Privacy Policy
Effective date: September 18, 2026
This Policy forms part of our Terms of Use and is supplemented by our Cookie Policy.
This Privacy Policy describes how StarlightIQ, LLC (“StarlightIQ,” “we,” “our,” or “us”) collects, uses, discloses, and protects personal information in connection with https://starlightiq.com and our related applications and services (together, the “Platform”). It is incorporated into, and subject to, our Terms of Use, including the arbitration and liability provisions there. Our separate Cookie Policy describes the cookies and similar technologies we use in more detail and how you can control them.
By creating an account, checking a consent box, or otherwise using the Platform, you acknowledge this Policy. Where required by law, we will obtain your affirmative consent to specific processing (for example, certain uses of Uploaded Content, SMS messaging, or non-essential cookies) separately, as described below.
1. Children’s Privacy
The Platform is intended for use only by individuals who are at least eighteen (18) years old. We do not knowingly collect personal information from anyone under eighteen (18) years of age. If we learn that we have collected personal information from someone under eighteen (18), we will take reasonable steps to delete it. If you believe a minor has provided us with personal information, contact us at support@starlightiq.com.
Information We Collect
2. Categories of Information
We may collect the following categories of information about you:
- Account Information. Your name, email address, phone number, professional role, and other information you provide to register or maintain your account.
- Commercial Information (Uploaded Content). The Platform lets you upload, store, and manage third-party commercial contracts and related information about your brand and talent relationships (“Uploaded Content”), including counterparty names, contract terms, deliverables, deadlines, and payment information. Section 11 (Uploaded Content) describes additional protections and your opt-out choices for this category.
- Payment Information. Billing name and address and payment card or bank details, collected and processed by our payment processor on our behalf. We do not store full payment card numbers on our own servers.
- Usage and Device Information. Information about how you use the Platform (features used, pages visited, time spent), and technical information such as IP address, browser type, operating system, and device identifiers, collected automatically, including through cookies and similar technologies described in our Cookie Policy.
- Location Information. Approximate location inferred from your IP address or device settings.
- Correspondence. Content of communications you send us, and information other users or third parties send us about your activity on the Platform.
- Agency and Client Information. If you use the Platform through an Agency Account (Section 7), information about the clients or team members whose deals you manage, provided by the Agency Account Holder.
- Other Information You Provide. Biographical, employment, or professional information (such as employment history, social media metrics, or industry connections) you choose to add to your profile.
We collect this information directly from you, automatically through your use of the Platform, and, where applicable, from service providers such as our payment processor, or from an Agency Account Holder who manages your information on the Platform.
How We Use Information
3. Purposes of Processing
We use personal information to:
- Provide the Platform. Operate core features such as organizing, summarizing, and tracking your commercial relationships, including through Auto-Populated Data as described in our Terms of Use.
- Manage Your Account and Payments. Process subscription payments, maintain your account, and enforce our Terms of Use, including billing and collections.
- Communicate With You. Send account, service, and security notices by email and, if you opt in, by SMS, and, where you have not opted out, product updates and marketing.
- Improve and Develop the Platform. Conduct research, testing, and analytics, and, as described in Section 10 (Artificial Intelligence) below, develop and improve our AI features.
- Ensure Security and Legal Compliance. Detect and prevent fraud and abuse, enforce our Terms of Use, resolve disputes, and comply with applicable law.
How We Disclose Information
4. Categories of Recipients
We do not sell your identifiable personal information to third parties for their own marketing purposes. We may disclose personal information as follows:
- Service Providers. Vendors who perform services on our behalf, such as payment processing, cloud hosting, customer support, analytics, SMS delivery, and artificial intelligence infrastructure providers. These vendors are contractually restricted to using personal information only to provide services to us, consistent with applicable state service-provider and processor requirements.
