Reports Privacy Policy
Version: 1.5
Last Updated: 2026-09-29
Effective Date: 2026-09-18
This policy covers one-off report purchases at starbind.me/reports ("StarBind Reports"). The StarBind app is a separate product with heavier account features and its own Privacy Policy. If you use both, each policy covers its own product; your data is not merged beyond what Section 7 describes.
1. Data Controller
- Controller: STORMVIBE Ltd. (EOOD), EIK 208809995, VAT BG208809995, 27E Srebarna Street, Bldg. 7, Entr. A, Apt. A2, Lozenets District, Sofia 1407, Bulgaria, [email protected]
- The Company is established in the European Union (Bulgaria); a GDPR Article 27 representative is not required.
2. What We Collect and Why
StarBind Reports is deliberately light: no account, no password, no age verification, and no analytics or advertising tag that runs before you say yes. We collect only what a purchase needs:
| Data | When | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Email address | At checkout (collected by Stripe), gift redemption, or library sign-in | Deliver your report, operate your library, send order emails | Art. 6(1)(b) contract |
| Birth data: date, time (or "unknown"), birth place and its coordinates; for compatibility reports, the same for the second person | Order form | Compute the chart and generate the report | Art. 6(1)(b) contract |
| Grammatical gender ("the reading is for a woman / a man"), for Bulgarian editions only | Order form, per person | Bulgarian adjectives and participles agree with the person they describe, so the report must state one; guessing would misgender you for the whole document. Used for grammar, never as interpretive material. English editions never ask for it and never receive it. On a compatibility gift where you attach your own chart, we ask regardless of language, because your recipient chooses the language when they redeem | Art. 6(1)(b) contract |
| Nickname: optional, compatibility reports only | Order form or gift redemption, per person | A short label of your choosing (a first name, initials, anything up to 50 characters) so the reading can refer to each of the two people by name instead of "the first chart" and "the second chart". Sent to the AI provider with the chart data and printed in the report. We do not verify it or use it to identify you, but if you enter a real name it is personal data: it is stored, sent and deleted together with the report it belongs to, and nothing outside that report links it to you | Art. 6(1)(b) contract |
| Whether your birth details are printed (compatibility gifts where you attach your own chart) | Gift purchase | You contribute a chart to a report someone else reads, so you choose whether your birth date, time and place appear in it; by default they do not. See Section 7 for what "not printed" does and does not mean | Art. 6(1)(b) contract |
| Full birth name (Numerology report only) | Order form or gift redemption | Derive your numerology numbers (Life Path, Expression, Soul Urge, Personality, etc.). The name is processed transiently on our server to compute these integers and is never stored, logged, or sent to any LLM provider; only the resulting numbers are saved | Art. 6(1)(b) contract |
| Report preferences: report type, language, relationship flavor or focus area | Order form | Generate the right report | Art. 6(1)(b) contract |
| Consent record: your email, IP address, the versions of the Terms and of this policy shown to you (and, at purchase, of the Refund Policy linked from the checkout), the language you saw them in, the version of the consent wording, whether you gave the immediate-generation waiver (direct purchases only; a gift voucher is not generated until redeemed, so its buyer is never asked), for orders placed before 2026-09-18 whether you ticked the ad-attribution box that checkout offered then, and the server-recorded time of your submission | At checkout or gift redemption | Prove the contract and, for direct purchases, your withdrawal-waiver consent | Art. 6(1)(c) legal obligation + Art. 6(1)(f) |
| Website measurement and advertising tags (only after you accept the Analytics or Advertising category in the cookie banner): the event fields we send are the page path, the surface, the language, the SKU, name, price and currency of a report you view, a checkout start, and after a confirmed purchase the order value, currency, gift flag and an opaque order token; each tag also processes technical request data on its own: your IP address, user agent, page URL and referrer, its cookie or click identifiers, timestamps and your consent state. Never your email or a hash of it, your name, birth data, promo code or any payment, access or download identifier | While you browse the storefront's product pages and its sample, about and FAQ pages, and on the order-confirmation page; never on a page where you type birth details - the order form and the Big Three calculator - nor on the library, download, redeem, deletion, shared-report or legal pages | Analytics: measure how the storefront is used (Google Analytics 4 and our own funnel counters). Advertising: tell Google Ads, Meta or Reddit that its ad led to a report view, a checkout start or a purchase, and hold two 30-day remarketing audiences at each platform: people who viewed a report and did not buy, and people who started checkout and did not buy. Nothing runs if you reject | Art. 6(1)(a) consent; withdraw at any time via "Cookie settings" in the page footer (Section 8) |
| Payment data | Stripe checkout | Payment processing: handled by Stripe; we never receive card numbers | Art. 6(1)(b) contract |
