# Starlight > Complete reference for Starlight, business development as a subscription. This file contains the product overview, current pricing, FAQs, every help center page, and the legal documents concatenated into a single markdown document for LLM ingestion. See https://joinstarlight.com/llms.txt for the indexed version and https://joinstarlight.com/changelog.md for release notes. --- ## What Starlight is Starlight is business development as a subscription. We take over your outbound completely: personalized outreach on email and LinkedIn from your own accounts, follow-ups, replies, and qualified meetings on your calendar. Live within 36 hours or a full refund. $2,800 a month, pause or cancel anytime. Key facts: - **Category:** business development as a subscription (a done-for-you outbound service, an alternative to hiring an SDR or retaining an agency). - **Price:** $2,800 per month, billed monthly through Stripe. No annual plan, no setup fee, no minimum term. Pause or cancel anytime. - **Guarantee:** Live within 36 hours or you get a full refund, no questions asked. We never promise a specific number of meetings, pipeline, or revenue. - **Who it's for:** founder-led b2b saas companies, boutique agencies, consultants with high-value offers, b2b service companies, lean sales teams. Best with a clear offer, a known buyer, deal sizes that justify outbound, and someone ready to take the meetings. - **How it works:** the customer signs up, finishes a short setup (website, LinkedIn, the email account and LinkedIn account outreach goes from, calendar, a note on who they want to meet), and Starlight runs their outbound: targeting, research, personalized email and LinkedIn outreach sent from the customer's own accounts, follow-ups, reply handling, and meeting booking. The customer takes the calls. - **What is included:** we learn your business; we find your next customers; we write outreach people answer; we follow up until it lands; we handle the busywork; we fill your calendar; we keep getting better. - **Reporting:** a private portal showing volumes and outcomes (messages sent by channel, people reached, replies, meetings booked and upcoming) plus a short update from Spencer every Friday. - **How to buy:** Sign up at https://joinstarlight.com/checkout (Stripe Checkout), or book a 15 minute intro call from the home page. ## Pricing One subscription: $2,800 per month. No annual plan, no setup fee, no minimum term. Pause or cancel anytime. Live within 36 hours or you get a full refund, no questions asked. Included: - Website and LinkedIn business discovery - Ideal-customer and targeting strategy - Ongoing account and contact research - Verified and prioritized prospect data - Personalized outreach in your voice - Email outreach from your Gmail or Outlook - LinkedIn outreach from your LinkedIn - Multi-touch follow-up - Reply monitoring and triage - Meeting qualification and calendar routing - A private portal with volumes and outcomes - Native booking and scheduling - A Friday update every week - Ongoing campaign optimization - Your campaign assets, learning, and relationship history ## Frequently asked questions ### What does Starlight actually do? We run your business development. We find your best-fit buyers, write personalized outreach in your voice, handle every follow-up and reply, and book qualified meetings on your calendar. You just take the calls. ### How fast will my outreach go live? Within 36 hours of your kickoff call with Spencer. If it isn't, you get a full refund. ### How does onboarding work? It takes about twenty minutes. Share your website, connect your email, calendar, and LinkedIn, tell us who you want to meet, and book a short kickoff call. We handle everything from there. ### Whose accounts do the messages come from? Yours. Email sends from your Gmail or Outlook and LinkedIn from your own profile, so every reply and every relationship stays with you. Your LinkedIn access is encrypted and you can revoke it anytime. ### What does a typical week look like? Outreach and follow-ups go out every business day, replies get handled as they come in, and meetings land on your calendar with prep notes. Every Friday, Spencer sends you the numbers. ### Do you guarantee meetings? We guarantee you're live within 36 hours or a full refund. From there, your outbound is run and improved every single week, so it keeps getting sharper. ### How do I pause or cancel? One click in your settings. No contract, no minimum term. Your playbook will be waiting whenever you come back. ### Are there any refunds? Yes. If your outreach isn't live within 36 hours of setup, ask within seven days of your payment and we refund it in full, no questions asked. ### Who is Starlight for? Founders, lean sales teams, agencies, and consultants with a strong offer and a clear buyer. We fill your calendar. You close the deals. --- # Documentation # Getting started Sign up, sign in, ten onboarding steps, and what happens in the first 36 hours. Starlight takes business development off your plate. You subscribe, spend about fifteen minutes on setup, and personalized email and LinkedIn outreach goes out in your name until qualified meetings land on your calendar. This page is the whole path from sign up to live. #### 1. Sign up Sign up at [joinstarlight.com/checkout](/checkout). Payment is $2,800 a month through Stripe, with no setup fee, no annual plan, and no minimum term. You can pause or cancel any time. #### 2. Sign in with the same email After payment you land on a welcome page. Sign in with the exact email you paid with (Google, or a magic link sent to your inbox). Your account is created from the payment, so there is nothing else to register. #### 3. Finish onboarding Onboarding is eight short steps with a guide to walk you through them: your company, what you sell (Starlight scans your website), who you buy from, your LinkedIn profile, connect email, connect calendar, LinkedIn, and booking your kickoff call. #### 4. Kickoff call A 20 minute call with Spencer in the next couple of days. You and Spencer agree who to reach and what to say, and he signs in to your LinkedIn with you, so keep your phone close in case LinkedIn texts a code. If you use text codes, he also helps you switch to an authenticator app so you never have to send one again. #### 5. Live within 36 hours of the call Spencer researches your buyers, writes the first outreach in your voice, and starts sending from your accounts. The first personalized messages go out within 36 hours of the kickoff call or you get a full refund. See [the 36 hour guarantee](/docs/your-starlight/the-36-hour-guarantee). ## What Spencer needs from you - The Gmail or Outlook account outreach should come from, connected with a secure sign in - Your calendar, so meetings land where you will see them - Your LinkedIn login, entered in onboarding, and 20 minutes on the kickoff call so Spencer can sign in with you (see [LinkedIn and email access](/docs/your-starlight/linkedin-and-email-access)) - A sentence or two on who your best customers are ## What happens in the first 36 hours - Spencer reads your website and LinkedIn and builds a plain language picture of what you sell and who buys it - He picks the first audience and the angle to lead with - He writes the first batch of personalized messages in your voice - Outreach starts going out from your email and your LinkedIn - Spencer emails you when setup is done, and again once your outreach is running - You see volumes on Home the same day, and your first weekly update the following Friday > **Tip:** The more you share in the notes step (a customer story, a favorite past email, who to avoid), the sharper the first batch. You can always add more from Settings. --- # Your portal Home, Calendar, Metrics, Connectors, Notifications, and Settings. Your Starlight portal is a calm view of the work being done for you. It shows what is in motion, how much is going out, what came back, and what is on the calendar. It is built for reassurance and account management, not for operating anything. There is no approval step and nothing for you to run. ## Home - A greeting with your outreach status and quick links to your calendar and metrics - This week at a glance: messages sent by channel, replies, and meetings coming up, each with an eight week trend or your next meetings - Updates from Spencer, with the latest weekly email in full and earlier ones a click away - Recent activity as it happens: new prospects, connections accepted, and replies - Your outreach plan: the audience and angle running right now, plus what Spencer has learned about your offer and best-fit buyers ## Calendar Every meeting Starlight booked for you, in agenda, week, and month views, with prep notes where there are any. The top of the page shows your next meeting and how many are coming up in the next 7 days. Editing or cancelling a meeting here updates the guest. ## Metrics Messages sent by channel, replies, and meetings booked, for this week and since you joined, each with an eight week trend. Below that, a chart of the last eight weeks and a breakdown of how people reached turned into replies, positive replies, and meetings. ## Connectors Your email, calendar, and LinkedIn: see status, reconnect, update, or revoke. Connect your CRM (HubSpot, Salesforce, or Attio) too, and if you ever stop working with Spencer, he exports every contact and note into it. ## Notifications Replies, meetings, and updates as they happen. Each one links to the right place. ## Settings Profile, company, notifications, security, billing (pause, cancel, request a refund), and support. > **Info:** You see volumes and outcomes, never the text of individual messages going out in your name. That is deliberate: the service is hands off, and the weekly update tells you what is being said and to whom. --- # LinkedIn and email access Whose accounts send, what we ask for, how it is protected, and how to revoke it. Outreach goes out from your own accounts, because that is what works. Prospects see your name, your email, and your LinkedIn profile. This page explains exactly what access Spencer asks for, how it is protected, and how to take it back. ## Email Connect the Gmail or Outlook account outreach should come from. This is a standard Google or Microsoft sign in; Starlight never sees your email password. The connection is used to send messages and to read replies to those messages. You can disconnect from Connectors at any time, or from your Google or Microsoft account. ## Calendar Connect Google Calendar or Outlook Calendar so booked meetings land where you will see them, and so you are never offered a time you are busy. ## LinkedIn LinkedIn has no equivalent sign in for a service like ours, so you share your LinkedIn login with Starlight the same way you would hand it to a consultant running your LinkedIn. You enter it once, in onboarding or later from Connectors. Spencer signs in for the first time with you on your kickoff call, from his own browser, and runs the outreach there. - Only Spencer uses it. Nobody else at Starlight signs in to your account - Your login is encrypted the moment you save it and is never shown back in the portal. Spencer reveals it only when he needs to sign in, and every reveal is written to an audit log - Once he is signed in, the browser session is saved encrypted too, so he does not need to sign in again each time and LinkedIn does not see a new device every week - Change or revoke access any time from Connectors. Revoking deletes the stored login and session right away. Changing your LinkedIn password has the same effect ## Verification codes The first time Spencer signs in from a new device, LinkedIn may email you a verification code. If the email comes to the inbox you connected, Spencer can read just that code from his side, so you usually do not have to do anything. It usually happens once. ## Two factor authentication Keep two factor on. You never need to turn it off for Spencer. Tell him how your codes arrive, in onboarding or from Connectors: - Authenticator app: when you set it up in LinkedIn, scan the QR code with your own app as usual and also paste the setup key LinkedIn shows into Starlight. Your app and Starlight then make the same codes, so Spencer can sign in without asking you for one. Already set up? Copy the key from your password manager, or turn authenticator two factor off and straight back on in LinkedIn, which takes about a minute. The key is encrypted, never shown back, and Spencer only ever sees the current code, with every read logged - Text message: LinkedIn texts codes that expire in minutes, so the first sign in happens live on your kickoff call and you read the code out. On the same call Spencer can help you switch to an authenticator app, so later sign ins never need you. If LinkedIn does text you later, Spencer emails you and a box appears in Connectors: type the code there and it goes straight to Spencer, once. The box closes after 10 minutes There is also a notes field for anything Spencer should know, shown to him alongside your login. > **Info:** Sending stays within LinkedIn's normal limits for one person. Spencer never signs out of your LinkedIn in the browser, and never posts, comments, or connects on your behalf beyond the outreach he is running for you. The formal wording is in the [Privacy Policy](/privacy). --- # Your weekly update The Friday email: what it says and where the numbers come from. Every Friday around 3pm your local time, Spencer sends you a short status email. It is written to be read in under a minute: a few lines on how the week went, a table of the numbers, and a sentence on what happens next week. ## What the table covers Each row shows this week and the total since you joined. | Row | What it counts | | --- | --- | | Emails sent | Outreach emails sent from your connected mailbox | | LinkedIn messages | Messages and InMails sent from your LinkedIn | | Connection requests | LinkedIn connection requests sent | | People reached | Distinct people who received at least one message | | Replies | Replies received on email and LinkedIn | | Positive replies | Replies that showed interest or asked for a time | | Meetings booked | Meetings that landed on your calendar this week | | Meetings coming up | Meetings scheduled for next week | ## The first week - When volume is still low, the update explains what Spencer set up, who he is targeting and why, and what goes out next week - Every number in the email comes straight from your account. Nothing is rounded or estimated - You can reply to the email. It goes to Spencer > **Info:** Every weekly update also appears on your Home page, so you can scroll back through them at any time. --- # Billing and pausing $2,800 a month, monthly only. Pause, cancel, resume, refunds. Starlight is one subscription: $2,800 a month, billed through Stripe, renewing monthly until you pause or cancel. Monthly only. No annual plan, no setup fee, no minimum term, and nothing on top. Everything Spencer does for you is included. ## Where to manage it Settings, then Billing. Your renewal date, invoices through the secure Stripe portal, and the pause, cancel, and refund controls all live there. No call required. ## Pausing Pause from Billing. Outreach stops at the end of the current billing period and you are not billed again while paused. Your account, history, and everything learned so far stay in place, so resuming picks up where things left off. Resuming starts a fresh monthly period. ## Canceling Cancel any time from Billing. The service stays active through the end of the current period, then outreach stops and you are not billed again. You keep access to your portal and data under the retention terms. ## Refunds - If your outreach is not live within 36 hours of your kickoff call, request a full refund of your first payment, no questions asked. See [the 36 hour guarantee](/docs/your-starlight/the-36-hour-guarantee) - The refund control is on your Billing page for the first 7 days after your first payment. You can also reply to your welcome email - After the first week, payments are non refundable, but you can pause or cancel at any time to stop future renewals > **Tip:** Pausing is the right move for a busy delivery month. Canceling is the right move if you are done. Both take one click and neither needs a conversation first. The formal policy lives in the [Terms of Service](/terms). --- # Data and security How staff access works, what is encrypted, and what is audited. Running your business development means Spencer works inside your account on your behalf. That access is deliberate, visible, and revocable. Here is exactly how it works. ## How we access your account - Only Starlight staff can open a customer account, through an internal surface protected by its own role system - When we open your account we act as you for sending and booking, so messages come from your mailbox and meetings land on your calendar. Every action is recorded against the staff member who took it - Every entry, exit, credential reveal, and sensitive action is written to an append only audit trail - One login per business. There are no team invites, and staff never appear as members of your company ## Your credentials - Email and calendar connect through Google or Microsoft sign in. Starlight never sees those passwords - Your LinkedIn login, your authenticator setup