- Aggregated or De-Identified Data. We may disclose aggregated or de-identified information that does not identify you (for example, industry trend statistics) without restriction. If we begin disclosing or selling such data in a manner that constitutes a “sale” or “share” under applicable state law, we will update this Policy and provide the opt-out and Do Not Sell/Share mechanism described in Section 12 before doing so.
- Legal and Safety Reasons. Law enforcement, regulators, or other parties where we believe disclosure is required by law, legal process, or necessary to protect the rights, property, or safety of StarlightIQ, our users, or others.
- Business Transfers. A successor in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.
- With Your Direction. Any other party, where you direct or consent to the disclosure.
5. Cookies and Similar Technologies
We and our service providers use cookies, pixels, and similar technologies to operate the Platform, remember your preferences, measure performance, and, where you consent, support marketing. Our Cookie Policy describes the categories of cookies we use, the consent banner and preference controls available to you, and how to manage or withdraw consent, including how we honor opt-out preference signals such as Global Privacy Control where required by law.
6. SMS and Mobile Messaging
If you opt in to receive SMS/text messages from us (for example, deadline or renewal reminders), we collect and use your mobile phone number to send those messages. Consent to receive SMS messages is never required to purchase or use a subscription. You may opt out at any time by replying STOP to any message, and we will not share your mobile number or SMS opt-in status with third parties for their own marketing purposes.
7. Agency and Business Accounts
If you access the Platform through an account administered by an agency, manager, or other business (an “Agency Account”), that Agency Account Holder controls the information it uploads about you, and we process it on the Agency Account Holder’s behalf and instructions, in our role as a service provider or processor under applicable privacy law. If you have questions about how your information is used within an Agency Account, please contact the Agency Account Holder directly; you may also contact us, and we will direct your request consistent with our obligations as a service provider. On request, we make available a standard data processing addendum to Agency Account Holders describing our respective roles, the categories of data processed, and applicable security and confidentiality commitments.
Retention, Security, and Your Choices
8. Data Retention
We retain personal information for as long as your account is active or as needed to provide the Platform, and thereafter for as long as reasonably necessary to fulfill the purposes described in this Policy, comply with legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we securely delete or de-identify it, consistent with applicable law.
9. Data Security
We use administrative, technical, and physical safeguards designed to protect personal information consistent with industry standards, and we limit access to personal information to personnel and service providers with a legitimate business need. No system is completely secure, and we cannot guarantee the absolute security of information transmitted to or stored on the Platform. Where required by applicable state data-breach notification laws, we will notify affected individuals (and, where required, regulators) of a security incident without unreasonable delay.
10. Artificial Intelligence
We use artificial intelligence, including third-party AI service providers, to power certain Platform features, such as extracting and organizing information from your Uploaded Content. We may also use Platform data, including Uploaded Content, to train, fine-tune, and improve our own AI models and features, unless you opt out as described below. Where we send information to a third-party AI provider, we require that provider not to use your information to train its own general-purpose models, except where you have separately consented. Before your first upload, and at any time thereafter in your account settings, you may opt out of having your data used to train StarlightIQ’s AI models; opting out does not affect your ability to use AI-assisted features, which may still process your data on a per-request basis to deliver the feature to you.
11. Uploaded Content
You are solely responsible for ensuring you have the right to upload any content to the Platform, and that doing so, and our collection and use of it consistent with this Policy, does not violate any law or any contractual, intellectual property, or other legal right of a third party. If your use of aggregated-data disclosure, or AI training as described in Section 10, in connection with your specific Uploaded Content would violate such a right (for example, a confidentiality clause in a contract you upload), you must opt out of that specific use at the time of upload, using the in-product controls we provide. Where you opt out, we will segregate that content from any data used for aggregated-data disclosure or AI training. Consistent with our Terms of Use, we are not liable for your provision of Uploaded Content or our use of it in accordance with your election under this Policy.