| Gift details: recipient email (optional), your name and message (optional) | Gift purchase | Deliver the voucher and show your message to the recipient | Art. 6(1)(b) contract |
| One-time sign-in codes | Library sign-in | Passwordless access to your library | Art. 6(1)(b) contract |
| Share/download access events: hashed IP (SHA-256, daily-rotating salt, original IP unrecoverable), country code, browser user-agent, referrer, timestamp | When a report download link is opened | Fraud prevention, aggregated download statistics | Art. 6(1)(f) legitimate interest |
| Approximate country (the two-letter code Cloudflare derives from your IP address) | Storefront pages, when your browser asks our API which currency to show prices in | Show report prices as an approximate amount in your local currency (currently for visitors in the United States). Your country decides only the currency shown, never the price or the currency you are charged in. Used for that one answer and neither stored nor logged | Art. 6(1)(f) legitimate interest |
| Anti-abuse verification (Cloudflare Turnstile) | Checkout and data-deletion forms | Block bots and abuse; Turnstile is cookieless | Art. 6(1)(f) legitimate interest |
Birth-place autocomplete: when you type a birth place, the text is first matched against our own server-side place database; only if there is no match is it sent through our server to a third-party geocoding service (Photon, operated by Komoot GmbH in Germany) to suggest matching places with coordinates. No name, email, or other identifier accompanies these queries.
Order attribution. When you arrive via a tagged link (e.g. a shared link or a campaign), we record which channel the link came from and attach it to your order, together with the page you landed on, when you landed, and, if you later clicked another tagged link on our site in the same tab, that last link too. This describes the links, not you. Whatever you choose in the banner, our own server counts how many checkouts are started (legitimate interest), with no identifier and nothing stored on your device; without Analytics consent that count carries no channel at all. Your browser sends us no count of any kind until you accept Analytics: the arrival and page-view counts, the per-tab link memory and the per-step counts (product page views, sample views, cart adds, clicks on our own tagged links, app-store clicks) all start there, and stay aggregate daily counts with no personal data.
What we do not do: no tag runs before you choose; no page you type birth details into carries an analytics or advertising tag at all, and that is a property of the page rather than a setting at the vendor: the order form is a page of its own, and so is the Big Three calculator; both load nothing optional. Neither do the library, download, redeem, deletion, shared-report and legal pages; no email, hashed email, name, birth data, promo code or payment identifier goes to any tag; no selling of data; no profiling beyond the two 30-day remarketing audiences you can accept under Advertising. Cloudflare Web Analytics is switched off. If you accept Advertising, the Google Ads, Meta and Reddit tags let those platforms recognise your browser on their own services; that is what a remarketing audience is, and it lasts 30 days. Every item we or a vendor store in your browser is listed in Section 8.
3. AI Generation
Report text is generated by a third-party large language model (LLM) provider. We work with two providers, each under its own data processing addendum, and may route generation, or the automated quality check a finished draft goes through before delivery, to either of them: OpenAI (OpenAI API) and Google (Vertex AI, which hosts Google's own models and third-party models on Google's infrastructure). Whichever provider is used, the generation request carries what that report type needs to be written: the birth data and the chart computed from it, and any nickname you supplied. Two exceptions are described elsewhere in this policy: a Numerology report never sends your full birth name, only the numbers derived from it (Section 2), and when a gift buyer's own birth details are hidden, the request carries their computed chart but not their birth date, time or place (Section 7). The quality check receives the same chart data plus the draft text. Our agreements with both providers prohibit them from using your data to train their models. Each provider processes your data to produce the response and may hold it briefly in a cache; at Google, the default cache is disabled for our project, so prompts sent there are not cached. Beyond that, how long it keeps the request depends on the service and the controls in use: where a provider's zero-retention controls are enabled for our account, inputs and outputs are not stored for abuse monitoring; otherwise the provider may keep them for a limited period (at OpenAI, up to 30 days) for security and abuse monitoring, subject to its own legal and security exceptions, as set out in its DPA. Until we have confirmed zero-retention controls for a provider, you should assume its default retention applies. Google processing is pinned to the EU multi-region in our code; OpenAI processing uses its global endpoint without a regional restriction and may take place in the United States and other countries where OpenAI and its sub-processors operate. Any transfer outside the EU is covered by the Standard Contractual Clauses in the provider's DPA. Reports contain no generated imagery: no image-generation provider is involved.