key if you share one, and, once Spencer is signed in, the LinkedIn browser session are stored with the same AES-256-GCM encryption as your email tokens. The login and session are never returned to a browser except through an audited staff reveal, the setup key never leaves our servers at all (Spencer sees only the current code, and each read is logged), and revoking access from Connectors deletes all three - Every connection can be revoked from Connectors at any time ## Your data Your targeting, messaging, prospect list, reply history, and account context stay tied to your account under the terms, privacy policy, and retention terms. If you leave, connected account authorizations are revoked and staff LinkedIn access ends as part of offboarding, and you can delete the account from Settings. > **Info:** The formal documents: [Terms of Service](/terms), [Privacy Policy](/privacy), [Security](/security), and [Data Processing Addendum](/dpa). --- # The 36 hour guarantee Live within 36 hours or a full refund, no questions asked. You are live within 36 hours of your kickoff call, or you get a full refund of your first payment, no questions asked. That is the one guarantee Spencer makes, and he makes it because launching fast is the part he controls. ## What live means Live means the first personalized outreach has gone out from your accounts: real messages to real prospects, sent from your connected mailbox or your LinkedIn. Not a plan, not a draft, not a kickoff call. ## When the clock starts - The last onboarding step is booking a kickoff call with Spencer, in the next couple of days. The 36 hours start when that call ends - If you move the call, the clock moves with it - If Spencer is waiting on something from you (an email connection, a LinkedIn verification code, a two factor change), the clock pauses until it arrives, and he tells you exactly what is missing ## How to claim it - Open Settings, then Billing, and press Request a refund. The control is there for the first 7 days after your first payment - Or reply to your welcome email or any weekly update - The refund covers your first monthly payment in full and ends the service ## What is not guaranteed Nobody honest can promise you a number of meetings or a revenue figure from cold outreach. What Spencer promises is that your outbound is live fast, actively managed, thoughtfully targeted, and improved every week, and that you can pause or cancel the moment it stops earning its keep. > **Info:** The formal wording is in the [Terms of Service](/terms) under Subscription and Billing. --- # Calendar View meetings, sync calendars, and get AI-generated meeting notes. The Calendar page shows the meetings Starlight booked for you in one place, alongside events synced from your connected calendar provider. ## Calendar Views Switch between four views depending on your preference: | View | Description | | --- | --- | | **Agenda** | Monthly timeline list of upcoming meetings | | **Month** | Traditional calendar grid | | **Week** | Weekly schedule with hourly breakdown | | **Day** | Single-day view with detailed time slots | ## Calendar Integrations Connect a calendar provider: - [Google Calendar](/docs/integrations/google-calendar), a two-way sync through your Google sign in - [Outlook Calendar](/docs/integrations/outlook-calendar), a sync of your Microsoft 365 calendar through your Microsoft sign in Meetings booked through Starlight appear here even when you have not connected a calendar provider. Cancel or reschedule them from the meeting itself so the guest is emailed and the time slot is released. ## Meeting Details Each meeting shows: - Time and duration - Attendee names (linked to your contacts when matched) and their RSVP status - Meeting title, description or agenda, and location - The video platform (Google Meet, Zoom, and more) at a glance - Meeting notes Editing a meeting that came from a booking page reschedules the booking itself, so the guest is emailed and the old time is released back into your availability. Cancelling works the same way. ## Meeting Prep Sheet Click a meeting to open the prep sheet, which includes: - **Attendee profiles**: matched against the people we have reached for you - **AI meeting notes**: summaries and talking points, with links to the web sources they draw from - **Preparation guidance**: key topics and context for the call Navigate between meetings with previous/next buttons. ## AI Meeting Notes Starlight prepares notes for your upcoming meetings each morning, and you can refresh them on demand with **Generate prep** in the meeting prep sheet. Prep is written from what we know about the person on the invite: their role, company, how they were found, and the conversation that led to the meeting. If we only have an email address, Starlight looks the person up in its business data provider first and uses whatever it finds. ## Follow-Up Email When a meeting with prep ends, Starlight drafts a short thank-you and next-steps email for the attendee, grounded in that meeting's notes, with no re-pitching. Spencer reviews it before it goes out from your mailbox. --- # Metrics Track your outreach performance with visual analytics. The Metrics page shows how your outreach is performing: messages sent by channel, people reached, replies, and meetings, for this week and since you joined, with a simple trend. ## Key Statistics At the top of the page, you'll see snapshot metrics with trends: - **Messages sent**: emails, LinkedIn messages, and connection requests sent in your name - **People reached**: distinct people who received at least one message - **Replies**: replies received on email and LinkedIn, with the reply rate - **Meetings booked**: meetings that landed on your calendar - **Meetings upcoming**: meetings scheduled in the coming days ## Pipeline Breakdown A gauge showing how your leads are distributed across the 6 pipeline stages (New, Contacted, Engaged, Responded, Meeting Booked, Converted). Quickly spot bottlenecks in your funnel. ## Outbound Funnel A funnel chart tracking how leads convert through each stage of your pipeline. See where drop-off happens and optimize your approach. ## Trend Chart A time-series graph of messages sent and replies received, so you can track improvements week over week. ## Activity Heatmap A visual grid showing when your outreach activity is highest. Use this to identify your most active days and times. ## Interaction Globe A spinnable 3D globe plotting where your interactions with potential customers are happening around the world. Every email sent, LinkedIn message, reply received, and meeting booked is placed at the prospect's location; drag the globe to explore. Locations with multiple leads roll up into a single counted badge. ## Reach-Out Touches A per-contact view of every touch in your campaigns, which channel each one used, and how prospects engaged, so you can see how your cadences actually play out. --- # Notifications Stay on top of messages, replies, meetings, and block usage. Starlight sends notifications to keep you informed about important events. Access them from the **Notifications** icon in the sidebar. ## Notification Types | Type | Description | | --- | --- | | **Message Sent** | Confirmation that your outreach was delivered | | **Reply Received** | A prospect replied to your message | | **Meeting Soon** | Reminder about an upcoming meeting | | **Follow-up Due** | A conversation you flagged is ready for a follow-up | | **System** | Weekly updates from Spencer, platform updates, and announcements | ## Managing Notifications - **Mark as read**: click a notification to mark it as read - **Mark all as read**: clear all unread indicators at once - **Dismiss**: hide a notification from your list - **Load more**: paginate through older notifications ## Clickable Actions Most notifications are clickable and will take you to the relevant page: - Weekly update notifications open **Home** - Meeting reminders open the **Calendar** Unread notifications are visually distinguished with a dot indicator, and each notification shows the avatar of the person it's about. --- # Gmail Connect Gmail to send outreach and track replies. Connect the Gmail account your outreach should come from. Starlight sends from it in your name and reads the replies to those messages. ## Setup #### 1. Go to Connectors Click **Connectors** in the sidebar #### 2. Click Connect Gmail Under the Email section, click **Connect** next to Gmail #### 3. Authorize with Google Sign in to your Google account and grant Starlight permission to send and read emails on your behalf #### 4. Configure sender name Optionally customize the sender name that appears on outgoing emails ## Permissions Starlight requests the following Gmail permissions: - **Send emails**: to deliver your outreach messages - **Read emails**: to track replies to those messages - **Manage labels**: to organize sent and received messages > **Info:** Starlight never reads emails unrelated to your outreach. Only threads initiated by Starlight are tracked. ## Rate Limits To protect your email reputation and stay within Gmail's sending limits, Starlight enforces a conservative daily send limit per connected account and warms new accounts up gradually. Gmail's own limits are typically 500 emails/day for personal accounts and 2,000/day for Google Workspace accounts. ## Disconnecting To disconnect Gmail, go to **Connectors** and click **Disconnect** next to your Gmail account. This revokes Starlight's access to your Gmail. Outreach from that mailbox pauses until you reconnect. --- # Outlook Connect Outlook to send outreach and track replies. Connect the Outlook account your outreach should come from. Starlight sends from it in your name and reads the replies to those messages. ## Setup #### 1. Go to Connectors Click **Connectors** in the sidebar #### 2. Click Connect Outlook Under the Email section, click **Connect** next to Outlook #### 3. Authorize with Microsoft Sign in to your Microsoft account and grant Starlight permission to send and read emails #### 4. Configure sender name Optionally customize the sender name that appears on outgoing emails ## Permissions Starlight requests permission to: - **Send emails**: deliver outreach messages from your account - **Read emails**: track replies to those messages > **Info:** Only threads initiated through Starlight are tracked. Your personal emails are never read. ## Rate Limits Starlight enforces a conservative daily send limit per connected account and warms new accounts up gradually to protect your email reputation. ## Disconnecting Go to **Connectors** and click **Disconnect** next to your Outlook account. Outreach from that mailbox pauses until you reconnect. --- # Google Calendar Sync your Google Calendar to view meetings in Starlight. Connect Google Calendar so meetings Starlight books land on your calendar and we never offer a time you are busy. ## Setup #### 1. Go to Connectors Click **Connectors** in the sidebar #### 2. Click Connect Google Calendar Under the Calendar section, click **Connect** next to Google Calendar #### 3. Authorize with Google Sign in and grant Starlight read access to your calendar events ## What Syncs - **Events**: calendar events including title, time, duration, and description - **Attendees**: participant names and email addresses - **Meeting links**: video call URLs (Zoom, Meet, and more) Starlight matches attendee emails against the people we have reached for you, so you can see which prospects you have upcoming meetings with. ## Two-Way Sync Google Calendar syncs both ways. Events created or modified in Google Calendar are reflected in Starlight, and meeting deletions in Starlight can optionally notify attendees. If you use Microsoft 365, see [Outlook Calendar](/docs/integrations/outlook-calendar). ## Disconnecting Go to **Connectors** and click **Disconnect** next to Google Calendar. Your calendar view will no longer show events from this account. --- # Outlook Calendar Sync your Microsoft 365 calendar with Starlight. Connect Outlook Calendar so meetings Starlight books land on your Microsoft 365 calendar and we never offer a time you are busy. ## Setup #### 1. Go to Connectors Click **Connectors** in the sidebar #### 2. Click Connect Outlook Calendar Under the Calendar section, click **Connect** next to Outlook Calendar #### 3. Authorize with Microsoft Sign in with your Microsoft 365 account and grant Starlight access to your calendar events ## What Syncs - **Events**: calendar events including title, time, duration, and description - **Attendees**: participant names and email addresses, matched against the people we have reached for you - **Deletions**: meetings cancelled in Starlight are removed from Outlook Calendar too You can connect Outlook Calendar alongside [Google Calendar](/docs/integrations/google-calendar); events from both appear together in the Calendar view. ## Disconnecting Go to **Connectors** and click **Disconnect** next to Outlook Calendar. Your calendar view will no longer show events from this account. --- # FAQ Frequently asked questions about Starlight. ### What exactly do you do? We take over your business development. We learn what you sell and who buys it, find the right people, write personalized email and LinkedIn outreach in your voice, send it from your own accounts, follow up, handle replies, and put qualified meetings on your calendar. You take the meetings. ### What do you need from me? About fifteen minutes of onboarding: your company and website, a sentence on who your best customers are, your LinkedIn profile, a Gmail or Outlook connection, a calendar connection, and your LinkedIn login and how your two factor codes arrive. After that, reading a short email on Fridays. ### Whose accounts send the messages? Yours. Email goes out from the Gmail or Outlook account you connect and LinkedIn messages go out from your LinkedIn profile. Prospects see you, not Starlight. That is why the reply rates hold up. ### Why do you need access to my LinkedIn? LinkedIn has no sign in a service can use, so you give Spencer access the way you would to a consultant running your LinkedIn. Only Spencer signs in, your login is encrypted and never shown back in the portal, two factor stays on, every time he reveals your login or a code is logged, and you can withdraw access at any time from Connectors, by changing your password, or by telling us to stop. ### What happens in the first 36 hours? We read your website and LinkedIn, pick the first audience and angle, write the first batch of messages in your voice, and start sending from your accounts. If the first personalized outreach has not gone out within 36 hours of your kickoff call with Spencer, you get a full refund of your first payment, no questions asked. ### What does the refund cover? Your first monthly payment, in full. Request it from Settings, then Billing, or by replying to any email from us. The control is there for the first 7 days after your first payment. After the first week you can pause or cancel any time to stop future charges. ### What does a week look like? Outreach goes out every business day within safe limits for one person's accounts. Replies come to your inbox and to us. Meetings appear on your calendar. On Friday around 3pm your time you get a short email from Spencer with the numbers for the week and what is next. ### Do you guarantee meetings? No honest sales partner can promise what strangers will do. The one thing we guarantee is speed: live within 36 hours or a full refund. Beyond that, you can pause or cancel the moment the service stops earning its keep. ### How much does it cost? $2,800 a month, billed through Stripe. Monthly only: no annual plan, no setup fee, no minimum term. That is less than half the cost of a $60,000 a year sales rep before benefits, tools, and ramp time. ### How do I pause or cancel? Settings, then Billing. Pausing stops outreach at the end of the current period and keeps everything in place for when you come back. Canceling ends the service at the end of the current period. Neither needs a call. ### Is my data secure? Email and calendar connect through Google and Microsoft sign in, so we never see those passwords. Your LinkedIn login and authenticator setup key are encrypted and never shown back. Staff access to your account is audit logged. One login per business, no team invites. ### How do I reach you? Reply to any email from Spencer, or go to Settings, then Support. Everything gets read. --- # Data & Privacy How Starlight handles your data. ## Data Sources ### Lead Data Lead information (names, titles, companies, contact info) comes from third-party B2B data providers with access to 250M+ verified business contacts. This data is publicly available business information. ### Email Content Outreach messages are generated by AI based on your settings and publicly available prospect information. Sent messages and replies are stored in your Starlight account and accessible only to your team. ## Security ### Encryption - **OAuth tokens** (Gmail, Outlook, Google Calendar, Outlook Calendar, HubSpot) are encrypted with **AES-256-GCM** before storage - **Database connections** use TLS encryption in transit ### Authentication Starlight uses **passwordless authentication** exclusively: - **Google OAuth** — delegates authentication to Google - **Magic Links** — one-time login links sent to your email No passwords