Privacy Policy

Who we are

Stellerj — operating from the United States. For the purposes of the UK GDPR and EU GDPR, Stellerj is the data controller for the personal data described in this policy. A registered postal address will be added once Stellerj is incorporated.

You can reach us at legal@stellerj.com with any questions about how we handle your data.

What data we collect

If you accept our cookie banner, we collect analytics data through PostHog: the pages you visit, how you arrived here (the address of the page that linked you, or the campaign parameters on the link you followed), approximate geographic region derived from your IP address, and standard device information such as browser type and screen resolution.

We also record how a page is used: what you click on and the visible words on the thing you clicked, where your mouse moves and where clicks land on the page, when you interact with a form field, and how quickly pages load and respond. Knowing which parts of a page people actually use is the reason we measure anything at all.

We also keep a replay of your visit — a re-creation of the pages as you saw them, and what you did on them, that we can play back afterwards. We watch these to find the places where the site is confusing or broken, and fix them. It is the closest thing we have to sitting beside a visitor, and it is why the site gets easier to use over time.

There are limits on all of this, and they matter more than the list above. We do not receive what you type into a text box: the replay hides the contents of form fields, and password fields are excluded outright, before anything leaves your browser. PostHog works out the rough region from your IP address and then discards the address; it is not stored with the analytics.

We do not collect your name, email address, or any information that directly identifies you.

We do not use this data for advertising, profiling, re-identification, or any purpose other than understanding how visitors use the site so we can improve it.

Hosting and server logs

This site is hosted and delivered by Vercel. To send you a page and to keep the site secure, Vercel records each request in its server logs: your IP address, the identifying text your browser sends about itself, the page you asked for, and the time you asked for it.

This happens on every visit, regardless of the choice you make in the cookie banner, and it happens before that banner appears. It is not analytics and it is not something you can turn off here — a website cannot send you a page without knowing where to send it. We rely on our legitimate interest in running and protecting the site, under Article 6(1)(f) of the UK GDPR and EU GDPR.

We do not use these logs to build a profile of you, and we do not combine them with the analytics described above. How Vercel handles the data is described in Vercel's Privacy Notice.

International transfers

PostHog processes analytics data on our behalf in the United States. Transferring personal data outside the EU and UK requires a recognized legal safeguard, which we name explicitly here so the transfer mechanism is verifiable from this policy alone.

For visitors in the EU, the transfer to the US is covered by the EU Standard Contractual Clauses (Module 2, controller-to-processor), incorporated into PostHog's Data Processing Agreement.

For visitors in the UK, the transfer is covered by the UK Addendum to the EU Standard Contractual Clauses, issued by the Information Commissioner.

Both instruments are available in PostHog's Data Processing Agreement.

Vercel hosts this site in the United States, so the server-log information described above is processed there too. Vercel's Data Processing Addendum incorporates the EU Standard Contractual Clauses.

Lawful basis

We process analytics data on the basis of your consent, under Article 6(1)(a) of the UK GDPR and EU GDPR. No analytics data is collected unless and until you explicitly accept the cookie banner.

You have the right to withdraw consent at any time under Article 7(3). Withdrawing consent does not affect the lawfulness of any processing that took place before withdrawal. See our Cookie Policy for how to do this.

The accept-or-decline record itself rests on a different basis. Remembering a preference you have expressed is strictly necessary to honor your answer — asking your consent to store a refusal would be circular. To the extent that record is personal data at all, we rely on our legitimate interest in respecting your choice, under Article 6(1)(f).

Retention

Analytics data is retained by PostHog for up to one year from collection on our current PostHog plan. Session replays are kept for a shorter period — up to 30 days — after which they are deleted.

When you withdraw consent, no new data is collected. To request deletion of previously collected data, contact us at legal@stellerj.com.

Your rights

Under Articles 15 through 22 of the UK GDPR and EU GDPR, you have the right to: access the personal data we hold about you (Article 15); have inaccurate data corrected (Article 16); request erasure of your data in certain circumstances (Article 17); restrict how we process your data (Article 18); receive your data in a portable format (Article 20); and object to processing (Article 21).

To exercise any of these rights, email legal@stellerj.com. We will respond within the time limits Article 12(3) sets. Where a request is particularly complex or where you have made a number of requests, Article 12(3) allows that period to be extended; if we ever need an extension, we will tell you before the initial period runs out and explain why.

If you believe we have not handled your data correctly, you also have the right to lodge a complaint with a supervisory authority. In the UK, that is the Information Commissioner's Office (ICO). In the EU, your national data protection authority — a directory of EU/EEA authorities is available from the European Data Protection Board.

California residents

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA") may apply to your personal information. We extend the disclosures below to all visitors regardless of whether it does.

We do not sell or share personal information as those terms are defined under the CCPA/CPRA. PostHog acts as our service provider under a written agreement that limits PostHog to processing the analytics data for our purposes only; that contractual relationship is excluded from the CCPA/CPRA definition of "sale" and "sharing".

If you are a California resident and would like to exercise any rights you may have under the CCPA/CPRA, including the right to know, delete, or correct personal information, contact us at legal@stellerj.com.

How we protect your data

Data travels between your browser and this site, and between your browser and PostHog, over encrypted connections. Access to the analytics data is limited to the people who run the site.

Automated decision-making

We make no decisions about visitors by automated means that produce legal effects or similarly significant effects.

Do Not Track and Global Privacy Control

Some browsers send signals such as Do Not Track or Global Privacy Control to ask sites not to sell, share, or track. We do not sell or share personal information, and no analytics runs without your consent — so the outcome these signals request is already the default for every visitor, whether or not their browser sends one. Nobody is followed across other sites through this one.

Children

This site is not directed to children, and we do not knowingly collect their data.

How to contact us

For any privacy-related queries, to exercise a data subject right, or to request deletion of your analytics data, contact us at legal@stellerj.com.

Changes to this policy

We may update this policy as our service evolves. When we do, we will update the "Last updated" date at the top of this page. If changes are material, we will take reasonable steps to bring them to your attention.

If the legal mechanism for transferring UK data to third countries changes — for example following any revision to UK adequacy regulations or replacement of the UK Addendum — we will update this policy accordingly.