Privacy Policy

StellaBase gives small businesses websites and tools to sell, book, take orders and keep in touch with customers. This policy explains what information we handle, why, who we share it with, and your choices. It applies to StellaBase’s own site and app, and to the business websites we host.

Two kinds of people, two roles

• Business owners and their teammates who use StellaBase: we are responsible for your account information, as described here.
• Customers of those businesses, who use a business’s site to order, book, ask for a quote, RSVP, donate, sign up or leave a review: the business decides how your information is used, and StellaBase processes it on the business’s behalf. For questions about how a business uses your information, contact that business. We help them answer requests.

What we collect

From business owners

• Account details: name, business name, email, phone, address, and any license numbers you enter.
• What you put into the service: site content, photos, products, services, prices, listings, contacts, notes, invoices and settings, including payment handles (such as a Zelle email or Venmo name) you choose to show customers.
• Billing details for your plan, handled by Stripe. We see the plan, status and the last digits of the card, never the full card number.
• Connected accounts you choose to link, such as Gmail or Outlook (send-only), Facebook lead ads, an MLS feed or another CRM.

From customers of a business, through its site

• What you type into forms: name, email, phone, address, messages, order and booking details, answers to a business’s questions, and photos you upload.
• Purchases, bookings, RSVPs, donations and memberships. Card and bank details are entered on Stripe’s secure page and never reach StellaBase. If you pay a business directly (Zelle, Venmo, Cash App, PayPal), that happens in your own app; we only record that you said you paid.
• Activity on the business’s site, such as pages viewed, listings or products looked at, saved searches and favorites, linked to a random ID in your browser and, if you give your email, to your contact record with that business.
• Whether you agreed to calls or texts, and whether you unsubscribed.

Automatically

• Basic technical data our hosting needs to run and protect the service, such as IP address, device and browser type, and pages requested. We use it for security, preventing abuse and fixing problems.
• Visit counts for each business’s analytics, counted without advertising cookies.

We don’t ask for Social Security numbers, dates of birth beyond an optional birthday a business may ask for, income, or credit details.

How information is used

• To run the service: publish sites, deliver form submissions, process orders, bookings and invoices, send receipts, reminders and confirmations, and show businesses their analytics.
• To send email a business sets up, such as replies, follow-ups, campaigns and review requests. Every marketing email has an unsubscribe link, honored right away.
• To secure the service, prevent fraud, spam and abuse, and enforce our Terms.
• To support you and improve StellaBase, using aggregated or de-identified data where possible. When a business needs help, StellaBase staff may open its dashboard in a read-only view (nothing can be changed or sent that way); each time is noted in that business’s activity log.
• To meet legal obligations.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We don’t use a business’s customer data for our own marketing or for any other business.

Who we share it with

• The business you dealt with, and, if that business refers you, the professional they choose, after that professional accepts.
• Service providers that run parts of StellaBase for us, under contracts that limit their use of the data:
  • Vercel: hosting, file and photo storage, and domain registration
  • Neon: database
  • Stripe: card and bank payments for businesses and their customers, and our own subscriptions
  • Postmark: email delivery: sign-in links, receipts, alerts, and businesses' customer and marketing emails
  • Google: sign in with Google, sending from a business's connected Gmail, and Gemini for optional AI writing
  • Microsoft: sending from a business's connected Outlook account
  • Anthropic: Claude, for optional AI features
  • Meta: importing leads from a business's own Facebook lead ads, when connected
  • RentCast: home value estimates on real estate sites
  • MLS Grid: listing data for real estate agents who connect their MLS
  • Apple, Google and Mozilla push services: phone and browser alerts a business owner turns on
  • OpenStreetMap: map tiles and address lookups on sites that show a map
  • YouTube and Vimeo: videos a business chooses to embed on its site
• Tools a business connects, such as its own email account, CRM or ad account.
• For legal reasons: to comply with law or valid legal process, to protect rights, safety and property, or to investigate fraud or abuse.
• In a business transfer, such as a merger or sale, under this policy’s protections.

Email accounts businesses connect (Google and Microsoft)

Businesses can let StellaBase send email from their own Gmail or Outlook. We request permission to send email only. We cannot read their inbox, and we use the access solely to send the emails the business sets up in StellaBase. StellaBase’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Access tokens are encrypted, and a business can disconnect at any time.

AI features

Optional AI features draft text such as descriptions, posts and follow-up emails. They send only the details needed for that draft (for example product facts or a customer’s request) to the AI provider listed above, which processes it to return the draft under its business API terms. We don’t send card or bank details, and businesses can choose not to use AI features.

Calls and texts

Businesses may call or text you only if you agreed, or about a request you made. Reply STOP to any text to opt out. StellaBase itself doesn’t send marketing texts.

Cookies and similar technology

We use a sign-in cookie for business owners, and a random ID stored in your browser on business sites to remember carts, saved searches and favorites, and to count visits. We don’t use third-party advertising cookies or trackers. If your browser sends a Global Privacy Control or Do Not Track signal, business sites don’t record your visit statistics or browsing activity. Some business sites embed a map (OpenStreetMap) or a video (YouTube or Vimeo); those services receive your IP address when they load.

Your choices and rights

• Unsubscribe from marketing email with the link in any message.
• Ask to see, correct, download or delete your information. Customers of a business should contact that business first; you can also contact us and we’ll pass the request on or help. We respond within 30 days, or sooner where the law requires.
• Business owners can download their contacts anytime and delete their whole account in Settings. Deleting an account is immediate.
• Each business site has its own privacy notice (linked in its footer) that names the business and how to reach it.
• US state privacy rights. Depending on where you live (for example California, Colorado, Connecticut, Virginia or Texas), you may have the right to know, access, correct, delete and port your personal information, and to opt out of its sale or use for targeted advertising (we do neither). We won’t treat you differently for using these rights. You can use an authorized agent; we may verify your identity before acting.

Security

Data is encrypted in transit, and sign-in and connection tokens are encrypted at rest. We limit who can access data and protect the service against abuse. No system is perfectly secure; if a breach affects your personal information, we’ll notify you and the right authorities as the law requires, and businesses within 72 hours of confirming it where possible. See our Security page and Data Processing Addendum.

How long we keep it

We keep account data while an account is open. Site visit statistics and browsing activity are kept for about 13 months, then deleted automatically. When a business deletes its account, its data is deleted right away and backup copies are erased within 90 days, except what we must keep for legal, tax, fraud-prevention or dispute reasons. When a business deletes one of its contacts, that person’s activity is deleted too; order and payment records are kept for the business’s books.

Children

StellaBase is not directed to children under 13, and we don’t knowingly collect their information. If you believe a child gave us information, contact us and we’ll delete it.

Where data is stored

StellaBase is run in the United States, and data is stored and processed in the United States.

Changes

We’ll post updates here and change the date above. We’ll email business owners about material changes before they take effect.