are stored in the system. ### Session Management You can terminate all active sessions from **Settings → Security → Sign Out Everywhere**. ## Email Handling - Starlight only reads and tracks email threads **initiated through the platform** - Your personal inbox is never accessed or scanned - Connected email permissions can be revoked at any time from the Connectors page or your Google/Microsoft account settings ## Data Retention - Your data is retained for as long as your account is active - Deleting your account permanently removes all associated data - Blacklisted email addresses are retained to prevent future outreach to those contacts ## Third-Party Services Starlight relies on these providers to run. The authoritative list, with locations, transfer safeguards, and a change log, is the [Sub-processors](/subprocessors) page; this table is generated from the same source. | Service | Purpose | Data Shared | | --- | --- | --- | | Vercel, Inc. | Application hosting, serverless compute, cookieless analytics, and the AI Gateway that routes our model calls | All application traffic, request logs, model prompts in transit | | Supabase, Inc. | Authentication and the production Postgres database (AWS us-east-2) | Account data and all application data at rest | | Amazon Web Services, Inc. (Amazon Bedrock) | Hosts the primary outreach-writing model (Moonshot AI's Kimi K2.5) in AWS US regions. Starlight pins every writer call to this host through the Vercel AI Gateway, so prompts never reach Moonshot AI's own API | Prospect business context, your product and brief, cached research facts | | Meta Platforms, Inc. | Judging, planning, and chat agent reasoning (Muse Spark) | Prospect business context, drafts being evaluated, your instructions to the agent | | xAI Corp. | X (Twitter) search for Social listening, query parsing, scoring and classification (Grok) | Search queries, public post text, lead titles and companies being scored | | Anthropic, PBC | Outage fallback for the writer and judges (Claude) | Same as the model it stands in for | | Google LLC | Grounded reply drafting with Google Search (Gemini); also the Gmail and Calendar APIs you connect | Reply threads being drafted, prospect context | | OpenAI, L.L.C. | Web research on prospects and companies, meeting prep, the draft revision pass, and the outreach fallback tier (GPT-6) | Prospect names, titles, and companies being researched; web search results; drafts being revised and their prompt context | | Apollo.io (ZenLeads Inc.) | Lead search, contact and company enrichment, phone reveals, job-change detection | Search filters, names, companies, LinkedIn URLs submitted for matching | | Resend, Inc. | Transactional email from Starlight itself (welcome, invites, notifications, booking confirmations) | Recipient name and email, message content | | Clearout | Email address verification before a draft is sent | Recipient email addresses | | Stripe, Inc. | Subscription billing, hosted checkout, and the billing portal | Billing name, email, payment method (card numbers never reach Starlight) | | SerpApi, LLC | Google Maps results for Local search; Google results for Reddit threads and G2/Capterra reviews | Search queries (business types, locations, keywords); no account data | | Perplexity AI, Inc. | Web search behind prospect and company research, signal and news detection, meeting prep, website scans, and Reddit and LinkedIn discovery in Social listening, called through the Vercel AI Gateway | Search queries, which can include a prospect's name, title, and company; no account data | | HarvestAPI (Aventra Technologies Limited) | LinkedIn public post search for Social listening | Keyword phrases; no account data | | Reddit, Inc. | Reddit Data API to read the full text of public threads surfaced in Social | Thread identifiers; no account data | | Openmart, Inc. | Local-business database behind Local search: business listings (name, address, phone, website, published inboxes, social links, ratings, ownership) and owner / decision-maker contact lookup for businesses you search | The business category and area you search, and the website domains and names of businesses in your results; no account data | | TinyFish, Inc. | Web search for Reddit threads, public LinkedIn posts, and G2/Capterra reviews in Social listening, and fetching the public pages those searches return (thread and post bodies, cited news articles) | Search keyword phrases and public page URLs; no account data | | Logo.dev | Company logos shown in the app | Company domain names only | | MapTiler AG | Map tiles for Local search and the Metrics globe, loaded by your browser | Your IP address and the map area viewed | | OpenStreetMap Foundation (Nominatim) | City boundary outlines for Local search, fetched server-side | Place names only | The Starlight Chrome extension acts locally in your browser to send LinkedIn and X messages and run the read-only scans you enable. Your LinkedIn and X credentials are never shared with Starlight. Every data flow is described in the Chrome Extension section of the [Privacy Policy](/privacy). ## Legal Documents - [Privacy Policy](/privacy): what we collect, why, and your rights - [Data Processing Addendum](/dpa): applies to every customer automatically; countersigned copies on request - [Security](/security): hosting, encryption, isolation, and vulnerability disclosure - [Cookie Notice](/cookies) and [Acceptable Use Policy](/acceptable-use) ## Contact For data privacy questions, contact [privacy@joinstarlight.com](mailto:privacy@joinstarlight.com). --- # Legal # Terms of Service Last updated: October 2, 2026 The agreement that governs your use of Starlight. > **Info:** These Terms incorporate the [Acceptable Use Policy](/acceptable-use), the [Privacy Policy](/privacy), the [Cookie Notice](/cookies), and the [Data Processing Addendum](/dpa). Section 19 contains an arbitration agreement and class action waiver with a 30-day opt-out. ## 1. Acceptance of Terms By accessing or using Starlight (the "Service"), operated by Starlight Software LLC, a California limited liability company ("Starlight," "we," "us," or "our"), you agree to be bound by these Terms of Service (the "Terms"). If you are using the Service on behalf of a company or other legal entity, you represent that you have authority to bind that entity to these Terms, and references to "you" mean both you individually and that entity. If you do not agree to these Terms, do not use the Service. The following policies are part of these Terms and are incorporated by reference: the [Acceptable Use Policy](/acceptable-use) ("AUP"), the [Privacy Policy](/privacy), the [Cookie Notice](/cookies), and, where you use the Service to process personal data, the [Data Processing Addendum](/dpa) ("DPA"). If these Terms conflict with the DPA on the processing of personal data, the DPA controls. ## 2. Description of Service Starlight is a business development service delivered by Starlight Software LLC, a California limited liability company. Under a monthly subscription, Starlight personnel ("Operators") run outbound business development on your behalf: learning your business and buyers, researching accounts and contacts, writing personalized email and LinkedIn outreach in your voice, sending it from accounts you connect and LinkedIn access you provide, following up, handling replies, and booking qualified meetings on your calendar. The service is available at [joinstarlight.com](https://joinstarlight.com). The software portal there (the "Portal"), together with public booking pages under [joinstarlight.com/book](https://joinstarlight.com/book) and the Starlight Chrome extension, is how you see results, manage your connections and credentials, and manage your subscription; the Portal, the extension, autonomous Agents, the chat assistant, and the remote MCP server and OAuth endpoints are also the tooling Operators use to deliver the service. Legacy self-serve software plans, where offered, are governed by these same Terms. ### The Starlight service By subscribing you authorize Operators to access your account and to act on your behalf using the email and calendar accounts you connect and the LinkedIn access you provide, to the extent needed to deliver the service. Operator access is logged in an audit trail, and messages sent by Operators from your accounts are treated for all purposes of these Terms as messages sent by you. The service covers top-of-funnel work only: your team remains responsible for sales calls, demos, proposals, negotiation, and closing. You are responsible for the accuracy of claims about your products and services, including corrections to the business profile Starlight derives from your website and LinkedIn, and for telling us about any audiences, companies, people, or claims to avoid. You may revoke any connected account at any time from the Portal and withdraw LinkedIn access at any time from Connectors (which deletes the stored login and session), by changing your password, or by telling us to stop. ## 3. Account Registration - You must provide accurate and complete information when creating an account and keep it up to date - You are responsible for maintaining the security of your account and for all activity that occurs under it, including activity by Agents, Autopilot, and any MCP or OAuth client you authorize - You must be at least 18 years old to use the Service - One person or legal entity may not maintain more than one free account - You must notify us promptly at [legal@joinstarlight.com](mailto:legal@joinstarlight.com) if you suspect unauthorized access to your account ## 4. Acceptable Use Your use of the Service must comply with the [Acceptable Use Policy](/acceptable-use), which sets out the rules for outbound messaging, lead data, AI-generated content, connected platforms, Agents, and the MCP server. We may update the AUP as laws and platform policies change. A material violation of the AUP is a material breach of these Terms. ## 5. Customer Responsibilities for Outbound Messaging Because the Service sends messages on your behalf, you are solely responsible for the content and lawfulness of every message sent through it, whether you approved it by hand or through an automated feature you enabled. You represent and agree that: - You have a lawful basis, such as a legitimate business interest, an existing relationship, or documented consent where required, to contact each recipient under every law that applies to that recipient - Every message accurately identifies you or your company as the sender and gives the recipient a reasonable way to opt out - You will honor every opt-out request within the period required by applicable law, and in no event later than 10 business days after receipt - You are responsible for configuring and maintaining the authentication of any sending domain you connect, including SPF, DKIM, and DMARC records, and for the reputation of that domain - You will not impersonate any person or entity or misrepresent your affiliation with any person or entity - You will comply with the acceptable use policies of any connected third-party provider, including Gmail, Outlook, LinkedIn, X, and Reddit We may suspend sending from your account without advance notice if we reasonably believe a campaign violates these obligations, harms recipients, or puts shared sending infrastructure at risk. These responsibilities apply equally when messages are prepared or sent by Operators from your connected accounts and LinkedIn profile as part of the service: you remain responsible for the accuracy of claims about your products and services, the lawfulness of contacting the audiences you have asked us to reach, and your authority over every account you connect or give us access to for our use. ## 6. Agents, Autopilot, and Automated Features The Service includes features that act on your behalf: scheduled Agents that source leads and draft outreach, a chat assistant that can take actions you instruct, Signals and Social auto-drafting, and Autopilot modes that send already-approved drafts. By default every draft waits for your review and nothing is sent until you approve it. When you turn on an autopilot setting, you authorize Starlight to approve and send on your behalf within the limits shown in the product, and you agree that: - Every message sent by an automated feature is your message. You remain the sender of record and the party responsible for it under Section 5 - Automated features operate on AI judgments that can be wrong. You are responsible for configuring them, reviewing their output, and turning them off when they are not performing as you expect - Daily and per-run caps exist to protect your accounts and our infrastructure. You will not attempt to circumvent them - Instructions you give the chat assistant or an MCP client are treated as your instructions, including instructions to approve, send, delete, or spend blocks ## 7. Third-Party Platforms and the Chrome Extension The Starlight Chrome extension runs in your own browser, under your own LinkedIn, X, and Reddit accounts, to deliver approved drafts, read replies to conversations you started, and run read-only scans you have enabled. Starlight's servers do not log into those platforms and, outside the LinkedIn access a service customer chooses to share (Section 2 and the Privacy Policy), do not hold your credentials for them. Your use of LinkedIn, X, Reddit, and any other third-party platform is governed by that platform's own terms, and you are responsible for ensuring that your use of the extension, including its Autopilot mode, complies with them. Starlight is not responsible for any restriction, suspension, or termination a platform applies to your account, and does not guarantee that the extension will continue to work if a platform changes its service. The data flows of the extension are described in full in the Chrome Extension section of the [Privacy Policy](/privacy). ## 8. Customer Data and Prospect Data "Customer Data" means any data you submit to, generate within, or enrich using the Service, including the business contact information of prospects you research or contact, imported network connections, booking invitee details, and meeting notes. As between you and Starlight, you retain all rights in Customer Data, and you grant us a limited, non-exclusive, worldwide license to host, process, transmit, and display Customer Data solely to provide the Service to you, to improve and secure the Service, and to enforce these Terms. You represent and warrant that you have all rights, consents, and legal bases necessary to provide Customer Data to the Service and to use it for the purposes you select, and that our processing of Customer Data on your instructions will not violate any law or third-party right. Our processing of personal data contained in Customer Data is governed by the [Data Processing Addendum](/dpa), which applies automatically to every customer. A countersigned copy is available on request at [legal@joinstarlight.com](mailto:legal@joinstarlight.com). ## 9. Lead Data License Lead, contact, and company data that Starlight surfaces from third-party data providers ("Lead Data") is licensed to you, not sold. You may use Lead Data to identify prospective customers, research existing customers and prospects, and communicate with a person in a manner that relates to that person's profession, business, or employment, through the Service and your own connected tools, solely for your internal business purposes. Lead Data you incorporate into your own records, systems, reports, or workflows during your subscription (for example, by syncing it to your CRM or adding it to a campaign) stays yours to use for those internal purposes after your subscription ends. You may not: distribute, sell, license, or otherwise make Lead Data available to third parties; use Lead Data to build or supplement a competing database, list, or service; combine Lead Data with other sources in a way that circumvents these restrictions; use Lead Data to train, fine-tune, or improve any AI or machine-learning model; use automated means to extract Lead Data beyond the exports the Service provides; or attempt to re-identify individuals from de-identified data. These restrictions pass through obligations we owe to our data providers, and we may suspend export features if we reasonably believe they are being violated. ## 10. Subscription and Billing ### The Starlight subscription - The service is billed monthly through Stripe at the price in effect when you subscribe or renew (currently US$2,800 per month) and renews automatically at the end of each monthly period using the payment method on file until you pause or cancel - Billing is monthly only. There is no annual plan, no setup fee, and no minimum term - Everything the service does for you is included in the subscription fee; block allowances and block charges do not apply to work performed in your account while your subscription is active - All fees are exclusive of applicable taxes, which you are responsible for paying - All fees are non-refundable except as required by law or as expressly provided in these Terms, including the 36-hour launch guarantee below ### The 36-hour launch guarantee If the first personalized outbound messages have not gone out from your connected accounts within 36 hours of the end of your kickoff call (the call