Privacy Policy

We collect information you provide directly and information gathered automatically:

Information you provide:

• Name, email address, phone number, and property address
• Project details, service preferences, and design requirements
• Account credentials when you register for the client portal
• Payment information processed securely through Stripe
• Communications, notes, and feedback you share with us
• Electronic signatures on quotes and proposals

Information collected automatically:

• Device type, browser, and operating system
• Pages visited, time spent, and navigation patterns
• IP address and general geographic location
• Push notification device tokens if you opt in to notifications on iOS
• Email-open events for transactional and project-related emails we send through our platform

Your information helps us deliver great service:

• Prepare accurate quotes and project proposals
• Schedule consultations, installations, and follow-up visits
• Process payments and send invoices/receipts
• Provide access to the client portal for project tracking
• Send project updates, appointment reminders, and status notifications
• Send push notifications you choose to receive on your device
• Confirm whether transactional emails such as quotes, receipts, and project updates were opened
• Respond to your questions and support requests
• Improve our services based on feedback and usage patterns
• Comply with legal and regulatory obligations

We will never sell your data or use your information for unrelated advertising.

We use Stripe to process all payments securely. Your full credit card number is never stored on our servers — it is sent directly to Stripe's PCI-compliant infrastructure. We only retain a transaction reference, last four digits, and payment status for your records in the client portal.

We do not sell your personal information. We may share limited data with:

• Service providers — Supabase (database & auth), Stripe (payments), Resend (email notifications), Cloudflare (hosting)
• Subcontractors — Only the project-specific information needed to complete your installation
• Legal authorities — When required by law, subpoena, or legal process

All third-party providers are contractually obligated to protect your information and use it only for the purpose of providing their services.

We take security seriously. Your data is protected with:

• TLS/SSL encryption for all data in transit
• AES-256 encryption for data at rest in our database
• Two-factor authentication (2FA) for staff and admin accounts
• Row-Level Security (RLS) policies ensuring you only see your own data
• Regular security audits and dependency updates
• Automatic session timeouts for inactive portal sessions

While no system is 100% secure, we implement industry best practices to protect your information.

The StarlightATL iOS app provides access to the same client portal functionality available on our website. The app may collect account information, contact details, project details, communications, and photos or videos that you or our team choose to upload for project documentation, portfolio management, or client updates.

The app may also request permission to use Apple's MapKit for address autocomplete during client setup. This supports address entry only and is not used for continuous location tracking. Data processed through Apple services is subject to Apple's privacy policy.

If you allow notifications on iOS, we collect and store your device's push notification token so we can send first-party service notifications such as project updates, reminders, scheduling alerts, and other account-related messages.

Push tokens are used only to deliver notifications for your StarlightATL account. They are not used for third-party advertising, cross-app tracking, or sold to data brokers.

We may measure whether transactional or project-related emails we send — such as quotes, receipts, project updates, and scheduling communications — were opened. This helps us confirm delivery, understand whether clients received important service information, and follow up appropriately.

This email-open measurement is used only for first-party operational purposes and customer service. It is not used for third-party advertising, cross-app tracking, or behavioral advertising.

On supported Apple devices, you may choose to use Face ID for faster sign-in to the StarlightATL app. Face ID data is processed by Apple on your device and we do not receive or store your biometric template.

We only receive the result of Apple's authentication check so we can unlock your app session.

You have the right to:

• Access — Request a copy of the personal information we hold about you
• Correction — Update or correct inaccurate information
• Deletion — Request removal of your personal data (subject to legal retention requirements)
• Opt-out — Unsubscribe from marketing emails at any time
• Portability — Request your data in a standard, machine-readable format

To exercise any of these rights, contact us at info@starlightatlanta.com. We will respond within 30 days.

Our website uses essential cookies for authentication and session management and also uses Google Analytics to measure website usage, page visits, and campaign performance. We do not use Facebook Pixel at this time. Basic, anonymized performance data may also be collected by Cloudflare. Our iOS app does not use App Tracking Transparency, IDFA, or third-party advertising SDKs for cross-app tracking.

Our services are not directed to individuals under 18. We do not knowingly collect personal information from minors. If you believe a child has provided us with personal information, please contact us so we can delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through a notice on our website. The "Effective" date at the top of this page indicates the latest revision. Your continued use of our services after changes constitutes acceptance of the updated policy.