12. Your Privacy Rights
Depending on your state of residence, you may have rights to: (a) know and access the personal information we hold about you; (b) correct inaccurate information; (c) delete your personal information; (d) obtain a portable copy of your information; (e) opt out of the sale or sharing of personal information, or of targeted advertising; (f) limit the use of sensitive personal information; and (g) not be discriminated against for exercising these rights. This is a general summary; the specific rights available to you depend on the law of your state (for example, California, Colorado, Connecticut, Virginia, and other states with comprehensive privacy laws each have their own thresholds and requirements) and may expand as more states adopt privacy legislation.
- How to Exercise Your Rights. Email support@starlightiq.com with your request. We may need to verify your identity before responding, and we will respond within the time required by applicable law. You may designate an authorized agent to submit a request on your behalf, subject to verification.
- Do Not Sell or Share My Personal Information. We do not currently sell or share personal information as those terms are defined under state privacy law. If that changes, we will provide a clear “Do Not Sell or Share My Personal Information” mechanism on the Platform, honor opt-out preference signals such as Global Privacy Control, and update this Policy before doing so.
- Appeals. If we decline a request, you may appeal by replying to our decision email; if we deny your appeal, some states allow you to contact your state Attorney General.
13. International Data Transfers
The Platform is operated from the United States, and personal information is processed and stored in the United States. If we make the Platform available to users outside the United States, we will implement appropriate safeguards for any international transfer of personal information as required by applicable law (such as the EU or UK GDPR), and we will update this Policy to describe the relevant transfer mechanism and your rights before doing so.
14. Consent Records
We keep records of your consent to this Policy, our Terms of Use, and any specific consents or opt-outs you provide (such as AI-training, SMS, or Uploaded Content elections), including the date, version, and associated account. We retain these records to demonstrate compliance and may use them as evidence in a dispute.
15. Changes to This Policy
We may update this Policy from time to time. For material changes, we will provide notice by email and a prominent notice on the Platform, and, where required by law, obtain renewed consent before the change applies to you. For non-material changes, we will update the “Effective Date” above; your continued use of the Platform after that date constitutes acceptance.
16. Contact Us
If you have questions about this Policy or wish to exercise your privacy rights, contact us at: StarlightIQ, LLC, Nashville, Tennessee — support@starlightiq.com.
Additional Disclosures for Connected Social Platforms & Privacy Rights
The following platform-specific and regional disclosures supplement the Policy above and govern data we obtain from social platforms you connect, our subprocessors, and your rights under applicable privacy laws.
Data we receive from connected social platforms
When you connect a social account, we store an OAuth access token (and, where applicable, a refresh token) plus only the fields we display. Per platform:
- Instagram (Graph API): Business/Creator account id, username, follower count, media count, and per-post insights (reach, impressions, engagement).
- Facebook (Pages API): Pages you manage, page id, name, follower count, and page-level insights.
- YouTube Data API + YouTube Analytics API: channel id, channel title, subscriber count, video id/title/description/thumbnail, and aggregate analytics (views, watch time, engagement). StarlightIQ does not request the monetary-revenue scope in its current release.
- TikTok (Login Kit + Display API): open_id, username, display name, avatar, follower/following/likes counts, and video metadata/stats returned by the video.list endpoint.
- X (Twitter): user id, username, public profile fields, and public tweet metrics when the feature is enabled.
- LinkedIn (Sign In with LinkedIn / OpenID Connect): sub (id), name, email, profile picture.
Subprocessors and data sharing
We share data with service providers who process it on our behalf under written agreements:
- Supabase — authentication and primary database hosting. Privacy policy.
- Vercel — application hosting and edge delivery. Privacy policy.
- Resend — transactional email delivery. Privacy policy.
- Anthropic — AI assistance features (only the content you submit to an AI tool is sent; it is not used to train models under our API agreement). Privacy policy.
- Google Cloud (Imagen) — optional AI image generation. Privacy notice.
- Sentry — error monitoring. Privacy policy.