you book with us as the last step of onboarding in the Portal; if the call is moved, the 36 hours run from the new time), you may request a full refund of your first monthly payment, no questions asked, by emailing [legal@joinstarlight.com](mailto:legal@joinstarlight.com) or from Settings, then Billing, in the Portal. The request must be made within the 7-day (168-hour) refund window that begins at your first payment. The 36 hours pause while we are waiting on something only you can provide (for example an email connection, a LinkedIn verification code, or a two-factor change), and we will tell you what is missing. A refunded subscription ends the service. Beyond this guarantee, the service is a services engagement, not a results guarantee (see Section 18). ### Pausing You may pause your subscription at any time from Settings, then Billing. A pause takes effect at the end of the current billing period; while paused you are not billed, active outreach stops, and your account, history, and connections remain available. Resuming starts a new monthly billing period. Restarting after an extended pause may be subject to capacity. ### Cancellation You may cancel your subscription at any time from Settings, then Billing. Cancellation takes effect at the end of your current billing period, after which active outreach stops and you are not billed again. We do not provide partial refunds for unused time within a billing period. Upon cancellation or refund, connected-account authorizations used for the service are revoked and staff LinkedIn access ends as part of offboarding, and your data remains subject to Section 8 and the Privacy Policy. ### Price Changes We may change pricing by giving you at least 30 days' advance notice. Price changes take effect at the start of your next billing period after the notice. ### Failed Payments and Chargebacks If a payment fails, we may suspend the service until payment is made current. If you initiate a chargeback that we reasonably believe to be improper, we may suspend or terminate your account and recover the disputed amount together with any associated fees. ### Capacity Capacity is intentionally limited so every customer gets real attention; we may decline or waitlist new subscriptions. ### Legacy self-serve plans and blocks The following applies only to accounts on a legacy self-serve software plan, where those plans remain available. Such plans offer a free tier and paid subscription plans with varying monthly block allowances, billed monthly or annually through Stripe, renewing automatically until canceled from account settings with effect at the end of the current billing period. Block costs are described in our [billing documentation](/docs/billing/blocks); unused blocks do not roll over. Blocks granted through the referral program or other promotions have no cash value, are non-transferable, cannot be exchanged for a refund, and expire when your account closes; we may withhold or reverse rewards for self-referrals, duplicate accounts, or other abuse. ## 11. Intellectual Property - **Our IP**: The Service, including its software, design, prompts, AI pipelines, and documentation, is owned by Starlight Software LLC and is protected by intellectual property laws. We reserve all rights not expressly granted to you in these Terms - **Your IP**: You retain all rights in Customer Data as described in Section 8 - **No Trademark License**: Nothing in these Terms grants you any right to use Starlight's trademarks, logos, or trade dress - **Copyright notices**: If you believe content available through the Service infringes your copyright, send a notice that meets the requirements of 17 U.S.C. § 512(c)(3) to [legal@joinstarlight.com](mailto:legal@joinstarlight.com) ## 12. AI-Generated Content and Model Training The Service uses third-party AI models, listed on our [Sub-processors](/subprocessors) page, to generate drafts, scores, research, and other outputs ("AI Output"). AI Output may be inaccurate, outdated, or unsuitable for your purpose, and you are solely responsible for reviewing AI Output before sending, publishing, or otherwise relying on it. - **No training on your data**: Starlight does not use Customer Data to train its own models, and we do not grant our AI providers the right to train their models on Customer Data. Where our provider agreements offer zero-data-retention terms, we enable them - **Ownership of Output**: As between you and Starlight, you own AI Output generated for you through the Service, subject to any underlying third-party rights. You understand that similar or identical outputs may be generated for other users - **No high-stakes decisions**: AI-generated scores, match assessments, and intelligence recommendations are advisory only and are not used to make decisions that produce legal or similarly significant effects about any individual without human review ## 13. MCP Server, API, and OAuth Clients You may connect third-party AI assistants and other clients to your account through our MCP server and OAuth endpoints. Each client you authorize acts with your permissions, and its actions, including tool calls that consume blocks, are your actions. You are responsible for the security of the clients you connect and for revoking access to any you no longer use. We may rate-limit, suspend, or revoke any client that degrades the Service, violates the AUP, or appears compromised. Access tokens and the MCP interface are provided as part of the Service and may change with notice as described in Section 20. ## 14. Third-Party Integrations The Service integrates with third-party services you connect, including Gmail, Microsoft Outlook, Google Calendar, Microsoft 365 Calendar, HubSpot, Salesforce, and Attio, and relies on the providers listed on the [Sub-processors](/subprocessors) page. Your use of each integration is subject to that provider's own terms of service. We are not responsible for the availability, performance, or policy changes of any third-party service, and disconnection or disruption of a third-party service may affect the features that depend on it. Company logos displayed in the Service are provided by [Logo.dev](https://logo.dev). Map data and tiles used in the Local business search feature and the Metrics interaction globe are provided by [MapTiler](https://www.maptiler.com/copyright/) and [OpenStreetMap](https://www.openstreetmap.org/copyright) contributors, and are subject to their respective copyright and license terms. ## 15. Data and Privacy Your use of the Service is also governed by our [Privacy Policy](/privacy) and [Cookie Notice](/cookies). By using the Service, you acknowledge that you have read them and that we will process personal data as they describe. ## 16. Feedback If you send us suggestions, ideas, bug reports, or other feedback about the Service, you grant Starlight a perpetual, irrevocable, worldwide, royalty-free license to use that feedback for any purpose, without obligation or attribution to you. ## 17. Beta Features We may label certain features as "beta," "preview," "experimental," or similar. Beta features are provided "as is," may be changed or discontinued at any time, and are excluded from any service-level commitment or warranty in these Terms. ## 18. Disclaimers, Limitation of Liability, and Indemnification ### Disclaimers The Service is provided "as is" and "as available" without warranties of any kind, whether express, implied, or statutory, including any implied warranties of merchantability, fitness for a particular purpose, title, or non-infringement. Your use of the Service is at your own risk. Without limiting the foregoing: - We do not guarantee the accuracy, completeness, or currency of lead data sourced from third-party providers - AI Output may contain errors, and you are responsible for reviewing all outreach before sending - We do not guarantee email deliverability, inbox placement, response rates, or any particular business outcome - The service is a services engagement, not a results guarantee: we do not promise any number of replies, meetings, opportunities, pipeline, or revenue. The 36-hour launch guarantee in Section 10 is the only guarantee we make - We do not warrant that the Service will be uninterrupted, secure, or error-free ### Limitation of Liability To the maximum extent permitted by law, in no event will Starlight, its affiliates, or its licensors be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for any loss of profits, revenue, data, goodwill, or business opportunity, arising out of or relating to your use of the Service, even if we have been advised of the possibility of such damages. Starlight's aggregate liability arising out of or relating to these Terms or the Service will not exceed the greater of (a) the total amounts you paid to Starlight for the Service in the twelve (12) months preceding the event giving rise to the claim or (b) one hundred US dollars (US$100). These limitations apply regardless of the legal theory on which the claim is based, whether contract, tort (including negligence), strict liability, or otherwise, and form an essential basis of the bargain between you and Starlight. Some jurisdictions do not allow the exclusion or limitation of certain damages, so some of the above limitations may not apply to you. ### Indemnification by You You will defend, indemnify, and hold harmless Starlight and its officers, employees, and contractors from and against any third-party claim, demand, or proceeding, and any resulting losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees), arising out of or relating to: (a) your use of the Service in violation of these Terms, the AUP, or applicable law, (b) your Customer Data, (c) messages sent from your account, including by automated features you enabled, or (d) your violation of any third-party right or platform term, including rights of publicity, privacy, or intellectual property. ### Indemnification by Us Starlight will defend you against any third-party claim alleging that the Service, as provided by Starlight and used in accordance with these Terms, infringes a third party's US patent, copyright, trademark, or trade secret, and Starlight will pay the final damages awarded or amount paid in settlement of any such claim, provided that you (i) promptly notify us in writing of the claim, (ii) give us sole control of the defense and settlement, and (iii) reasonably cooperate with us at our expense. Starlight has no obligation under this section for claims arising from (A) Customer Data or AI Output, (B) your combination of the Service with anything not provided by Starlight, or (C) your continued use of the Service after we have provided a non-infringing modification or alternative. This Section 18 states each party's sole and exclusive remedy for third-party infringement claims. ## 19. Dispute Resolution; Arbitration; Class Action Waiver **PLEASE READ THIS SECTION CAREFULLY. IT REQUIRES YOU AND STARLIGHT TO RESOLVE DISPUTES THROUGH INDIVIDUAL BINDING ARBITRATION AND WAIVES THE RIGHT TO A JURY TRIAL AND TO PARTICIPATE IN CLASS ACTIONS.** ### Informal Resolution Before filing any formal claim, you and Starlight agree to try in good faith to resolve any dispute by informal negotiation for at least 30 days after written notice of the dispute is delivered. You may send notice to [legal@joinstarlight.com](mailto:legal@joinstarlight.com), and we will send notice to the email address associated with your account. ### Binding Arbitration Any dispute, claim, or controversy arising out of or relating to these Terms or the Service that is not resolved informally will be resolved by final and binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules, which are available at [adr.org/commercial](https://www.adr.org/commercial). Proceedings will be conducted remotely by video or telephone unless a party requests in-person proceedings. Judgment on the arbitration award may be entered in any court of competent jurisdiction. The arbitrator, not any court, has exclusive authority to decide threshold questions about the scope, enforceability, or formation of this arbitration agreement, except that a court may decide whether the Class Action Waiver below is enforceable. ### Class Action Waiver You and Starlight agree that each may bring claims against the other only in your or its individual capacity, and not as a plaintiff or class member in any purported class or representative proceeding. The arbitrator may not consolidate more than one person's claims and may not preside over any form of representative or class proceeding. This waiver is an essential part of the parties' agreement to arbitrate; if a court decides it is unenforceable as to any particular claim, that claim (and only that claim) must be brought in court as set out in Section 21. ### California PAGA Carve-Out Nothing in this Section 19 waives a California resident's non-waivable right to bring a representative claim under the California Private Attorneys General Act (Cal. Lab. Code § 2698 et seq.) on behalf of themselves. To the extent California law treats any such claim as non-waivable, it is excluded from arbitration and from the Class Action Waiver above and may be pursued in a court of competent jurisdiction in California after the informal-resolution period has ended. ### Batch Arbitration If 25 or more similar demands for arbitration are filed against Starlight by or with the assistance of the same counsel or coordinated group within a 60-day period, the parties agree that the demands will be resolved in sequential batches of up to 50 at a time. The first batch will proceed to arbitration, and the remaining demands will be stayed pending the outcome of the first batch, after which the parties will engage in a good-faith mediation before the next batch proceeds. This procedure is intended to promote the efficient resolution of mass filings and is an essential part of this arbitration agreement. ### Carve-Outs Either party may (i) bring an individual claim in small claims court if it qualifies and (ii) seek injunctive or other equitable relief in a court of competent jurisdiction to protect its intellectual property, confidential information, or security interests. Filing such a claim does not waive the right to arbitrate any other dispute. ### 30-Day Opt-Out You may opt out of this Section 19 by sending written notice of your decision to opt out to [legal@joinstarlight.com](mailto:legal@joinstarlight.com) within 30 days of first accepting these Terms. Your notice must include your name, the email address associated with your account, and a clear statement that you want to opt out of the arbitration agreement. Opting out of arbitration does not affect any other provision of these Terms. ### Jury-Trial Waiver If for any reason a dispute proceeds in court rather than in arbitration, you and Starlight each knowingly and voluntarily waive any right to trial by jury to the maximum extent permitted by law. ## 20. Changes to Terms We may update these Terms from time to time. For material changes, we will give at least 30 days' advance notice by email or in-app notification before the change takes effect. For non-material changes, we will update the "Last updated" date at the top of this page. Your continued use of the Service after changes take effect constitutes acceptance of the updated Terms. If you do not agree to an update, you must stop using the Service before the update takes effect. Previous versions of these Terms are available on request. ## 21. Governing Law and Venue These Terms are governed by the laws of the State of California, without regard to its conflict of law principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply. For any dispute that is not subject to arbitration under Section 19, you and Starlight consent to the exclusive jurisdiction and venue of the state and federal courts located in San Francisco County, California. ## 22. State-Specific Notices - **California**: Under California Civil Code § 1789.3, California users are entitled to the following notice: the Service is provided by Starlight Software LLC. To file a complaint regarding the Service or to receive further information, contact us at [legal@joinstarlight.com](mailto:legal@joinstarlight.com), or contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs at 1625 N. Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210. Your rights under the California Consumer Privacy Act are described in the [Privacy Policy](/privacy) - **Colorado, Connecticut, Virginia, Texas, Oregon, and other states with comprehensive privacy laws**: your rights of access, correction, deletion, portability, and opt-out are described in the State privacy rights section of the [Privacy Policy](/privacy) - **Nevada**: Nevada residents may direct us not to sell covered information. We do not sell covered information; to record a request, email [privacy@joinstarlight.com](mailto:privacy@joinstarlight.com) ## 23. General - **Assignment**: You may not assign these Terms or any rights under them without our prior written consent. We may assign these Terms, in whole or in part, to an affiliate or in connection with a merger, acquisition, reorganization, or sale of assets. Any attempted assignment in violation of this section is void - **Severability**: If any provision of these Terms is held unenforceable, the remaining provisions will remain in full force and effect, and the unenforceable provision will be reformed to the minimum extent necessary to make it enforceable while preserving its intent - **Entire Agreement**: These Terms, together with the AUP, Privacy Policy, Cookie Notice, DPA, and any order or addendum that references these Terms, constitute the entire agreement between you and Starlight regarding the Service and supersede any prior agreements on that subject - **Waiver**: Our failure to enforce any right or provision of these Terms will not be a waiver of that right or provision - **Force Majeure**: Neither party will be liable for any failure or delay in performance (other than payment obligations) caused by events beyond its reasonable control, including natural disasters, war, terrorism, labor disputes, internet or telecommunications failures, or acts of any third-party provider - **Electronic Communications**: By using the Service you consent to receive notices and other communications from us electronically, by email to the address on your account or by posting in the Service. Electronic communications satisfy any legal requirement that a communication be in writing - **Notices**: You may give notice to us at [legal@joinstarlight.com](mailto:legal@joinstarlight.com) - **Accessibility**: We aim to conform to the Web Content Accessibility Guidelines (WCAG) 2.1, Level AA. If you have difficulty accessing any part of the Service, contact [legal@joinstarlight.com](mailto:legal@joinstarlight.com) and we will make reasonable efforts to address it promptly - **Independent Contractors**: The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, franchise, or employment relationship - **No Third-Party Beneficiaries**: These Terms do not create any third-party beneficiary rights - **Export Controls**: You represent that you are not located in, and will not use the Service from, a jurisdiction subject to comprehensive US embargoes, and that you are not on any US government restricted-party list - **Publicity**: Starlight may identify you as a customer by name and logo in marketing materials and on its website. You may opt out of this use at any time by emailing [legal@joinstarlight.com](mailto:legal@joinstarlight.com) - **Survival**: Sections 8, 9, 11, 12, 16, 18, 19, 21, and 23 survive termination - **Headings**: Section headings are for convenience only and have no legal effect ## 24. Termination You may terminate your account at any time from your account settings. We may suspend or terminate your account if you materially breach these Terms or the AUP, if required by law, or if your use of the Service poses a security, legal, or operational risk to the Service or to other users. Where reasonable and not precluded by legal or safety considerations, we will give you notice and an opportunity to cure before terminating for cause. Upon termination, your right to access and use the Service ends immediately. You may export your data from the Service at any time before termination takes effect. After termination, we will retain and delete Customer Data as described in the [Privacy Policy](/privacy) and the [DPA](/dpa). ## 25. Contact For questions about these Terms, contact us at [legal@joinstarlight.com](mailto:legal@joinstarlight.com). Copyright © 2026 Starlight Software LLC. All rights reserved. --- # Acceptable Use Policy Last updated: August 20, 2026 What you may and may not do with outreach, lead data, AI features, and connected platforms. This Acceptable Use Policy ("AUP") is part of the [Terms of Service](/terms). It exists because Starlight sends messages, reads public data, and takes actions on your behalf, and those activities are regulated in most of the places your prospects live. Terms that are capitalized but not defined here have the meaning given in the Terms. > **Info:** The short version: contact people you have a legitimate business reason to contact, tell them who you are, stop when they ask, use lead data only for your own outreach, review what the AI writes, and stay inside the rules of any platform you connect. ## 1. Outbound Messaging ### Laws that apply You are responsible for complying with every electronic-communications and privacy law that applies to each recipient, including the US CAN-SPAM Act, Canada's Anti-Spam Legislation (CASL), the EU GDPR and ePrivacy Directive, the UK GDPR and PECR, Australia's Spam Act, and equivalent laws elsewhere. Some of these laws require prior consent for business-to-business email; where they do, you must have it before you send. ### Every message must - Accurately identify you or your company as the sender, with working reply-to and sender addresses - Have a subject line and content that are not deceptive or misleading - Give the recipient a reasonable way to opt out, whether an unsubscribe link, a reply, or clear instructions, and you must honor opt-outs within 10 business days and never later than the law requires - Go to a business contact for a business purpose. Starlight is not a consumer-marketing or bulk-mailing tool ### You must not - Send unsolicited bulk messages, or the same message to large lists without individual relevance - Harass, threaten, defame, or send deceptive or fraudulent communications to any recipient - Promote adult content, illegal products or services, unregulated financial products, multi-level marketing schemes, get-rich-quick schemes, or unsolicited cryptocurrency offerings - Contact anyone who has opted out, through any channel, or remove anyone from your suppression list to contact them again - Use sending domains or mailboxes you do not control, or circumvent the rate limits, daily caps, warm-up limits, or policies of any connected mailbox provider - Impersonate any person or entity or misrepresent your affiliation with anyone ### Domain health You are responsible for the SPF, DKIM, and DMARC configuration and the reputation of every domain you send from. Starlight surfaces deliverability problems but cannot fix your DNS for you. ## 2. Lead and Company Data - Use Lead Data only for your own business-to-business sales and marketing, as licensed in Section 9 of the Terms - Do not resell, sublicense, publish, or redistribute Lead Data, and do not use exports to build or enrich a database, list, or product offered to anyone else - Do not attempt to re-identify, combine, or enrich Lead Data in ways that violate a data provider's terms or applicable law - Honor data-subject requests. If a prospect asks you to delete their information, delete it from Starlight and from any system you exported it to - Only import network connections (LinkedIn, Google, Instagram, X) and CRM records that you are permitted to share with a processor. Do not upload data you obtained in breach of another service's terms ## 3. AI-Generated Content - Review AI Output before it is sent. You are the author of every message, whether you edited it or not - Do not instruct the AI to fabricate facts, credentials, statistics, relationships, or endorsements, or to write in a way that conceals that a message is a sales approach - Do not use the Service to create content that impersonates a real person without their authorization, or that is discriminatory, harassing, or unlawful - Where a law requires you to disclose that a communication is automated (for example, California's bot disclosure law for automated accounts that incentivize a purchase), you are responsible for making that disclosure. Drafts you review and send yourself are your communications, not a bot's - Do not use AI Output to train a model that competes with Starlight ## 4. Connected Platforms and the Chrome Extension - Use the extension only with LinkedIn, X, and Reddit accounts that belong to you, and only within those platforms' terms. You accept the risk that a platform may restrict an account for automation, and you can reduce that risk by keeping Autopilot off, lowering your volumes, or using prefill-only sending - Do not modify the extension, automate the extension with other tools, or use it to scrape, harvest, or export platform data beyond the flows described in the [Privacy Policy](/privacy) - Do not use Starlight to send connection requests or messages to people who have no plausible business reason to hear from you, or to post comments that are deceptive about your affiliation - Respect the daily caps the extension enforces. They exist to protect your account ## 5. Agents, Chat, and the MCP Server - Configure Agents with an honest description of your product and customer. An Agent told to fabricate will fabricate - Do not use the chat assistant, Agents, or MCP clients to evade any rule in this AUP, to issue high volumes of automated requests that degrade the Service, or to probe for vulnerabilities - Protect the credentials and tokens of any MCP or OAuth client you connect. Revoke clients you no longer use from Settings - Autonomous sending (autopilot) is your decision and your responsibility. Turn it off if the output is not what you would send yourself ## 6. Security and Integrity of the Service - Do not attempt to access another customer's data, bypass authentication, or interfere with the Service's infrastructure - Do not reverse engineer, decompile, or extract the source code, prompts, models, or algorithms of the Service - Do not scrape, crawl, or use automated means to access the Service outside the interfaces we provide (the app, the extension, and the MCP server) - Do not run security testing against the Service without written permission. Good-faith research under our [vulnerability disclosure program](/security) is welcome - Do not share account credentials, maintain multiple free accounts, or self-refer to collect referral rewards ## 7. Enforcement We prefer to warn before we act, and we will where it is safe to do so. Depending on severity, we may: contact you and ask you to fix the problem; pause sending from your account while we investigate; disable a specific feature, integration, or client; suspend your account; or terminate it for material breach under the Terms. We may also report unlawful activity to the relevant authorities. We are not obligated to refund blocks consumed by activity that violates this AUP. ## 8. Reporting Abuse If you received a message through Starlight that you believe violates this policy, or you are a Starlight customer and want to report misuse, email [privacy@joinstarlight.com](mailto:privacy@joinstarlight.com). Recipients who want to stop receiving messages from all Starlight customers can email the same address, or use the unsubscribe link where a message includes one; we add the address to a suppression list that every customer's sends are checked against. ## 9. Changes We may update this AUP as laws, platform policies, and the Service change. Material changes are announced with at least 30 days' notice as described in the Terms; the "Last updated" date at the top of this page reflects the current version. --- # Privacy Policy Last updated: September 29, 2026 How Starlight collects, uses, stores, and protects personal data for customers, the people they contact, and visitors. > **Info:** Received an email or LinkedIn message from a company using Starlight? Skip to [Section 10](#10-information-for-people-our-customers-contact) for where your information came from and how to stop further contact. ## 1. Who We Are and What This Policy Covers Starlight Software LLC, a California limited liability company ("Starlight", "we", "us", or "our"), operates the Starlight platform at [joinstarlight.com](https://joinstarlight.com), the Starlight Chrome extension, and public booking pages under joinstarlight.com/book (together, the "Service"). This Privacy Policy explains how we collect, use, share, and protect personal information. It covers three groups of people: - **Customers and users**: people who sign up for Starlight, their teammates, and visitors to our website. For this group Starlight is the **controller** (the "business" under US state laws) - **People our customers contact**: prospects and leads whose business contact details are researched, enriched, or messaged through the Service; people whose public posts appear in Social; people in networks our customers import; and invitees who book meetings through a customer's booking page. For this group the customer is the controller and Starlight is a **processor** ("service provider") acting on the customer's instructions under our [Data Processing Addendum](/dpa) - **Visitors**: anyone reading our website or docs without an account Where we act as a processor, the customer who contacted you decides why and how your data is used; this policy describes what we do with it on their behalf and the choices you have with us directly. ## 2. Personal Information We Collect ### From customers and users - **Account data**: name, email address, and profile photo from Google sign-in or the email magic link; company name, website, and the product and ideal-customer description you provide or we generate from your website during onboarding - **Billing data**: plan, block usage, and invoices. Payment details are collected and stored by Stripe on its hosted pages; card numbers never reach Starlight - **Content you create**: search queries, briefs, outreach drafts and edits, signatures, notes, Agent configurations, chat messages to the assistant, and meeting notes - **Integration data**: when you connect Gmail or Outlook we access only threads that Starlight started plus replies to them, never your wider inbox; when you connect a calendar we read event details to show meetings and prepare notes; when you connect HubSpot, Salesforce, or Attio we sync the contact and company records you choose - **Imported network data**: if you use Your Network, the connection exports you upload from LinkedIn, Google, Instagram, or X (names, profile URLs, emails where present). Only import lists you are permitted to share - **Extension data**: described in full in Section 16 - **MCP and OAuth clients**: the client name, the scopes you approve, and a log of tool calls made by AI assistants you connect - **Referral data**: your referral code, and the email addresses and sign-up status of people who sign up with it - **Technical data**: IP address, browser and device type, operating system, referrer URL, and request logs collected by our hosting provider; aggregated, cookieless page analytics - **Communications**: support emails, feedback you submit in the docs, and your response to in-app surveys ### About people our customers contact - **Business contact and professional data**: name, job title, employer, work email, business phone number (revealed only on request), LinkedIn URL, location, employment history, and company firmographics. Sourced from Apollo.io and other B2B data providers, the prospect's public LinkedIn or X profile, the customer's CRM, or the customer's imported network - **Research facts**: publicly available information about a person or company gathered by AI web search to personalize outreach, cached for 72 hours - **Public posts**: the text, author, URL, and engagement counts of public posts on X, Reddit, LinkedIn, and review sites that match a customer's listening criteria, and the author's public profile when it can be matched to a business contact record - **Buying signals**: funding rounds, hiring, job changes, and news about companies and the people who work there, from Apollo.io and web search - **Engagement data**: delivery status, opens, clicks, replies, and LinkedIn connection acceptances for messages sent through the Service - **Booking data**: the name, email, timezone, and answers an invitee enters on a customer's public booking page, and the resulting meeting details ### Data about others Several features let customers provide information about other people: importing a network, syncing a CRM, adding contacts, or inviting teammates. Customers must have the right to share that information with us, and may only use it as described in our [Acceptable Use Policy](/acceptable-use). ## 3. How We Use Personal Information For people in the EEA, UK, and Switzerland, the table also states the legal basis we rely on under the GDPR and UK GDPR. Where we act as a processor, the legal basis is the customer's and is documented in the DPA. | Purpose | Examples | Legal basis | | --- | --- | --- | | Provide the Service | Lead search, drafting, sending, scheduling, inbox sync, Agents, MCP access | Contract (Art. 6(1)(b)) | | Billing and account administration | Subscriptions, block accounting, invoices, tax records | Contract; legal obligation (Art. 6(1)(c)) | | Service communications | Verification emails, booking confirmations, notifications, security alerts | Contract | | Security and abuse prevention | Rate limiting, suppression lists, detecting misuse, enforcing the AUP | Legitimate interests: keeping the Service and recipients safe | | Improve the Service | Aggregate usage analysis, draft-quality scoring, debugging with logs | Legitimate interests: building a better product | | Personalize outreach on a customer's behalf | Research, signals, social listening, AI drafting about prospects | Processor acting on customer instructions; the customer's legitimate interest in B2B outreach | | Referrals and promotions | Attributing sign-ups, granting bonus blocks | Contract; legitimate interests | | Legal compliance and claims | Responding to lawful requests, defending claims, honoring