Privacy policy

Controller: Steloria – Matej Batinić, Via Vallone 19, 6500 Bellinzona. For any question about privacy: info@steloria.ch.

For the customer data that a business enters in Steloria, the controller is the business itself: we process it on its behalf and according to its instructions (art. 9 FADP, art. 28 GDPR).

Free analysis: the name of the business you search for and the public data of its Google profile (rating, reviews, nearby competitors), read through Google Maps Platform.

Free report by email: the email you leave us, the language, the business analysed and its score, to open the full report for you and send it to you and, only if you also tick the second box (optional, the report does not need it), to write to you and introduce Steloria. You can withdraw that consent at any time, with the link in any of our emails or by writing to us.

Free monthly check: with the report we save, still switched off, the monthly check of the same business: your email, the language and the public Google data of the analysis (name, rating and number of reviews of your business and of nearby businesses in the same trade). It starts only if you turn it on from the link in the email: then once a month we read that data again on Google and write to you only if something has changed. You turn it off from the link in every email.

Postcards: we sometimes post a card to a local business with its Google reviews and those of businesses in the same trade nearby. To make it we save a short code, the place ID on Google, the business's public name and address, the language, the printed numbers, how often the code was opened and how many reports were requested. The QR code and the link carry only the code, never the name. Of the opens we count only the number, not who opens. If you want no more post from us, write to us and we will send you none.

IP address: it is used only to limit abuse (number of requests per hour) and we delete it by the next day at the latest.

Statistics: Vercel Web Analytics counts the public pages visited, without cookies and without profiles. It does not receive what you search for and does not count the owners' dashboard or the pages sent to customers.

Results: from the Google review counts we calculate anonymous totals and averages across all businesses, shown on our page only once there is enough data. A business's name, town and result appear only if the owner turns this on in the dashboard, and disappear as soon as it is turned off.

Account: your email (you log in with a link by email, no password), the language and the business details: name, address, Google profile, logo and the texts of the customer page.

Cookie: only one, a technical one (steloria_session), which keeps you logged in for 30 days or until you log out. No advertising cookies. Some preferences, such as large text, stay only in your browser.

Payments: handled by Stripe. We neither see nor store card details; we keep the plan and the status of the subscription.

Google reviews: we read the public reviews of your profile (author's name, rating, text) to show them to you and prepare replies.

Drafts with artificial intelligence: for a reply we send Mistral AI the rating, the author's first name and the text of the review; for a post, the topic you write. You decide whether to use them. For the review analysis (Pro plan) we send the rating, text and date of Google reviews and of your customers' feedback, with no names or contacts.

Help assistant: we send Mistral AI your question, the conversation so far and our guides; in the dashboard also the plan, the quotas used and the account's settings, never your customers' names, phone numbers or emails. We remove email addresses and phone numbers written in the question first. The conversation stays in the browser tab: we keep the question and the answer only if you answer “Solved?” or write to the founder, for 12 months. The email you leave for a reply and messages from “Write to us” reach the founder by email; we do not store them in the app.

Public customer map: on the home page every business is a star, at a position rounded to about 10 km, with no name or address. The name and town appear only for founders who choose so.

Customer stories: if you choose to tell your story, with your consent we publish on steloria.ch the text, the business name, the town, your name or role if you write it and the numbers you choose, which we count. Before it goes live only the founder reads it, after an email, and can only approve or reject it, never change it. You can withdraw it whenever you like from the dashboard: we delete it at once and it disappears from the site.

The business gives us your name, your phone number or email, the service and the date of your visit: entered by hand, from a file or from its booking system.

We store the status of the request (sent, opened, review left) and what you choose to write on the page: rating, message, name, contact details, photo or video. We record the opening only when you tap something on the page, not when it simply loads.

Texts are sent through Twilio, emails through Resend. WhatsApp is sent by the business from its own phone. If the business turns it on, you receive at most one invitation to come back every 3 months.

The link to Google always stays visible, whatever rating you give. With the link to stop receiving messages, that business no longer writes to you, on any channel: we keep your contact details only on this list, so that we can respect it.

To exercise your rights you can contact the business or us: we pass the request on.

Vercel: hosting and statistics; the service runs on servers in Frankfurt (EU).

Supabase: database and files, in a data centre in Europe.

Resend: email. Twilio: texts. Stripe: payments and invoices.

Google Maps Platform: public data of Google profiles. Mistral AI (France): drafts of replies and posts, review analysis, help assistant.

Some providers are based in the United States: there the transfer is protected by standard contractual clauses or by the Data Privacy Framework, as the FADP and the GDPR require. We do not sell data and do not use it for advertising.

Contract for the account and the service (art. 6(1)(b)), legitimate interest for security, limiting abuse, statistics without profiles and postcards to local businesses (point f), consent for the waiting list, the free monthly check and customer stories (point a), legal obligation for accounting (point c). For the customers of businesses, the basis is set by the business.

Account and business data, including its customers: as long as the account is active; after cancellation we delete it within 30 days of the request.

Customer stories: until you withdraw yours; we delete it at once when you withdraw it or when we delete the account. A rejected story is not published and only you see it in the dashboard, until you withdraw it.

Accounting records: 10 years, as required by the Swiss Code of Obligations (art. 958f CO).

Free report by email: until you ask to be removed; if you unsubscribe, the entry stays marked as unsubscribed, so we never write to you again. Free monthly check: until you turn it off, and then we delete it at once; if you never turn it on, we delete it after 30 days. Postcards: 12 months; if you ask for no more post, we keep only the place ID and the name, so we never write again. IP address: by the next day at the latest. List of people who want no more messages: as long as the business's account exists.

Fingerprints (hashes) of the email, Google profile and phone number of a business that used the free trial: we keep them even after the account is deleted, only to recognise a second trial.

Encrypted connections (HTTPS), login with a link valid only once, links and sessions stored only as a fingerprint (hash), customer files in private storage.

You can request access, correction, deletion, restriction and portability, and object to processing, by writing to info@steloria.ch. We reply within 30 days.

You can also contact the Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, the supervisory authority of your country.

If we change this policy, we update the date at the top.