Privacy

Who we are

StarlineSales is operated at starlinecart.com. For anything in this policy, write to privacy@starlinecart.com.

What stays on your device

Contacts, companies, campaigns, drafts, notes and activity history are stored in your browser using IndexedDB. This data is never transmitted to our servers. We cannot read it, we do not back it up, and it is not included in any export or disclosure we could be compelled to make, because we do not have it.

Two consequences you should understand:

• It does not sync between devices or browsers.
• Clearing your browser data deletes it permanently. Export regularly.

What we hold

Your account

• Name and email address, so you can sign in and we can reach you.
• A bcrypt hash of your password. We never store the password itself.
• Role and status, which determine what you can do.
• When the account was created, last updated, and last signed in.

Sessions and security records

• An identifier for each active session, your network address and browser user-agent, so you can see and end your own sessions.
• An audit log of sign-ins, sign-outs and account changes, with time and network address.
• Failed sign-in attempts, keyed to the email tried and the address it came from, to limit password guessing. Discarded after fifteen minutes.

Credentials you connect

If you connect a mailbox or an AI provider, those credentials are encrypted with AES-256-GCM and stored outside the web root. They are used only to carry out actions you start, are never sent to the browser, and can be disconnected at any time in Settings.

What we do not do

• No analytics, no advertising, no tracking pixels, no third-party scripts.
• No selling, renting or sharing of personal data. There is no arrangement under which anyone else receives it.
• No profiling and no automated decisions with legal effects.
• No cookies beyond one strictly-necessary session cookie.

Cookies

One cookie, named starline_session. It keeps you signed in, is marked Secure, HttpOnly and SameSite=Lax, and expires when you close your browser. There is no cookie banner because there is nothing to consent to.

Email you send through the product

Messages are sent directly from the mailbox you connect to the recipient's mail server. They do not pass through our infrastructure and we keep no copy. Your mail provider's own privacy policy applies to them.

You are the data controller for the people you contact. You are responsible for having a lawful basis to email them and for honouring their requests. See the terms.

How long we keep things

• Account records — until the account is deleted.
• Sessions — until you sign out, or 30 days without use.
• Audit log — retained for security. Tell us if you need it removed and we will explain what we can do.
• Failed sign-in attempts — fifteen minutes.

Your rights

If you are in the UK or EU, the UK GDPR and GDPR give you rights of access, correction, erasure, restriction, portability and objection. Write to privacy@starlinecart.com and we will respond within 30 days. You may also complain to your data protection authority; in the UK that is the ICO.

Our lawful basis for holding your account is performance of a contract — we cannot provide an account without it. For security logging it is legitimate interest in keeping accounts safe.

Where data is held

Account data is stored on servers in the European Union operated by our hosting provider. Your contact list is on your own device, wherever that is.

Children

StarlineSales is a business tool and is not directed at anyone under 16.

Changes

If we change this policy in a way that affects you, we will email account holders before it takes effect. The date at the top always reflects the current version.