opt-outs | Legal obligation; legitimate interests | We do not use personal information for targeted advertising, and we do not make decisions with legal or similarly significant effects about anyone by solely automated means. ## 4. AI and Automated Processing Starlight uses third-party AI models to write drafts, judge draft quality, score lead fit, plan searches, research prospects, summarize meetings, and power the chat assistant and Agents. Different models handle different jobs; the providers and their roles are listed on the [Sub-processors](/subprocessors) page. When AI features run: - The relevant prospect context, your product description, and your instructions are sent to the model provider for that call, through the Vercel AI Gateway or directly to the provider - We do not train models on your data, and our provider agreements do not permit providers to train on it. Where a provider offers zero-data-retention terms, we enable them - Models may run web searches to gather publicly available information about a prospect or company; results are cached briefly and then discarded - Content from prospects and public posts is passed to models as untrusted data, never as instructions - AI-generated scores and recommendations are advisory. A person reviews drafts before they are sent unless a customer has deliberately enabled an autopilot setting, which only ever sends drafts the AI judged as ready and within caps the customer controls ## 5. How We Share Personal Information We do not sell personal information and we do not share it for cross-context behavioral advertising. We share it only as follows. ### Sub-processors Vendors that process data on our behalf to run the Service. The full list, with locations, transfer safeguards, and a change log, is maintained on the [Sub-processors](/subprocessors) page, which is the authoritative version of the summary below. | Service | Purpose | Location | | --- | --- | --- | | Vercel, Inc. | Application hosting, serverless compute, cookieless analytics, and the AI Gateway that routes our model calls | United States | | Supabase, Inc. | Authentication and the production Postgres database (AWS us-east-2) | United States | | Amazon Web Services, Inc. (Amazon Bedrock) | Hosts the primary outreach-writing model (Moonshot AI's Kimi K2.5) in AWS US regions. Starlight pins every writer call to this host through the Vercel AI Gateway, so prompts never reach Moonshot AI's own API | United States | | Meta Platforms, Inc. | Judging, planning, and chat agent reasoning (Muse Spark) | United States | | xAI Corp. | X (Twitter) search for Social listening, query parsing, scoring and classification (Grok) | United States | | Anthropic, PBC | Outage fallback for the writer and judges (Claude) | United States | | Google LLC | Grounded reply drafting with Google Search (Gemini); also the Gmail and Calendar APIs you connect | United States | | OpenAI, L.L.C. | Web research on prospects and companies, meeting prep, the draft revision pass, and the outreach fallback tier (GPT-6) | United States | | Apollo.io (ZenLeads Inc.) | Lead search, contact and company enrichment, phone reveals, job-change detection | United States | | Resend, Inc. | Transactional email from Starlight itself (welcome, invites, notifications, booking confirmations) | United States | | Clearout | Email address verification before a draft is sent | India | | Stripe, Inc. | Subscription billing, hosted checkout, and the billing portal | United States | | SerpApi, LLC | Google Maps results for Local search; Google results for Reddit threads and G2/Capterra reviews | United States | | Perplexity AI, Inc. | Web search behind prospect and company research, signal and news detection, meeting prep, website scans, and Reddit and LinkedIn discovery in Social listening, called through the Vercel AI Gateway | United States | | HarvestAPI (Aventra Technologies Limited) | LinkedIn public post search for Social listening | Hong Kong | | Reddit, Inc. | Reddit Data API to read the full text of public threads surfaced in Social | United States | | Openmart, Inc. | Local-business database behind Local search: business listings (name, address, phone, website, published inboxes, social links, ratings, ownership) and owner / decision-maker contact lookup for businesses you search | United States | | TinyFish, Inc. | Web search for Reddit threads, public LinkedIn posts, and G2/Capterra reviews in Social listening, and fetching the public pages those searches return (thread and post bodies, cited news articles) | United States | | Logo.dev | Company logos shown in the app | United States | | MapTiler AG | Map tiles for Local search and the Metrics globe, loaded by your browser | Switzerland | | OpenStreetMap Foundation (Nominatim) | City boundary outlines for Local search, fetched server-side | United Kingdom | ### Services you connect When you connect your own accounts, we exchange data with those providers on your instruction, under your agreement with them: | Service | Purpose | Data exchanged | | --- | --- | --- | | Gmail and Google Calendar | Send outreach, read replies to threads Starlight started, sync meetings | Outreach messages, reply threads, calendar events | | Microsoft Outlook and Microsoft 365 Calendar | Send outreach, read replies to threads Starlight started, sync meetings | Outreach messages, reply threads, calendar events | | HubSpot, Salesforce, Attio | Two-way contact sync with your CRM | Contact and company records you choose to import or export | | LinkedIn, X, Reddit (via the Chrome extension) | Deliver approved messages and read your own messaging and search results in your browser | Nothing is sent to these platforms by Starlight's servers; see the Chrome Extension section of the Privacy Policy | ### LinkedIn account access Customers of the Starlight service may share the login for their own LinkedIn account with Starlight, in onboarding or later from Connectors, so that outreach can be sent from their own LinkedIn profile. The login email and password are encrypted at rest with AES-256-GCM and are never returned to any browser except when Starlight staff reveal them to sign in, and every reveal is written to an audit log. Once staff are signed in, the internal build of the Starlight Chrome extension that staff run on Starlight-controlled devices may capture the LinkedIn browser session cookies for that account and store them encrypted, so that the account is not signed in from a new device on every visit; the same build may read the LinkedIn verification code from the customer's connected mailbox when LinkedIn sends one. Starlight staff act in the account under LinkedIn's terms as the customer's authorized user. You can withdraw access at any time from Connectors, which deletes the stored login and session immediately, by changing your LinkedIn password, or by telling us to stop; cancelling the service or deleting your account also deletes them. The two-factor authentication choice and notes you leave are stored alongside the login. If you use an authenticator app and choose to share its setup key, the key is encrypted at rest the same way, is never returned to any browser, and is used only to generate the current sign-in code for staff, with every code generated written to the audit log. If LinkedIn texts you a code instead, a code you type into Connectors at staff request is stored encrypted, shown to staff once, and deleted when read or after 10 minutes. LinkedIn is not a sub-processor: Starlight's servers never send LinkedIn your data. ### Other recipients - **Your team**: teammates in your Starlight company can see the workspace's contacts, drafts, and activity - **AI clients you authorize**: MCP and OAuth clients you connect receive the data their tool calls return - **Recipients of your messages**: the content you send, your name, signature, and booking links - **Professional advisors**: lawyers, accountants, and insurers, under confidentiality - **Authorities**: where we believe in good faith that disclosure is required by law or necessary to protect rights, safety, or property - **Business transferees**: in connection with a merger, acquisition, financing, or sale of assets, with notice to you where required ## 6. Data Retention We keep personal information for as long as needed for the purposes above, then delete or anonymize it. The criteria are the nature and sensitivity of the data, the purpose it serves, and our legal obligations. Current retention periods: | Data | Retained | | --- | --- | | Account and workspace data | Life of the account; deleted when you delete the account | | Prospect, lead, and contact records | Life of the customer's account, or until a verified deletion request from the person concerned | | Outreach drafts, sent messages, replies | Life of the account | | AI research cache | 72 hours | | Connected-account tokens (email, calendar, CRM) | Until you disconnect the integration or delete the account; encrypted at rest | | Extension tokens | Until revoked from Connectors or the account is deleted | | LinkedIn login, browser session, authenticator setup key, two-factor notes (service customers) | Until you revoke access from Connectors, the service is cancelled, or the account is deleted; encrypted at rest | | Suppression (unsubscribe) list | Indefinitely, so an opted-out address is never contacted again | | Billing records | As required by tax and accounting law, typically 7 years | | Hosting and request logs | Per our hosting providers' standard retention, typically 30 days or less | | Backups | Rolling backups kept by our database provider are overwritten within its standard window; deleted data ages out of them | ## 7. Security and Incident Notification We use technical and organizational measures designed to protect personal information: TLS for all data in transit, encryption at rest, AES-256-GCM encryption for integration tokens, passwordless authentication, per-workspace isolation enforced by database row-level security, least-privilege access, and a vulnerability disclosure program. Details are on the [Security](/security) page. No system is perfectly secure, and we cannot guarantee the security of your information. If a personal data breach occurs, we will notify affected customers without undue delay and, where we are the controller and the law requires it, the relevant supervisory authority within 72 hours of becoming aware, in accordance with GDPR Article 33 and applicable US state breach-notification laws. Where we are a processor, we notify the customer so they can meet their own obligations. ## 8. International Data Transfers Starlight is based in the United States and our production infrastructure is hosted there. If you use the Service from the EEA, UK, or Switzerland, your personal information is transferred to and processed in the United States, which does not have an adequacy decision from the European Commission. For those transfers we rely on the European Commission's [Standard Contractual Clauses (2021/914)](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en), the UK International Data Transfer Addendum, and the Swiss variations, as set out in our [DPA](/dpa). Several of our sub-processors are also certified under the [EU-US Data Privacy Framework](https://www.dataprivacyframework.gov/); the [Sub-processors](/subprocessors) page shows which. You can ask us for a copy of the safeguards in place by emailing [privacy@joinstarlight.com](mailto:privacy@joinstarlight.com). ## 9. Your Choices and Rights Depending on where you live, you may have the right to: - **Access** the personal information we hold about you and learn how it is used - **Correct** inaccurate information - **Delete** your information (account deletion is in Settings, and removes all workspace data, messages, and integration tokens) - **Export** your data in a portable format (contacts and messages export from the app) - **Object** to processing based on legitimate interests, including direct marketing, and **restrict** processing while a dispute is resolved - **Withdraw consent** where processing is based on consent, without affecting prior processing - **Opt out of marketing**: use the unsubscribe link in any marketing email; service emails continue while you have an account - **Revoke** any connected integration, extension token, or MCP client at any time from Connectors and Settings, and withdraw LinkedIn access given to Starlight staff at any time from Connectors (which deletes the stored login and session), by changing your password, or by telling us to stop - **Appeal** a decision we make on your request, and **complain** to your data protection authority ### How to exercise them Email [privacy@joinstarlight.com](mailto:privacy@joinstarlight.com). To protect your data we verify requests: if you have an account, write from the account's email address or from inside the app; if you were contacted by a customer, write from the address that was contacted, or tell us which address it was. An authorized agent may submit a request on your behalf with written permission from you, and we may confirm the request with you directly. We respond within 30 days (45 days where state law allows and we tell you why), free of charge unless requests are manifestly excessive. We never discriminate against you for exercising your rights. ### Do Not Track and Global Privacy Control We do not sell or share personal information or serve targeted advertising, so there is nothing for a Do Not Track or Global Privacy Control signal to opt you out of. We treat every visitor as opted out of those activities already. ## 10. Information for People Our Customers Contact If you received a message from a company using Starlight, that company chose to contact you and is the controller of your information for that campaign. This section is our notice to you under GDPR Article 14 and similar laws. - **Where your data came from**: a B2B data provider (most often Apollo.io), your public LinkedIn or X profile, a public post you made, the customer's CRM, or a network the customer imported. We process business contact details and professional information, not sensitive data - **Why**: the customer believed you might be interested in their product based on your role and company. AI wrote the draft; a person at the customer approved it, or the customer chose to let approved drafts send automatically - **How to stop it**: reply to the sender, use the unsubscribe link where the message includes one, or email [privacy@joinstarlight.com](mailto:privacy@joinstarlight.com). We add your address to a permanent suppression list checked before every send by every customer, and we delete your contact record on a verified request - **Your rights**: everything in Section 9 applies to you. You can also contact the customer directly; they are responsible for responding about their own use ## 11. Cookies and Similar Technologies We use strictly necessary cookies to keep you signed in, and cookieless analytics to understand aggregate website usage. We do not use advertising or cross-site tracking cookies. The [Cookie Notice](/cookies) lists every cookie and storage key and explains how to manage them, including the consent banner and the Cookie preferences link in the footer of every public page. ## 12. Children The Service is for business use by adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact [privacy@joinstarlight.com](mailto:privacy@joinstarlight.com) and we will delete it. ## 13. State Privacy Rights Notice This section applies to residents of California, Colorado, Connecticut, Virginia, Texas, Oregon, Utah, Montana, and other US states with comprehensive privacy laws, to the extent those laws apply to us. It supplements the rest of this policy. ### Categories of personal information In the 12 months before the date of this policy we collected the following categories, from the sources and for the purposes described in Sections 2 and 3: | Category (Cal. Civ. Code § 1798.140) | Examples | Disclosed to | | --- | --- | --- | | Identifiers | Name, email, IP address, account ID, LinkedIn URL | Sub-processors; services you connect | | Professional or employment information | Job title, employer, employment history | Sub-processors; services you connect | | Commercial information | Plan, block usage, invoices | Stripe; our hosting providers | | Internet or network activity | Pages viewed, feature usage, request logs | Our hosting providers | | Communications | Drafts, messages, replies, notes, support emails | Sub-processors; recipients you message | | Inferences | AI lead-fit scores and draft-quality scores | AI model providers | We have not sold or shared personal information in the preceding 12 months, and we do not sell or share it. We do not collect or process sensitive personal information to infer characteristics about you. We do not use or disclose personal information for targeted advertising or for profiling with legal or similarly significant effects. ### Your rights You may request to know, access, correct, delete, and obtain a portable copy of your personal information, and to appeal a denial, as described in Section 9, at [privacy@joinstarlight.com](mailto:privacy@joinstarlight.com). Because we do not sell, share, or use personal information for targeted advertising, there is no opt-out to exercise and Global Privacy Control signals are honored by