Privacy Policy

1. Who We Are (Data Controller)

Star Pilot (https://starpilot.it) is an automated customer review platform designed for local businesses such as restaurants, barbershops, tattoo studios, salons, and clinics. For personal data processed through our website, mobile interface, and review pipeline, Star Pilot operates as the Data Controller in accordance with the EU General Data Protection Regulation (GDPR).

If you have questions about this Privacy Policy or your data, you can contact us directly at:

2. What Data We Collect

We collect and process minimal data categorized into two groups:

A. Business Owners and Staff

• Account Information: Business name, business address, operator contact email, manager telephone number.
• Service Configuration: Official Google Business Profile Place ID / review link destination, messaging delay preferences (e.g., 2h, 3h, 4h, 24h).
• Staff Authentication: Fast employee access codes or credentials used solely to access the counter reservation ledger.

B. Customers of Participating Businesses

• Reservation Details: Customer name or nickname, mobile telephone number, booking date and time, and optional booking notes (such as party size or service) entered by front-desk staff.
• Feedback & Ratings: 1-to-5 star rating selections, voluntary written comments, and submission timestamps submitted on the rating page.
• Interaction Metadata: Single-use token validation status, message delivery receipt flags via Meta WhatsApp Cloud API, and standard web browser user agent strings for responsive layout rendering.

3. How We Use Your Data

We process collected data exclusively for the following operational purposes:

• Automated Review Dispatch: Transmitting an official, Meta-approved WhatsApp template message to the customer after their visit containing a secure rating link.
• Rating & Private Feedback Collection: Enabling customers to rate their experience via a frictionless web interface without requiring passwords or application downloads.
• Google Review Redirection: Providing customers with a direct link to the business's public Google Maps listing in strict compliance with Google's non-gating review policies.
• Dashboard & Service Insights: Displaying reservation statistics, response rates, and customer comments inside the business owner's password-protected dashboard to help them improve service operations.
• Preventing Unwanted Messages: Synchronizing cancellations and no-shows so customers are never messaged if their booking did not take place.

4. Legal Bases for Processing (GDPR)

Under Article 6 of the General Data Protection Regulation (GDPR), we process your data under the following legal bases:

• Performance of Contract (Art. 6(1)(b)): Providing the review automation service requested by our business subscribers.
• Legitimate Interests (Art. 6(1)(f)): Enabling businesses to gather customer satisfaction insights, protect customer sentiment, and improve their service.
• Consent (Art. 6(1)(a)): Where customer contact information is recorded at the counter with customer consent, and when customers choose to submit voluntary feedback on the rating screen.

5. Third-Party Processors & Integrations

We partner with industry-standard, secure infrastructure providers strictly necessary to deliver the service:

6. Data Security & Cryptographic Tokens

We implement defense-in-depth technical safeguards to protect all data:

• All HTTP traffic is encrypted using Modern Transport Layer Security (TLS 1.3 / HTTPS).
• Customer rating links employ 43-character cryptographically random, unguessable tokens with expiration and single-use validation.
• Administrative dashboards require authenticated session credentials with role-based access separation between counter staff and owners.

7. Data Retention & Erasure

We hold personal data only for as long as necessary to fulfill the service:

• Active Tokens: Customer rating tokens expire after their active collection window.
• Reservation Phone Numbers: Retained only for the duration needed to dispatch the scheduled WhatsApp message and allow owner follow-up, after which they are eligible for automated anonymization.
• Cancelled Reservations: If staff marks a booking as cancelled or no-show, outbound message triggers are instantly discarded.

8. Your Rights Under GDPR

If you are a resident of the European Economic Area (EEA) or United Kingdom, you hold the following rights:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten"): You can request the complete deletion of your personal data from our systems.
• Right to Restriction & Objection: You can object to or request restriction of our data processing.
• Right to Data Portability: You can receive your data in a structured, machine-readable format.

To exercise any of these rights, visit our dedicated Account & Data Deletion Instructions or email us at hello@starpilot.it.

9. How to Request Account or Data Deletion

Whether you are a participating business owner or a customer who received a review invitation, you can request total deletion of your records at any time. We process and confirm all verified deletion requests within 30 days without charge.

10. Contact Us

For questions, concerns, or data protection inquiries regarding this policy:

Star Pilot Support: hello@starpilot.it
Direct Phone: +39 366 508 9382