that it is inside the EU.
  • Zoho Mail (on the way out) — Zoho Corporation. We have not verified the exact contracting entity. What it receives: Company correspondence, past and present, for as long as our mail still arrives there. Where it processes: Zoho's European mail service. On its way out. Until the switch is finished it still processes your data, so it stays on this list.
  • Azure (the AI in the product, EU arm) — Microsoft Corporation, for the Azure OpenAI Service. What it receives: Your profile, your CV, the job ad you paste in, and the text we write for you from them, when you generate a CV, write a cover letter or an auto-apply draft, evaluate a job posting or prepare interview notes. This is the AI we use by default. Where it processes: EU — Azure resource in Sweden Central; Microsoft's EU Data Zone may process a request in another EU country. We confirmed the Sweden Central region on 21 September 2026 with a real call and read it back out of the answer. Processes your data inside the EU.
  • Vertex (the AI in the product, EU arm) — Google LLC, for the Google Cloud Vertex AI service. What it receives: When you import a CV: the CV itself and the profile details we extract from it. CV import is set to use this provider. Where it processes: The EU, at Google's EU endpoint, and the processing stays in the EU. We confirmed the endpoint with a real call on 23 September 2026. Processes your data inside the EU.
  • Azure (database backups) — Microsoft Corporation, for the Azure Storage service. What it receives: A nightly copy of our database, so everything the database holds about you. Each copy is kept for about five weeks (copies older than 35 days are removed after the next nightly copy succeeds), cannot be altered during its first 30 days, and is used only to restore the service after a failure. Where it processes: Germany, in Azure's Germany West Central region. The storage keeps a second copy in Azure's paired region, Germany North, also in Germany. Processes your data inside the EU.
  • Cloudflare Turnstile (bot check) — Cloudflare, Inc., United States. We have not verified which contracting entity or SCC set covers our account. What it receives: The visitor's IP address, plus whatever browser signal Cloudflare's own script collects, for the invisible challenge behind login, signup, the questionnaire and guest checkout. Where it processes: Not determined. Cloudflare Turnstile documents no fixed processing region for this account. We have not confirmed where this one processes your data, and we make no claim that it is inside the EU.
  • Cloudflare R2 (the files you upload) — Cloudflare, Inc., United States. We have not verified which contracting entity or SCC set covers our account. What it receives: The files you upload: the CVs and documents you import, and your photo if you add one. Where it processes: The EU. We use Cloudflare R2's EU jurisdiction, which keeps the stored files in data centres inside the European Union. Processes your data inside the EU.
  • Apify (LinkedIn profile import) — Apify Technologies s.r.o., Vodičkova 704/36, Nové Město, 110 00 Praha 1, Czech Republic — the contracting entity named in the DPA's own Annex I(A) (List of Parties). What it receives: The public LinkedIn profile URL the Star pastes, and the profile data Apify returns for it: name, headline-adjacent fields we do not store, positions (title, company, location, dates, description), education, skills, and languages. Where it processes: Apify's own Privacy Policy states: your Personal Data is maintained and processed by Apify and its third-party service providers primarily in the European Union and the United States, and may also be processed and stored in other jurisdictions where Apify or its service providers operate (https://docs.apify.com/legal/privacy-policy, section International transfer of your Personal Data). This is mixed EU+US, never simplified to only one side. CORRECTED 2026-09-28 (post-checker fix round): the DPA's own Schedule A (https://docs.apify.com/legal/data-processing-addendum), read live, states its EU SCCs (Module Four) apply only where '(a) Customer is not established in the EU and Personal Data Processing by Customer is not subject to GDPR (pursuant to Article 3(2) thereof)' — Bosio UG IS established in the EU, so Module Four does NOT cover our contract. The StarIn (EU controller) -> Apify Technologies s.r.o. (EU processor, Prague, Czech Republic, per the DPA's own Annex I(A)) leg is intra-EU and needs no transfer safeguard at all. What can actually leave the EU is Apify's OWN onward transfer to its subprocessors (DPA Section 7.1: 'Customer appoints Apify to transfer Personal Data to the United States or any other country in which Apify or its Subprocessors operate'; Section 7.2 only commits that 'a lawful data transfer mechanism' will be in place 'where legally required', without naming which mechanism covers which subprocessor). Apify's subprocessor list (https://trust.apify.com/subprocessors) is a JS-rendered page this check could not read without a browser; whether the relevant US subprocessor(s) are EU-US Data Privacy Framework participants or run under SCC Module Three is PENDENTE DE CONFIRMAÇÃO DO FORNECEDOR. We have not confirmed where this one processes your data, and we make no claim that it is inside the EU.