default. ### Additional state notices - **California Shine the Light** (Civil Code § 1798.83): we do not disclose personal information to third parties for their own direct marketing - **Nevada**: we do not sell covered information as defined in NRS 603A. To record an opt-out request anyway, email [privacy@joinstarlight.com](mailto:privacy@joinstarlight.com) - **Texas**: we do not sell sensitive personal data - **De-identified data**: where we create de-identified data, we maintain it as de-identified and do not attempt to re-identify it except to test our de-identification ## 14. Notice to European Users This section applies to people in the European Economic Area, the United Kingdom, and Switzerland ("Europe"). "Personal information" in this policy means "personal data" as defined in the GDPR. - **Controller**: Starlight Software LLC is the controller for customer, user, and visitor data. For data about people our customers contact, the customer is the controller and Starlight is their processor under the [DPA](/dpa) - **Representative and DPO**: Starlight has no establishment in Europe and has not appointed a representative under GDPR Article 27 or a Data Protection Officer. Contact [privacy@joinstarlight.com](mailto:privacy@joinstarlight.com) for all matters - **Legal bases**: set out in the table in Section 3. Where we rely on legitimate interests, we have balanced them against your rights; you may object at any time - **Retention**: Section 6 - **Transfers outside Europe**: Section 8 - **Your rights**: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, as described in Section 9 - **Complaints**: you may lodge a complaint with the supervisory authority where you live or work. EEA authorities are listed at [edpb.europa.eu](https://edpb.europa.eu/about-edpb/about-edpb/members_en). In the UK, the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, +44 303 123 1113, [ico.org.uk](https://ico.org.uk/make-a-complaint/). In Switzerland, the Federal Data Protection and Information Commissioner, [edoeb.admin.ch](https://www.edoeb.admin.ch/) - **Sensitive data**: please do not send us special-category data (health, biometrics, political opinions, and so on). The Service does not need it and our customers agree in the DPA not to submit it - **Automated decision-making**: we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects ## 15. Google API Services and Microsoft Graph Starlight's use and transfer of information received from Google APIs to any other app will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We only access Gmail and Google Calendar data that is necessary to provide the features you have connected, and we do not use Google user data to train generalized AI or machine learning models. Our use of data obtained from Microsoft Graph (Outlook and Microsoft 365 Calendar) is likewise limited to providing the features you have connected. We do not transfer, sell, or use Microsoft Graph data for advertising, and we do not use it to train generalized AI models. ## 16. Chrome Extension The Starlight Chrome extension is a first-party browser extension, published on the Chrome Web Store, that bridges Starlight with LinkedIn, X, and (optionally) Reddit. It is optional; Starlight works without it. This section describes every data flow it takes part in, as of extension version 1.7. ### What the extension stores locally - **Bearer token**, issued when you sign in, in `chrome.storage.local`. It authenticates the extension to joinstarlight.com. Revoke it any time from Connectors in your dashboard - **In-flight dispatch metadata** (recipient URL, channel, draft body) in `chrome.storage.session`, keyed by tab, while a send is in progress. Cleared when the tab closes or the send reports - **Autopilot preference** and the day's send count in `chrome.storage.local` - **Scan run state** in `chrome.storage.session` while a background scan task is running, so an interrupted run can be recovered - **Learned element selectors** in `chrome.storage.local`, so the extension keeps working when LinkedIn changes its page markup ### What the extension sends to Starlight - **Send-status callbacks**: after a draft is sent, the draft ID and outcome (sent, failed, aborted), plus the recipient's LinkedIn member ID read from the conversation so later replies can be matched exactly - **Autopilot poll**: while Autopilot is on, a request roughly every 90 seconds for the next draft you have approved. No page data is sent in this request - **Quick Sync**: when you run a sync from the Inbox, the extension opens your LinkedIn messaging page in a background tab, opens recent inbound conversations, and sends Starlight the sender's name, profile identifier, last message, and timestamp so replies from people you contacted through Starlight appear in your Inbox. It also records which connection requests were accepted - **Social scan results**: when extension-powered scans are on (Social settings, on by default), Starlight queues search tasks for your listening topics. The extension opens your own logged-in LinkedIn content search or X search in a background tab, reads the visible public posts (text, author, profile URL, engagement counts), and sends them to Starlight. It reads only; it never posts, likes, follows, or connects during a scan - **Engagement mining**: for competitor watches you enable, the extension opens the competitor's public LinkedIn company page, reads who reacted to its recent posts (name, headline, profile URL), and sends that list to Starlight as prospecting data - **Reddit thread text**: if you grant the optional reddit.com permission from the extension's options page, the extension fetches the public text of Reddit threads surfaced in Social from your browser and sends it to Starlight so suggested comments answer the real post - **Selector healing telemetry**: when a LinkedIn element cannot be found, the extension sends Starlight a structural snapshot of the page (element roles and labels, no message bodies) so Starlight, sometimes with help from an AI model, can identify the right element. Successful fixes are shared with other users so one person's fix heals everyone ### Autopilot Autopilot is **on by default** and can be turned off from the extension popup at any time. While it is on, the extension delivers drafts you have already approved inside Starlight, one at a time, by opening the recipient's conversation and clicking Send on your behalf, capped at 25 sends per day. It only ever sends drafts that exist because you, your teammate, or an autopilot setting you enabled approved them. With Autopilot off, the extension prefills the composer and waits for you to press Send yourself. Before any automated click, the extension verifies that it is in the right conversation and that the approved text is in the box; if either check fails, it aborts and reports a failure rather than sending. ### Background activity Two things run without you being on a page: the Autopilot poll (while Autopilot is on) and the social scan heartbeat, which checks for queued scan tasks every few minutes and runs at most a handful of read-only scans per day (while extension-powered scans are on). Both stop when you sign out, revoke the token, or turn the feature off. Nothing else runs in the background. ### What the extension never does - Post, comment, like, follow, or connect on your behalf except to deliver a specific draft or comment you approved in Starlight - Read your personal messages, feed, or profile beyond the surfaces listed above - Send data to anyone other than joinstarlight.com. All extension traffic flows between your browser and Starlight - Store or transmit your LinkedIn, X, or Reddit passwords or session cookies. This is true of the public Web Store extension. The separate internal build that Starlight staff run on Starlight's own devices to send outreach for service customers does capture the LinkedIn session cookies of customers who have shared their LinkedIn access, sends them only to Starlight where they are stored encrypted, and checks which LinkedIn member the browser is signed in as before every send so it never sends from the wrong account. That internal build is never published to the Web Store ### Permissions and host access - **Chrome permissions**: `storage` (token, preferences, learned selectors), `alarms` (the Autopilot poll and scan heartbeat), `activeTab` and `scripting` (to run the content script in the tab it opens for a send or scan) - **Host access**: `*.linkedin.com`, `*.x.com`, `*.twitter.com`, and `joinstarlight.com`. `*.reddit.com` is optional and only granted if you choose to from the options page ### Disconnecting the extension Revoke the extension token from Connectors in your Starlight dashboard, or uninstall the extension from `chrome://extensions`, which also removes everything it stored locally. After revocation the extension cannot communicate with your account until you sign in again. ### LinkedIn, X, and Reddit LinkedIn, X, and Reddit are not sub-processors: Starlight's servers never log into them and never send them your data. The extension acts in your own browser, under your own account. Your use of those platforms is governed by their terms and privacy policies, and you are responsible for making sure your use of the extension, including Autopilot and scans, complies with them. ## 17. Changes to This Policy We may update this Privacy Policy from time to time. For material changes we will notify users by email or in-app notification before they take effect. The "Last updated" date at the top of this page shows the current version; previous versions are available on request. ## 18. Contact Privacy questions and requests: [privacy@joinstarlight.com](mailto:privacy@joinstarlight.com). Legal notices: [legal@joinstarlight.com](mailto:legal@joinstarlight.com). We aim to acknowledge every privacy request within 5 business days and resolve it within 30 days. --- # Cookie Notice Last updated: August 20, 2026 The cookies and browser storage Starlight uses, and how to control them. This Cookie Notice explains how Starlight Software LLC ("Starlight", "we") uses cookies and similar browser storage on joinstarlight.com, including the app, the docs, and public booking pages (the "Sites"). It is part of our [Privacy Policy](/privacy). ## What Cookies Are Cookies are small files a website places in your browser to remember something between requests, such as that you are signed in. Browser web storage (`localStorage` and `sessionStorage`) serves a similar purpose without being sent to the server on every request. Session cookies expire when you close the browser; persistent cookies stay until they expire or you delete them. First-party cookies are set by us; third-party cookies are set by another company's service. ## What We Use We do not use advertising cookies, social-media cookies, session-replay tools, or any cookie that tracks you across other websites. | Type | Name | Set by | Purpose | Duration | How to control | | --- | --- | --- | --- | --- | --- | | Strictly necessary | `sb--auth-token` | Starlight (Supabase Auth) | Keeps you signed in and protects requests to your account | Session, refreshed while you use the app | Required. Sign out to clear it | | Strictly necessary | `starlight_ref` | Starlight | Remembers a referral code from a link you followed until you sign up | 30 days | Clear site data; not set unless you arrive via a referral link | | Strictly necessary (web storage) | `starlight:cookie-consent` | Starlight | Remembers your cookie choice so the banner does not reappear | Until cleared | Clear site data to reset the banner | | Functional (web storage) | `starlight:*`, `sidebar-sections-open`, table and view preferences | Starlight | Remembers UI preferences: collapsed sections, dismissed tips, sound setting, table layouts | Until cleared | Clear site data | | Analytics | None (cookieless) | Vercel Analytics, Vercel Speed Insights | Aggregate page views and load performance. No identifier is stored in your browser and you are not tracked across sites | n/a | Reject analytics in the consent banner or the Cookie preferences link in the footer | | Payments | Stripe cookies | Stripe | Fraud prevention and session handling on Stripe's hosted checkout and billing portal pages, which open on stripe.com | Per Stripe's notice | See Stripe's cookie policy; not set on joinstarlight.com itself | ### Embedded booking pages Customers can embed their Starlight booking page in their own website in an iframe. The embed sets no cookies of its own; the host website's cookies are governed by that website's notice. ### Maps The Local search map and the Metrics globe load tiles from MapTiler. That request carries your IP address, like any image request, but MapTiler sets no cookies on our pages. ## Your Choices - **Consent banner**: the first time you visit a public page you can accept all, reject non-essential, or choose per category. Change your choice any time with the Cookie preferences link in the footer. Your choice is stored in your browser, not on our servers, so clearing site data resets it - **Browser settings**: every major browser lets you block or delete cookies and site data. Blocking the strictly necessary cookie will sign you out of Starlight - **Do Not Track and Global Privacy Control**: we do not sell or share personal information or serve targeted advertising, so these signals have nothing further to opt you out of ## Changes We update this notice when the cookies we use change. The "Last updated" date at the top reflects the current version. ## Questions Email [privacy@joinstarlight.com](mailto:privacy@joinstarlight.com). --- # Data Processing Addendum Last updated: August 20, 2026 How Starlight processes personal data on your behalf under GDPR, UK GDPR, Swiss FADP, and US state privacy laws. > **Info:** This DPA applies automatically to every customer as part of the [Terms of Service](/terms); nothing needs to be signed for it to take effect. Customers whose procurement process needs a countersigned copy can request one at [legal@joinstarlight.com](mailto:legal@joinstarlight.com). This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between the customer that accepted the Agreement ("Customer") and Starlight Software LLC, a California limited liability company ("Starlight") (each a "Party"). It governs Starlight's Processing of Personal Data on Customer's behalf in providing the Service. ## 1. Definitions - **Applicable Data Protection Laws**: all privacy and data-protection laws applicable to the Processing, including, as applicable, the GDPR, the UK GDPR, the Swiss FADP, and the State Privacy Laws - **Customer Data**: data provided or made available by or on behalf of Customer to Starlight for Processing in connection with the Service - **Personal Data**: Customer Data that relates to an identified or identifiable natural person under Applicable Data Protection Laws. It excludes information Starlight collects independently about Customer's own personnel as Starlight's customers, which is governed by the Privacy Policy - **GDPR**: Regulation (EU) 2016/679; **UK GDPR**: the GDPR as incorporated into UK law by the Data Protection Act 2018; **FADP**: the Swiss Federal Act on Data Protection of 25 September 2020 - **State Privacy Laws**: the comprehensive US state consumer privacy laws in force and applicable to the Processing, including the California Consumer Privacy Act as amended ("CCPA") - **Controller**, **Processor**, **Data Subject**, **Processing**, **Supervisory Authority**: as defined in the GDPR, and read to include the equivalent terms (business, service provider, consumer) under the State Privacy Laws - **Sub-processor**: a third party engaged by Starlight to Process Personal Data in connection with the Service - **Security Incident**: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data in Starlight's possession. Unsuccessful attempts (port scans, failed log-ins, denial-of-service attacks that do not compromise data) are not Security Incidents - **SCCs**: the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914; **UK Addendum**: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under s.119A of the Data Protection Act 2018 - **Restricted Transfer**: a transfer of Personal Data from the EEA, the UK, or Switzerland to a country that lacks an adequacy decision from the relevant authority, where the transfer would be prohibited without a legal basis under Chapter V of the GDPR or its UK and Swiss equivalents ## 2. Scope, Roles, and Duration - Customer is the Controller (or a Processor acting for another Controller) and Starlight is the Processor of Personal Data. The details of the Processing are in Annex 1 - This DPA remains in effect for as long as Starlight Processes Personal Data, regardless of the expiry or termination of the Agreement - Annex 4 (European terms) applies to Processing subject to the GDPR, UK GDPR, or FADP. Section 11 (State Privacy Laws) applies to Processing subject to those laws ## 3. Customer Instructions Starlight will Process Personal Data only on Customer's documented instructions, which consist of the Agreement, this DPA, and Customer's use and configuration of the Service (including searches run, contacts added, drafts approved, Agents configured, automation settings enabled, and integrations connected). Starlight will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws, and