- Amplitude — product analytics and session replay. Records how the Platform is used, including recordings of pages as they appeared on your screen, which may include content you have uploaded or entered. Privacy policy.
Platform-specific compliance
Google / YouTube
StarlightIQ's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. See the policy at developers.google.com/terms/api-services-user-data-policy. Our use of YouTube data is also governed by the YouTube API Services Terms of Service. You can revoke StarlightIQ's access at any time at myaccount.google.com/permissions. By using StarlightIQ's YouTube integration you also agree to the YouTube Terms of Service , and your data is handled in accordance with the Google Privacy Policy.
Meta (Instagram & Facebook)
Data obtained from Instagram and Facebook is used solely to power the features you see in StarlightIQ (profile display, audience analytics, content history). We comply with the Meta Platform Terms and Developer Policies. Request deletion of platform-sourced data at any time on our Data Deletion page.
TikTok
Our integration complies with the TikTok Developer Terms of Service and the TikTok Developer Platform Guidelines. We request only the minimum scopes needed (user.info.basic, user.info.profile, user.info.stats, video.list) and retain no data beyond what you can see in the dashboard.
X (Twitter)
Our use of X data is governed by the X Developer Agreement and Policy. If you delete a post on X, we will delete our cached copy of that post within 24 hours of the deletion being discoverable via the X API.
Our use of LinkedIn data complies with the LinkedIn API Terms of Use. We use the Sign In with LinkedIn (OpenID Connect) product and collect only profile identity fields (sub, name, email, picture).
Platform data retention specifics
- OAuth tokens — retained only until you disconnect the platform or delete your account.
- Raw YouTube content (video metadata, titles, descriptions, thumbnails) — refreshed or deleted within 30 days, in line with the Google Limited Use policy.
- Raw Instagram and TikTok post records — the same 30-day refresh-or-delete cap applies.
- Aggregated / derived metrics — retained for 24 months, then rolled up into monthly summaries.
- Audit and security logs — retained for 12 months.
EU / UK and California privacy rights
Under the GDPR and UK GDPR, the legal bases on which we rely are: contract (to deliver the service), consent (to connect each social platform, for optional email marketing, and for non-essential cookies), legitimate interest (security, fraud prevention, and product analytics, balanced against your rights), and legal obligation (tax, accounting, and lawful requests). You may access, correct, erase, restrict, object to, or port your data, and withdraw consent at any time, and you may lodge a complaint with your local supervisory authority.
Under the California Consumer Privacy Act (CCPA / CPRA), California residents have the right to know what personal information we collect, to request deletion, to correct inaccurate information, to opt out of the “sale” or “sharing” of personal information, and to be free from discrimination for exercising these rights. To exercise any of these rights, email hello@starlightiq.com.
How to delete your data
- In-app: Settings → Delete account (preferred; self-service).
- By email: hello@starlightiq.com with the subject “Delete my data”.
- Via the Meta data-deletion callback URL we register with Meta. See our Data Deletion page for details and a status-check link.
Deletion is normally completed within 30 days. Backups that contain your data are overwritten on a rolling basis and fully purged within 90 days.
International transfers
StarlightIQ is operated from the United States. For transfers from the EEA, UK, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum, together with supplementary safeguards (encryption in transit and at rest).
Cookies
- Authentication cookies — set by Supabase Auth (HTTP-only) so your session persists. Strictly necessary.
- OAuth anti-CSRF cookies —
oauth_state_<platform>andoauth_pkce_twitterprotect you while connecting a social account. HTTP-only, 10-minute lifetime. Strictly necessary. - Analytics / telemetry — used in aggregate to understand product usage and improve the app.
Security measures
- All traffic to StarlightIQ is encrypted in transit (TLS 1.2+).
- Data is encrypted at rest in Supabase-managed Postgres and Vercel storage.
- OAuth state is signed with HMAC-SHA256 and verified on callback.
- Access to production infrastructure is restricted to authorized personnel with multi-factor authentication.