The StarBind app is a separate product; the AI processing behind its horoscopes, readings and chat is described in the app's Privacy Policy, not here.
4. Who We Share Data With
We do not sell personal data. We share data with the recipients below: processors acting on our instructions, Stripe, which as merchant of record is partly an independent controller, and, only after you accept the Advertising category in the cookie banner, the advertising platforms, whose real role per operation the Role column states:
| Recipient | Role | Data | Region / transfer |
|---|---|---|---|
| Stripe (merchant of record, see Terms of Sale §3) | Checkout and payment. For payment processing, fraud prevention, tax, and its own legal compliance, Stripe acts as the seller of record and an independent controller under its own Privacy Policy. Your birth data is not sent to Stripe. It stays on our servers; the checkout session carries only a reference to it, plus which report you bought, the language, and any discount | Email, payment data, which report/language was purchased | Stripe Payments Europe, Ltd. (Ireland); transfers to Stripe, Inc. (US) covered by the EU-US Data Privacy Framework and SCCs under Stripe's DPA |
| OpenAI, L.L.C. (OpenAI API) | Report text generation; automated quality check of report drafts | Birth/chart data, any nickname, and the generated report text | Global endpoint, no regional restriction (United States and other countries where OpenAI and its sub-processors operate); OpenAI DPA with SCCs; no training on API data; retention as described in Section 3 |
| Google LLC (Vertex AI) | Report text generation; automated quality check of report drafts | Birth/chart data, any nickname, and the generated report text | European Union (Vertex AI EU multi-region, pinned in our code); Google Cloud DPA with SCCs and EU-US Data Privacy Framework; no training on API data; retention as described in Section 3 |
| Microsoft (Azure) | API, database, and infrastructure hosting, including the cookie-consent evidence described in Section 8 | All stored data at rest, including birth/chart data, generated report content and the consent evidence (receipt id, wording revision, language, two category answers, action, time; no IP address, user agent, page address, email or order) | European Union (Azure EU regions, within the Microsoft EU Data Boundary). Microsoft may make limited transfers outside the Boundary in the circumstances set out in its Product Terms (for example security investigations, remote support, or service quality), under the safeguards in its Data Protection Addendum |
| Brevo (Sendinblue SA) | Email delivery: order confirmation, download links, sign-in codes, gift vouchers, deletion confirmations | Email address, message content | European Union (France); any onward transfer by Brevo's own sub-processors is governed by Brevo's DPA and its SCCs |
| Cloudflare | Website hosting/CDN, Turnstile anti-abuse, and the reverse proxy in front of our API (api.starbind.me) that filters abusive and automated traffic; Cloudflare Web Analytics is switched off |
IP address and standard web request metadata; the content of your requests to our API (checkout details, library sign-in, downloads) in transit only: decrypted and re-encrypted at Cloudflare's edge for abuse filtering, never stored | US with EU edge network; SCCs |
| Photon geocoder (Komoot GmbH) | Birth-place autocomplete (fallback after our server-side place cache) | The place text you type (no identifiers) | Germany (EU), public photon.komoot.io instance; EU→EU, no third-country transfer |
| Google Ireland Ltd (Google Tag Manager + Google Analytics 4) | Our processor under the Google Ads Data Processing Terms. The tag container loads as soon as you accept either optional category and fires only the tags of the categories you accepted; the Google Analytics tag inside it runs under the Analytics category and measures how the storefront is used. Google Analytics keeps event-level data for 2 months (our setting) | The event fields in Section 2 (page path, surface, language, SKU, name, price, currency, order value, gift flag, opaque order token); technical request data processed automatically: IP address, user agent, page URL and referrer, its cookie identifiers (_ga, _ga_<id>), timestamps, consent state |
Ireland (EU); Google may process in other countries where it or its sub-processors operate, under the SCCs its terms incorporate and Google LLC's EU-US Data Privacy Framework certification |
| Google Ireland Ltd (Google Ads tag; Advertising category) | Independent controller under the Google Ads Controller-Controller Data Protection Terms. Measures whether a Google ad led to a report view, a checkout start or a purchase; holds the two 30-day remarketing audiences | The same event fields; technical request data processed automatically: IP address, user agent, page URL and referrer, its cookie and click identifiers (_gcl_au, _gcl_aw, _gcl_gb, and the gclid/gbraid/wbraid value from the ad link if you accept Advertising in that visit), timestamps, consent state |