A processor is added to this list before it receives anything, and a processor we stop using stays on it until the switch is actually finished — not from the day we decide to switch. To ask about any entry here, write to finance@starin.pro.

Artificial intelligence and your data

When you ask us to evaluate a job posting against your profile, generate a CV, write a cover letter, import an existing CV, or prepare interview notes, we send the text those features need — your name, roles, employers, skills, achievements, education and languages, and the posting itself where relevant — to an AI model to produce the result you asked for. The purpose is exactly the feature you triggered: the analysis is the service, so the legal basis is Art. 6(1)(b) DSGVO, performance of the contract you asked us to perform, not consent. We keep nothing beyond the record of that one result, which is deleted with the analysis or document it belongs to.

Below, first the providers that receive your data today, then the ones our software can call but no feature does. A provider that receives your data acts as our processor, on our instructions, for the one request you made. What we can show about the transfer differs from provider to provider, so each line says it plainly: a Data Processing Agreement incorporating the EU Standard Contractual Clauses where data would leave the EU, processing inside the EU where it does not, and, where we have verified neither, that we claim no safeguard. Microsoft Corporation (Azure OpenAI Service), Google LLC (Google Cloud Vertex AI) are inside the EU. Anthropic PBC, OpenAI, L.L.C. are outside the EU, so your data leaves the EU whenever one of those providers is used.

In production

  • Microsoft Corporation (Azure OpenAI Service) (EU — Azure resource in Sweden Central; Microsoft's EU Data Zone may process a request in another EU country). Used for generating a CV, writing a cover letter or an auto-apply draft, evaluating a job posting against your profile and preparing interview notes. Your data is processed inside the EU, under the provider's Data Processing Agreement; your request is not sent to a country outside the EU, and any access to it from outside the EU by the provider or its sub-processors falls under that agreement's transfer terms.
  • Google LLC (Google Cloud Vertex AI) (EU, Google's EU endpoint). Used for importing an existing CV. Your data is processed inside the EU, under the provider's Data Processing Agreement; your request is not sent to a country outside the EU, and any access to it from outside the EU by the provider or its sub-processors falls under that agreement's transfer terms.

Switched off

Our software can also call the providers below, but no feature does today, so nothing from you is sent to them. They would receive your data only if we switched one on, and we will update this page before we do.

  • Anthropic PBC (USA). If we switched it on, your data would be transferred to USA, covered by a Data Processing Agreement incorporating the EU Standard Contractual Clauses (Art. 46 DSGVO).
  • OpenAI, L.L.C. (USA). If we switched it on, your data would be transferred to USA, covered by a Data Processing Agreement incorporating the EU Standard Contractual Clauses (Art. 46 DSGVO).

To ask about this processing, to ask where a provider’s transfer safeguards stand today, or to exercise any of the rights listed below, write to finance@starin.pro.

How We Measure the Product

There is no advertising on StarIn, no advertising network, no tracking pixel, and no third-party analytics. We do not do targeted advertising and we have never sold an ad.

We do measure the product, with our own server: which step of the funnel people reach, which tools they use, what our AI bill is, and what you tell us in the feedback box. The legal basis is Art. 6(1)(f), our interest in knowing whether the thing works and what it costs. Nothing in it is sold, cross-referenced, or used to profile you individually.

This is not a promise we ask you to take on trust. Our build fails if a known tracker host appears anywhere in the source or in what ships, and a second check fails if any new external recipient of data appears that is not in our documented map.

Marketing email

We send email about StarIn’s own services. This rests on two separate legal bases, and it is worth knowing which one applies to you, because they carry different rights.

  • The checkbox at account creation is consent under DSGVO Art. 6(1)(a). It is never pre-ticked, it is not a condition of the account, and you can withdraw it at any time.
  • The notice line next to it is the objection information required by § 7 Abs. 3 Nr. 4 UWG. It tells you, before you give us the address, that you may object to this use at any time and that objecting costs no more than the transmission itself.

What the consent record holds

When you consent we write one record. It holds your email address, the version of the wording you were shown, the language it was shown in, the date and time of the declaration, and the IP address the declaration came from. That is what lets us show, later, exactly what you agreed to and when — DSGVO Art. 7(1) puts that burden entirely on us.

We keep the record for as long as the consent is in use, and after that for as long as we may still have to show it was given. How long that second stretch runs is not settled yet, and we would rather write that here than publish a number we do not hold ourselves to. What keeps the record alive after you object is DSGVO Art. 6(1)(f), our legitimate interest in being able to defend a claim: an objection is written down as an objection, not as a gap where the proof used to be.

