Privacy Policy

Who we are

For businesses in the United Arab Emirates and the people they contact, the controller is Mintech Marketing Consultants Co. L.L.C, Office DSO-HQ-D2-209, 2nd Floor, Dubai Silicon Oasis Headquarters, Dubai, United Arab Emirates (Dubai Department of Economy and Tourism, licence no. 1195006). For all others it is DarT FZ-LLC, Ras Al Khaimah Economic Zone Authority (RAKEZ), Emirate of Ras Al Khaimah, United Arab Emirates (RAKEZ licence no. 45032124). You can reach both at support@starsfirst.com.

This policy covers three groups: businesses that use StarsFirst (our customers), the people who receive a message that such a business sends through StarsFirst (their customers), and the partners of our partner programme. For the information about the customers of a business, that business is the controller and we process it on its behalf.

Information about businesses and their staff

• Account details: business name, country and time zone, the e-mail addresses of the people who sign in and the owner's mobile number.
• The details of the business on Google Maps that the owner picks at sign-up (name, address, phone number, website, category, rating and number of reviews), and the public review count we check from time to time.
• Passwords are stored only in hashed form.
• Payment: card details are entered with our payment provider Stripe and are never stored on our servers. We keep the Stripe customer and subscription identifiers and the status of the subscription.
• Settings a business chooses, such as its Google review link, reminder days and sending hours.
• For the care of the Google Business Profile: the information and photos a business sends us for its profile, the verification code Google sends for it, and manager access to that profile for as long as the business grants it.
• The address the business cards are sent to.
• If a business cancels: the reason it gives and any note it adds.

Information about the customers of a business

A business enters this information to send a review request. We process it on behalf of the business and only to provide the service.

• First name (and last name, if the business enters it), mobile number or e-mail address, and the language of the message.
• The time at which the business recorded the person's consent, and which user recorded it.
• The messages that were sent and whether the link in a message was opened.
• Whether the person opted out.

We do not ask for addresses or details of the job. If a business sends us an invoice, a photo or a list so that we add the customers on it, we read the name, phone number and e-mail address from it and do not keep the file.

Messages

Messages are sent by text message, WhatsApp or e-mail, only to people for whom the business has confirmed consent. A request consists of at most three messages. Message and data rates may apply. Reply STOP to a text or WhatsApp message, or use the unsubscribe link in an e-mail, to stop receiving messages from that business through StarsFirst; reply HELP for help.

Mobile numbers and consent records are not sold, rented or shared with third parties for their marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third parties, except the text message delivery provider that sends the messages for us.

How we use information

• To send the review requests and reminders a business has asked for.
• To show the business which requests were sent and which links were opened.
• To honor opt-outs.
• To keep the Google Business Profile of a business up to date at its request.
• To bill the subscription and to keep the service secure.

We do not use this information for advertising and we do not build profiles of the people who are messaged.

Partners

For partners of our partner programme we store the name, e-mail address, phone number, the partner who recruited them, the businesses that signed up through their link with the payments the commission is based on, and the bank details they enter for the transfer of their commission. Bank details are stored encrypted and used only for that transfer. We keep this information while the partnership lasts and afterwards as long as the law requires for accounting.

Service providers

We use these service providers. They may process information only on our instructions and for the purpose named: Vercel (hosting), Neon (database), Stripe (payment), Resend (e-mail), Twilio (text messages), Meta (WhatsApp messages and, with your consent, measuring our ads), Gelato (printing and shipping business cards), Google (finding a business on Google Maps at sign-up and reading its public review count) and Anthropic (reading the customer name, phone number or e-mail address from invoices, photos and lists a business sends us, and drafting answers to support e-mails). Anthropic does not use this information to train its models.

Where the information is stored

Our service providers store and process information in the United States and the European Union. We use providers that protect it under contract and in line with the law that applies to the transfer.

Cookies

We use the cookies the service needs: one that keeps you signed in, one that remembers which country's website you chose, one that remembers your answer to the ads question below, and, if you arrived through the link of a partner, one that remembers that partner for 60 days.

On our pages for the United Arab Emirates we ask whether we may use cookies of Meta (Facebook and Instagram) to see which of our ads bring visitors. Only if you say yes, the Meta pixel loads. It tells Meta that you visited our pages, ran the free profile check, asked for its report by e-mail, started the sign-up or paid for the subscription (with its amount), together with your IP address, your browser, the Meta cookies and, for the report, the sign-up and the payment, your e-mail address in hashed form. We send the same events from our server as well, so Meta counts them once even when the browser blocks the pixel. We use this only to measure and improve our ads. Meta processes the information as described in its own privacy policy. If you say no, nothing is sent to Meta. Your answer is kept for a year; to change it, delete the cookie sf_ads in your browser.

When you open our pages through a link with campaign details (for example from an ad or an e-mail), your browser keeps those details for the visit, and we store them with a profile check or a sign-up, so we know which of our ads and messages work.

Security

Connections are encrypted, passwords are stored only in hashed form and bank details of partners are stored encrypted. Only the people who run StarsFirst have access to the information, as far as their work needs it.

Retention

• The information about a person who was asked for a review is kept for as long as the business has an account, so that nobody is asked twice and an opt-out stays in force for as long as the business uses the service.
• When a business closes its account, its data and the data of its customers are deleted within 30 days, and from backups within a further 30 days.
• Invoices and payment records are kept for as long as tax and accounting laws require, currently up to seven years.

Your rights

If you received a message, you can opt out at any time by replying STOP, using the unsubscribe link, or telling the business. You can ask for access to your information, for its correction or deletion, or object to its use. Contact the business that sent the message or write to us at support@starsfirst.com; we answer within 30 days. In the United Arab Emirates you can also complain to the UAE Data Office.

Changes

If this policy changes, the new version is published on this page with a new date.