Ireland (EU); same transfer basis as the row above, under Google's controller terms |
| Meta Platforms Ireland Ltd (Meta Pixel; Advertising category) | Joint controller with us for the event data the pixel collects for ad delivery and optimisation, and our processor for matching and measurement, under the Meta Business Tools Terms. Measures whether a Facebook or Instagram ad led to a report view, a checkout start or a purchase; holds the two 30-day remarketing audiences | The same event fields; technical request data processed automatically: IP address, user agent, page URL and referrer, its cookie and click identifiers (_fbp, _fbc, and the fbclid value from the ad link if you accept Advertising in that visit), timestamps, consent state |
Ireland (EU); onward transfers to Meta Platforms, Inc. (United States) under the Global Data Transfer Addendum the terms incorporate (SCCs) and Meta Platforms, Inc.'s EU-US Data Privacy Framework certification |
| Reddit Netherlands B.V. (Reddit Pixel; Advertising category) | Independent controller for event data under the Reddit Advertising Data Processing Agreement. Measures whether a Reddit ad led to a report view, a checkout start or a purchase; holds the two 30-day remarketing audiences | The same event fields; technical request data processed automatically: IP address, user agent, page URL and referrer, its cookie identifier (_rdt_uuid), timestamps, consent state. The rdt_cid value from an ad link is removed before any tag loads and never passed on |
Netherlands (EU); onward transfer to Reddit, Inc. in the United States under the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as the fallback |
| TikTok Technology Ltd | Not enabled. No TikTok tag runs on our pages and no data goes to TikTok; if that changes, this policy and the cookie banner change first | None | n/a |
For the joint processing described above, we and Meta have agreed how to divide our responsibilities under the Meta Controller Addendum. We provide the notice, obtain the required consent and are responsible for the correct, secure integration on our site. Meta is responsible for security of its own product and for enabling access, correction, deletion, restriction and portability rights for personal data it holds after the joint processing. Each party remains responsible for the lawfulness of its own processing. You may exercise your rights against either party: contact us at [email protected], or use the contacts and rights information in Meta's Privacy Policy We forward requests requiring Meta's action.
5. How Long We Keep It
| Data | Retention |
|---|---|
| Report + its birth data | 24 months from purchase. The report then expires and its contents (birth data, chart data, generated text) are deleted. Download your PDF before expiry to keep it. |
| Purchase consent records | Kept as part of the order record for 10 years (Accountancy Act art. 12), the same period as the transaction it evidences, as proof of the contract you entered, of the texts presented to you and of the withdrawal waiver you gave, and to defend legal claims |
| Accounting records | As required by Bulgarian tax and accounting law (typically up to 10 years) |
| One-time sign-in codes | Expire after 10 minutes; purged shortly after |
| Library sessions | Up to 90 days per sign-in, renewed while you keep using the library so an active session does not expire under you; signing out ends it immediately |
| Payment-event records | 90 days, then deleted (Stripe retains its own records under its policy) |
| Share/download access logs | 90 days |
| Cookie-consent evidence (receipt id, wording revision, language, two category answers, action, time) | 13 months from the record's date, then deleted; kept under GDPR Art. 7(1) so we can demonstrate your consent. Your choice itself lives in the sb_consent cookie for 6 months (Section 8) |
| Legacy ad-click attribution (orders placed with the checkout opt-in that existed until 2026-09-18) | The click identifier, IP address and user-agent are removed from the order 90 days after purchase; what remains is the platform's name and whether the purchase was reported, with no identifier. No new rows are written |
| Unredeemed gift vouchers | 12 months from purchase, then expire |
6. Your Rights: Including One-Click Erasure
You have the GDPR rights of access, rectification, erasure, restriction, portability, and objection. Two are built directly into the product:
- Erasure (Art. 17): use the Delete my data page. We email you a confirmation link (valid 24 hours); confirming permanently erases your purchased reports, gift vouchers you bought, sign-in codes, and your email address from our records. Retained afterwards, under legal obligation: purchase consent records and accounting entries, plus a hash-only audit entry recording the erasure itself.
