Privacy policy
Template. Written for the EU GDPR, the Digital Services Act and the Data Act, and the New Zealand Privacy Act 2020. Fill in your company details in the server settings and have a lawyer review it before launch. Last updated: [date].
This policy explains how [Company name] (“we”) handles personal data when you visit this website and use Stellate. It follows Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).
Who is responsible
Controller for account, billing, support and website data: [Company name], [registered address]. Contact: [privacy email].
Data protection officer:
Representative in the EU (GDPR Art. 27):
Processor for project content: the proposals, partner details, budgets, meeting notes and files your organisation puts into a project belong to your organisation, which is the controller. We process that content only on its instructions, under our data processing agreement. Questions about project content are best directed to the organisation that runs the project.
What we collect, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Name, email, password hash, organisation, role | Create and run your account; let you sign in | Contract (6(1)(b)) |
| Two-factor authentication secret and recovery codes (encrypted / hashed) | Protect your account | Contract; legitimate interest in security (6(1)(f)) |
| Sign-in sessions, network address, browser type, security log entries | Keep accounts secure, detect misuse, investigate incidents, alert you to new sign-ins | Legitimate interest in security (6(1)(f)); legal obligation for security of processing (Art. 32) |
| Subscription, invoices, billing address, VAT number | Bill your subscription; keep accounting records | Contract; legal obligation (6(1)(c)) |
| Emails you send to support; illegal-content reports | Answer you; handle reports under the Digital Services Act | Contract; legal obligation (6(1)(c)) |
| Service emails (invitations, minutes, reminders, call alerts) | Deliver features you or your organisation use | Contract |
We don’t sell personal data, use it for advertising, or make decisions with legal or similarly significant effects by automated means.
Cookies and local storage
We use one cookie, the sign-in session cookie (__Host-stellate_session or stellate_session). It is strictly necessary to keep you signed in, is marked HttpOnly, Secure and SameSite, and expires when your session ends (after 12 hours without activity, and at most 14 days). Because it is strictly necessary, it doesn’t need consent under the ePrivacy Directive, so there’s no cookie banner. We use no analytics, advertising or third-party cookies, and the website loads no third-party scripts or fonts.
Who receives data
We use carefully selected service providers (sub-processors) who process data on our instructions under contracts that meet GDPR Art. 28. The current list, with locations and safeguards, is on the sub-processors page. People in your organisation and partners invited to a project see the content of that project according to their role.
International transfers
We host the service in [EU region]. Where a provider processes data outside the EU/EEA, we rely on an adequacy decision (for example for New Zealand, or the EU–US Data Privacy Framework for certified US companies) or on the European Commission’s Standard Contractual Clauses with additional safeguards.
How long we keep data
| Data | Retention |
|---|---|
| Account and project data | While the account or organisation exists. Deleted accounts are removed immediately; deleted projects and files are removed from the live system immediately and from encrypted backups within 30 days |
| Security log | 365 days |
| Sign-in sessions | Until sign-out or expiry; expired sessions are deleted hourly |
| Password-reset and confirmation links | Up to 48 hours, then deleted |
| Server logs (network addresses) | A few days (rotated logs) |
| Invoices and accounting records | As required by tax law (typically 7–10 years) |
Your rights
You have the right to access, correct, delete, restrict and object to the processing of your personal data, and to data portability. You can do much of this yourself on the Account page: download your personal data, correct your name, sign out devices and delete your account. For anything else, contact [privacy email]. We answer within one month.
You can complain to a data protection supervisory authority, in particular in the EU country where you live or work, or in New Zealand to the Office of the Privacy Commissioner.
AI drafting
AI drafting is off by default. If an owner or administrator of your organisation turns it on and someone uses it, the section text and the project details needed for the draft are sent to the AI provider listed on the sub-processors page. The provider processes it to return the draft and does not use it to train its models. Each organisation decides whether to allow this.
Security
We protect data with encryption in transit (TLS) and at rest (AES-256-GCM for project content, files and backups), two-factor authentication, account lockout, role-based access, a tamper-evident security log and regular updates. Details are on the security page. If a personal data breach is likely to put you at risk, we will tell you and the supervisory authority as the GDPR requires.
Children
The service is for professional use and not intended for children under 16.
Changes
We’ll announce material changes to this policy by email or in the application before they take effect.