Nothing removes this record on a schedule. There is no automatic deletion. If you want it gone, ask us at finance@starin.pro and a person here removes it by hand and writes back to say it is done.

If you delete your account we remove your profile and every record attached to it, and we revoke the marketing consent so nothing further is sent. The consent record itself stays, detached from the account, because it is the proof of what you were told and of when sending had to stop. Ask us and a person removes that one too.

How to object

Use the unsubscribe link at the end of every message. It works without logging in and it takes effect immediately. You can also write to finance@starin.pro. Objecting does not affect your account.

The notice, in the words you were shown it

Portuguese: Usamos seu e-mail para falar dos nossos serviços; você pode recusar a qualquer momento, sem custo, pelo link em cada mensagem. Política de Privacidade

English: We use your email to tell you about our services; you can opt out anytime, at no cost, via the link in every message. Privacy Policy

German: Wir nutzen Ihre E-Mail-Adresse, um Sie über unsere Leistungen zu informieren; Sie können jederzeit kostenlos widersprechen, über den Link in jeder Nachricht. Datenschutzerklärung

How Long We Keep Your Information

Plainly: apart from the purchase record above, a two-hour window on the abuse counters and the database backups described below, we have not set retention periods. Your data stays for as long as your account does. We would rather write that than a number we do not keep.

What you can do about it does not depend on us deciding anything. In your account settings you can export everything we hold about you, as a machine-readable file, and you can delete your account. Deleting it removes your profile, your questionnaire answers, your documents, your Academy comments, your job-search history and the files you uploaded, straight away. The exception is the tax record described above, which German law requires us to keep. The database backups are the other: we keep each backup for about five weeks and use backups only to restore the service after a failure; on our Azure database a backup also cannot be altered during its first 30 days. A deletion therefore reaches the backups when they expire, about five weeks later. Each deletion also leaves a short note, holding only the internal number of your account and the date, which we use for nothing else: if we ever restore a backup, we use these notes to delete again, before the service reopens, the accounts deleted since that backup was made. A booking for the mentoring call is not removed with your account either: it sits in Fernanda’s Google calendar, outside our systems, so write to us and we delete it. The notes are not removed automatically yet; once they are, each one will be kept only a little longer than our oldest backup, and we will print that period here.

One record does not go with the rest: if you gave us permission to send marketing email, the proof of that permission stays, because without it we could not show we ever had it. Ask us and a person removes it.

Deleting your account also folds your use of the product into counters that hold no key back to you — how many people reached a step, how many left. Those counters survive, and we keep them. We call that aggregation and not anonymisation, on purpose: at our current size a weekly counter can stand for one person, so we suppress small numbers in the reports we read.

Your Rights

Under the GDPR you can ask us for a copy of your data, correct it, have it erased, restrict or object to how we process it, take it elsewhere in a portable form, and withdraw any consent you gave. Withdrawing consent does not undo what was lawful before you withdrew it.

Two of these you can exercise yourself, in your account settings, without asking anyone: the export and the deletion. For anything else, write to finance@starin.pro and we will answer within 30 days.

You can also complain to a supervisory authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, because that is where the company is seated. You may also complain to the authority where you live.

Cookies

We set a small number of cookies, all our own, all needed for something you asked for:

  • Your sign-in session, so you stay logged in.
  • Your chosen language.
  • A guest token, so a questionnaire result or a checkout you started before creating an account is still yours afterwards.
  • A short-lived one-time value that protects the calendar connection from being hijacked while it is being set up.

There is no advertising cookie, no tracking cookie and no third-party cookie. That is also why you are not reading a cookie banner.

Security

We prioritize the security of your information and employ reasonable measures to prevent the loss, misuse, or unauthorized alteration of the information under our control. However, acknowledging the inherent risks, we cannot provide an absolute guarantee of security. Consequently, we cannot ensure or warrant the security of any information you transmit to us, and you undertake such transmissions at your own risk.

Third Party Links & Use Of Your Information

Our Service may include links to external websites not operated by us. This Privacy Policy does not cover the privacy policies and practices of third parties, including those operating websites or services accessible through links on our Service. We strongly recommend reviewing the privacy policy of each site you visit. We lack control over and disclaim any responsibility for the content, privacy policies, or practices of any third-party sites or services.

Who Answers

Questions and complaints about your data go to finance@starin.pro, read by the company itself. We have not appointed a data protection officer, so there is no separate address for one — write to that one and it reaches the people who can act on it.