- Access/portability: your library lists everything we hold for your email; each report is downloadable as a PDF. For a structured data export beyond that, email [email protected].
- Withdrawing consent to the website tags needs no email: open "Cookie settings" in the page footer (Section 8). Only for an order placed before 2026-09-18 with the ad-attribution box ticked: email [email protected] naming the order and we delete the click identifier from it before the 90-day strip would. A purchase event a platform already received cannot be recalled, but no further data follows.
For anything else: [email protected]. We respond without undue delay and at the latest within one month; for complex or numerous requests we may take up to two further months, in which case we tell you within the first month and explain why (GDPR Art. 12(3)). You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria: https://www.cpdp.bg.
7. Third Parties' Data, Gifts, and the StarBind App
- Someone else's birth data (compatibility reports, or redeeming a gift for another person's chart): the buyer confirms, when submitting it, that they are entitled to share it with us. It is used only to generate that report, is covered by the same 24-month retention, and is included in the buyer's erasure. Because we hold only the birth details for that person, no email or other contact details, we rely on the disproportionate-effort exception in GDPR Art. 14(5)(b) rather than contacting each chart subject individually. If your birth details were used in someone else's report and you want them removed, contact [email protected].
- Gift purchases involve two people: the buyer (payment, consent) and the recipient (their email and the chart's birth data at redemption). Each can erase their own data via the deletion flow.
- Compatibility gifts where the buyer attaches their own chart. A compatibility gift can be bought with your own birth details included, so the reading compares the two of you and your recipient only fills in theirs. Whether your birth date, time and place are printed in their report is your choice at purchase, and by default they are not.
- "Not printed" means exactly that: not printed, not unprocessed. Your chart is still computed and still held on your recipient's report record for the normal 24 months, and the reading still describes your placements ("her Moon in Scorpio"), which an astrologer could work backwards from. What your recipient does not receive is your birth date, your birth time, or your birth place, and those three are also left out of the request we send the AI provider, which receives the computed chart instead.
- Until the voucher is redeemed or expires (whichever comes first) your details are held on the unredeemed voucher, then deleted.
- Changing the choice later cannot alter a report already generated or downloaded. If you would rather share nothing at all, buy the gift without your details and let your recipient supply both charts.
- App crossover: report purchases may include a bonus for the StarBind app (a period of free subscription-tier access, if this feature is enabled at time of purchase) recorded against your purchase email. If you never use the app, this is never linked to anything else. If you have or later create an app account with the same email, the bonus attaches to it. The app's own Privacy Policy governs the app account.
8. Cookies and Browser Storage
The storefront stores the Necessary items below without asking; they are exempt from consent under ePrivacy Directive Art. 5(3). Everything marked Analytics or Advertising is set only after you accept that category in the cookie banner, which offers Accept all, Reject all and Manage at equal weight with nothing pre-ticked. Accepting one optional category does not switch on the other. The banner never shows on its own, and no tag ever loads, on the order form, the Big Three calculator, the library, download, redeem, deletion, shared-report or legal pages. Until you accept Analytics your browser sends us no measurement request either: our own arrival, page-view and funnel counts all start there. Before the banner or any tag runs, our own script removes the ad-click identifier and any unlisted parameter from the page address; if you accept Advertising in that visit, the Google or Meta identifier is written into that vendor's cookie below so it can attribute a later purchase to its ad, otherwise it is discarded. The Reddit and TikTok click identifiers (rdt_cid, ttclid) are always discarded: neither platform publishes a cookie format or a browser interface for handing one over without putting it back in the page address. We use:
| Name | Set by | Purpose | Category | Lifetime |
|---|---|---|---|---|
sb_reports_session (cookie, HttpOnly, sent only to our API) |
StarBind | Keeps you signed in to your library, renewed while you use it; page scripts cannot read it | Necessary | 90 days |
sb_consent (cookie) |
StarBind | Your cookie choice, the wording revision you answered and the receipt id of the evidence record | Necessary | 6 months |
Saved report cart (localStorage) |
StarBind | Preserves your selected reports | Necessary | 7 days after the latest cart change |
Promo code sb:promo, checkout recovery sb:success, order-form hand-off (sessionStorage) |
StarBind | Carries a promo code from the link you arrived on, keeps the order-confirmation page working if you refresh it, and carries the birth details you typed into the chart widget to the order form | Necessary | The browser tab |
Dismissed-note flag (localStorage) |
StarBind | Remembers you dismissed an informational note | Necessary | Until you clear browser storage |
| Cloudflare Turnstile | Cloudflare | Anti-bot verification on forms; cookieless | Necessary | None |
sb:attr (sessionStorage) |
StarBind | Which tagged link brought you to this tab, so each funnel step is counted once and an order can name its channel; holds no identifier | Analytics | The browser tab |
sb:mk:ga4:<order> (localStorage) |
StarBind | Stops a purchase being reported to Google Analytics twice | Analytics | 90-day validity; see deletion note below |
_ga, _ga_<id> (cookies) |
Google Analytics 4 | Distinguishes visitors and sessions | Analytics | 2 years |
sb:mk:google_ads:<order>, sb:mk:meta:<order>, sb:mk:reddit:<order> (localStorage) |
StarBind | Stops a purchase being reported to that platform twice | Advertising | 90-day validity; see deletion note below |
_gcl_au (cookie) |
Google Ads | Conversion measurement | Advertising | 3 months |
_gcl_aw, _gcl_gb (cookies) |
Google Ads | Holds the Google ad-click identifier from the link you arrived on | Advertising | 3 months |
_gcl_ls (local storage, when used by the Google tag) |
Google Ads | Ad-click attribution state | Advertising | No browser-set expiry; cleared here on withdrawal |
_fbp, _fbc (cookies) |
Meta | Distinguishes browsers; holds the Meta ad-click identifier from the link you arrived on | Advertising | 3 months |
_rdt_uuid (cookie) |
Distinguishes browsers for conversion measurement | Advertising | 3 months |
Purchase markers sb:mk:* are valid for 90 days. Expired entries are removed on the next use with consent for their category; withdrawal clears that category's markers. No deletion code runs while the site is closed, so entries may remain until such a return visit or browser clearing.
The vendor lifetimes are the values each vendor documents; we re-verify every row in a clean browser, for each consent combination, before the tags are enabled and again whenever a tag changes. Changing your mind: "Cookie settings" in the page footer, available in the site footer (static legal pages link back to the site's preferences), reopens the preference sheet. Withdrawing a category takes effect at once: the vendors are told it is denied, that category's items above are deleted from your browser as far as this site can reach them, and if code for the withdrawn category had already loaded on the page, the page reloads so the withdrawn tags stop running. A cookie a vendor set on its own domain rather than ours is not something a script on this site can delete; it stays until your browser or that vendor drops it, and you can remove it yourself in your browser settings. Withdrawal stops future collection; it cannot recall data a platform already received, and your membership of a remarketing audience lapses at the platform after 30 days under its own terms. Evidence: whenever you make, change or withdraw a choice in the banner, your browser sends our server one record (a random receipt id, the wording revision, the language, your two answers, the kind of action and the server's time; no IP address, user agent, page address, email or order), a granted category is activated only once that record is saved, and the record is deleted after 13 months. Rejections and withdrawals apply immediately whether or not it is saved. Global Privacy Control: if your browser sends the signal, Advertising counts as refused on every page, whatever an earlier choice said; you can still accept Analytics. If we change the wording, the categories or the vendors, the banner asks again. Payment happens on Stripe's own checkout pages (checkout.stripe.com), where Stripe's cookie policy applies. The StarBind app is a separate product with no analytics or advertising SDK; nothing in this section applies to it.
9. Security
TLS for all transport; encryption at rest; access to production data restricted to authorized staff; unguessable single-purpose tokens for downloads, shares, sign-in, and erasure links; rate limiting and Turnstile on abuse-prone endpoints. No method of transmission or storage is 100% secure.
10. Children
StarBind Reports is not directed at children. Charts for minors may only be purchased by a parent or guardian. We do not knowingly process a child's data outside of birth data supplied by their parent/guardian for a report.
11. Changes
We may update this policy. Material changes will be posted on this page with a new date and version; the version shown to you at purchase is recorded with your order, alongside the Terms version you accepted.
12. Contact
- Email: [email protected]
- Address: STORMVIBE Ltd. (EIK 208809995, VAT BG208809995), 27E Srebarna Street, Bldg. 7, Entr. A, Apt. A2, Lozenets District, Sofia 1407, Bulgaria
This Reports Privacy Policy was last updated on 2026-09-29.