may suspend the relevant Processing until the instruction is confirmed or changed. Instructions that fall outside the Service's functionality require a written agreement. ## 4. Security - **Measures**: Starlight implements and maintains the technical and organizational measures in Annex 2, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the Processing. Starlight may update them provided the overall level of protection does not materially decrease - **Personnel**: Starlight ensures that persons authorized to Process Personal Data are bound by confidentiality obligations - **Security Incidents**: Starlight will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident, describe what is known, the likely consequences, and the measures taken or proposed, and provide reasonable cooperation. Notification is not an admission of fault. Customer is responsible for any notifications it must make to Supervisory Authorities or Data Subjects, and will consult Starlight before a notification that names Starlight - **Customer responsibilities**: Customer is responsible for securing its own accounts, credentials, devices, and connected services, and for configuring the Service appropriately for the risk of the Personal Data it chooses to Process ## 5. Data Subject Rights Taking into account the nature of the Processing, Starlight will assist Customer, by appropriate technical and organizational measures, in responding to requests from Data Subjects to exercise their rights. The Service provides self-serve tools to view, edit, export, and delete contact records, and a suppression list that blocks further contact. If Starlight receives a request directly, it will notify Customer promptly (unless prohibited by law) and, where the request concerns a person contacted through the Service, may add the requester to the suppression list and advise them to contact Customer. Assistance beyond the Service's functionality is provided at Starlight's then-current rates. ## 6. Customer Responsibilities - Customer has provided all notices and obtained all consents and permissions required under Applicable Data Protection Laws for Starlight to Process Personal Data as contemplated by the Agreement, including for outreach to Data Subjects and for the import of third-party contact data - Customer has, and will maintain, a valid legal basis for each Processing activity it instructs (including, where applicable, Articles 6 and 14 of the GDPR) - **Restricted Data**: Customer will not submit to the Service any government identification numbers, health or medical information, biometric or genetic data, financial account credentials, payment card data, precise geolocation, data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation, criminal history, data of children under 16, or other special categories of data. The Service is not designed for it and Starlight does not accept responsibility for it - Customer is responsible for its use of the Service in compliance with the [Acceptable Use Policy](/acceptable-use) ## 7. Sub-processors - **Authorization**: Customer generally authorizes Starlight to engage Sub-processors. The current list, with locations and transfer safeguards, is Annex 3, maintained at [joinstarlight.com/subprocessors](/subprocessors) - **Obligations**: Starlight imposes on each Sub-processor, by written contract, data-protection obligations no less protective than this DPA to the extent applicable to the services it provides, and remains liable for the Sub-processor's performance - **Changes**: Starlight will update the list and notify the owner of each Customer workspace by email at least **15 days** before a new Sub-processor begins Processing Personal Data. Customer may object on reasonable, documented data-protection grounds within that period. The Parties will work in good faith to resolve the objection; if they cannot within a reasonable time, Customer may terminate the affected Service on written notice as its sole remedy, and Starlight will refund any prepaid fees for the unused portion of the term ## 8. Audits Starlight will make available the information reasonably necessary to demonstrate compliance with this DPA, including its [security documentation](/security) and, under NDA, the third-party audit reports of its infrastructure providers. Where those do not reasonably satisfy a requirement of Applicable Data Protection Laws or a Supervisory Authority, Customer may, once per year and on at least 30 days' written notice, conduct or commission an audit of Starlight's compliance, during business hours, under a mutually agreed plan, at Customer's expense (including Starlight's reasonable time at its then-current rates), by an auditor who is not a competitor and is bound by confidentiality. Customer will share the results with Starlight. ## 9. Return and Deletion - During the term, Customer can export contacts, messages, and activity from the Service at any time - On termination or expiry, Starlight stops Processing Personal Data other than for storage. Customer may export its data, or request deletion, for **30 days** after termination; Starlight will comply within a commercially reasonable time - After that period Starlight deletes or anonymizes the Personal Data, subject to retention required by law (kept confidential, Processed only for that purpose, and deleted when the requirement ends) and to the time it takes for deleted data to age out of encrypted backups - Suppression-list entries (email addresses that have opted out) are retained indefinitely as the technical means of honoring the opt-out; Customer instructs this - Deletion certificates are provided on written request ## 10. Artificial Intelligence - Starlight will not use Personal Data to train, fine-tune, or improve any AI or machine-learning model, its own or a third party's, except as strictly necessary to provide the Service on Customer's instructions (for example, scoring a specific draft) or as Customer expressly authorizes in writing - Starlight contractually prohibits its Sub-processors, including AI model providers, from using Personal Data for their own model training, and enables zero-data-retention terms where offered - The Service does not make decisions about Data Subjects based solely on automated Processing that produce legal or similarly significant effects. AI outputs (lead-fit scores, draft-quality scores, suggested messages) are recommendations that Customer reviews or, where Customer enables an autopilot setting, authorizes in advance within caps it controls. On request, Starlight will provide meaningful information about the logic involved, excluding trade secrets ## 11. State Privacy Laws To the extent Personal Data is subject to the State Privacy Laws, Starlight is a service provider, contractor, or processor and: - will Process Personal Data only for the limited and specified business purpose of providing the Service under the Agreement, and will comply with the obligations applicable to it under the State Privacy Laws, providing the same level of privacy protection they require - will not sell or share Personal Data; will not retain, use, or disclose it for any purpose, including a commercial purpose, other than providing the Service; will not retain, use, or disclose it outside the direct business relationship with Customer; and will not combine it with Personal Data received from another source, except as permitted by the State Privacy Laws - will notify Customer if it determines it can no longer meet its obligations, and grants Customer the right to take reasonable and appropriate steps to stop and remediate unauthorized use - acknowledges Customer's right to take reasonable steps to ensure Starlight's Processing is consistent with Customer's obligations, including the audit rights in Section 8; notice of Sub-processor changes under Section 7 satisfies any notice-and-objection requirement - certifies that it understands and will comply with these restrictions ## 12. Liability and General - Each Party's liability under this DPA, including the SCCs, is subject to the exclusions and limitations of liability in the Agreement, except where the SCCs give Data Subjects rights that cannot be limited - If this DPA conflicts with the Agreement, this DPA prevails; if the SCCs conflict with this DPA or the Agreement, the SCCs prevail for the Restricted Transfer to which they apply - Starlight may update this DPA on notice to maintain compliance with Applicable Data Protection Laws, including replacing the SCCs with a successor mechanism, provided the change does not materially reduce the protection of Personal Data. Other changes follow the Agreement's amendment terms - Notices to Starlight under this DPA go to [legal@joinstarlight.com](mailto:legal@joinstarlight.com); notices to Customer go to the workspace owner's email address ## Annex 1: Details of Processing | Item | Description | | --- | --- | | Data exporter | Customer, the entity that accepted the Agreement. Contact: the workspace owner's email. Role: Controller (or Processor for its own clients) | | Data importer | Starlight Software LLC, a California limited liability company. Contact: [legal@joinstarlight.com](mailto:legal@joinstarlight.com). Role: Processor | | Categories of Data Subjects | Customer's personnel and teammates; prospects and leads Customer researches or contacts; authors of public posts surfaced to Customer; people in networks or CRMs Customer imports; invitees who book meetings with Customer | | Categories of Personal Data | Business contact details (name, work email, business phone, job title, employer, LinkedIn URL, location); employment history and company firmographics; publicly available research facts and public posts; outreach messages, replies, and engagement events; meeting bookings and notes; usage and log data | | Sensitive data | None. Customer agrees not to submit Restricted Data (Section 6) | | Frequency | Continuous, as initiated by Customer's use of the Service and the automations Customer enables | | Nature and purpose | Hosting, storage, enrichment, AI-assisted drafting and scoring, sending on Customer's connected accounts, reply tracking, scheduling, analytics, and related support, to provide the Service | | Duration | The term of the Agreement plus the return-and-deletion period in Section 9 | | Transfers to Sub-processors | As described in Annex 3, for the purposes stated there | ## Annex 2: Security Measures The public description is maintained on the [Security](/security) page. In summary, Starlight maintains: 1. Encryption of Personal Data in transit (TLS) and at rest, with additional application-level AES-256-GCM encryption of integration credentials 2. Logical tenant isolation enforced in the application and by database row-level security on every table 3. Passwordless authentication, session revocation, and least-privilege, multi-factor-protected access to production systems 4. Minimal OAuth scopes for connected services and no custody of third-party platform credentials 5. Secrets management outside source control; dependency vulnerability monitoring; change management through version control and review 6. Encrypted daily backups and provider-managed availability and DDoS protection 7. Logging of security-relevant events and account activity 8. An incident-response process with the notification commitments in Section 4, and a public vulnerability-disclosure program 9. Contractual AI-provider restrictions (no training, zero-data-retention where available) and treatment of third-party content as untrusted input 10. Sub-processors selected for equivalent safeguards, including SOC 2 Type II reports for infrastructure providers ## Annex 3: Sub-processors The authoritative list is [joinstarlight.com/subprocessors](/subprocessors). As of the date of this DPA: | Sub-processor | Purpose | Location | Safeguard | | --- | --- | --- | --- | | Vercel, Inc. | Application hosting, serverless compute, cookieless analytics, and the AI Gateway that routes our model calls | United States | DPF | | Supabase, Inc. | Authentication and the production Postgres database (AWS us-east-2) | United States | DPF | | Amazon Web Services, Inc. (Amazon Bedrock) | Hosts the primary outreach-writing model (Moonshot AI's Kimi K2.5) in AWS US regions. Starlight pins every writer call to this host through the Vercel AI Gateway, so prompts never reach Moonshot AI's own API | United States | DPF | | Meta Platforms, Inc. | Judging, planning, and chat agent reasoning (Muse Spark) | United States | DPF | | xAI Corp. | X (Twitter) search for Social listening, query parsing, scoring and classification (Grok) | United States | SCCs | | Anthropic, PBC | Outage fallback for the writer and judges (Claude) | United States | DPF | | Google LLC | Grounded reply drafting with Google Search (Gemini); also the Gmail and Calendar APIs you connect | United States | DPF | | OpenAI, L.L.C. | Web research on prospects and companies, meeting prep, the draft revision pass, and the outreach fallback tier (GPT-6) | United States | DPF | | Apollo.io (ZenLeads Inc.) | Lead search, contact and company enrichment, phone reveals, job-change detection | United States | SCCs | | Resend, Inc. | Transactional email from Starlight itself (welcome, invites, notifications, booking confirmations) | United States | SCCs | | Clearout | Email address verification before a draft is sent | India | SCCs | | Stripe, Inc. | Subscription billing, hosted checkout, and the billing portal | United States | DPF | | SerpApi, LLC | Google Maps results for Local search; Google results for Reddit threads and G2/Capterra reviews | United States | None required | | Perplexity AI, Inc. | Web search behind prospect and company research, signal and news detection, meeting prep, website scans, and Reddit and LinkedIn discovery in Social listening, called through the Vercel AI Gateway | United States | SCCs | | HarvestAPI (Aventra Technologies Limited) | LinkedIn public post search for Social listening | Hong Kong | None required | | Reddit, Inc. | Reddit Data API to read the full text of public threads surfaced in Social | United States | None required | | Openmart, Inc. | Local-business database behind Local search: business listings (name, address, phone, website, published inboxes, social links, ratings, ownership) and owner / decision-maker contact lookup for businesses you search | United States | None required | | TinyFish, Inc. | Web search for Reddit threads, public LinkedIn posts, and G2/Capterra reviews in Social listening, and fetching the public pages those searches return (thread and post bodies, cited news articles) | United States | None required | | Logo.dev | Company logos shown in the app | United States | None required | | MapTiler AG | Map tiles for Local search and the Metrics globe, loaded by your browser | Switzerland | None required | | OpenStreetMap Foundation (Nominatim) | City boundary outlines for Local search, fetched server-side | United Kingdom | None required | ## Annex 4: European Terms ### Application This Annex applies to Processing of Personal Data subject to the GDPR, the UK GDPR, or the FADP. ### Impact assessments and consultation Starlight will provide reasonable assistance, at Customer's cost and on written request, with data protection impact assessments and prior consultations with Supervisory Authorities under Articles 35 and 36 of the GDPR, to the extent they relate to Starlight's Processing. ### Restricted Transfers To the extent Customer's provision of Personal Data to Starlight is a Restricted Transfer, the Parties agree as follows. - **EEA transfers**: the SCCs are incorporated into this DPA and deemed signed by the Parties, populated as set out below - **UK transfers**: the SCCs as varied by the UK Addendum apply. Tables 1 to 3 of the UK Addendum are deemed completed with the information in Annex 1, this Annex, and the SCCs as populated below; in Table 4, the data importer may end the Addendum as set out in Section 19 of the Addendum - **Swiss transfers**: the SCCs apply with these modifications: references to the GDPR are to the FADP; the competent Supervisory Authority is the Swiss Federal Data Protection and Information Commissioner; references to EU Member States include Switzerland; and Data Subjects in Switzerland may bring claims before Swiss courts - **New mechanisms**: Starlight may on notice replace the SCCs with a successor or alternative valid transfer mechanism that does not materially reduce protection - **Full-form copies**: on written request, where a Supervisory Authority or Data Subject requires it, Starlight will provide an executed copy of the applicable SCCs for countersignature ### Population of the SCCs 1. **Modules**: Module Two (controller to processor) applies where Customer is a Controller; Module Three (processor to processor) applies where Customer is itself a Processor 2. **Clause 7** (docking clause): not used 3. **Clause 9**: Option 2, general written authorization, with 15 days' notice of changes as set out in Section 7 of this DPA 4. **Clause 11**: the optional language is not used 5. **Clause 13**: all text retained; the competent Supervisory Authority is determined per Clause 13(a) by reference to Customer's establishment or representative, and otherwise the authority Customer notifies to Starlight in writing 6. **Clause 17**: Option 1; the SCCs are governed by the law of Ireland 7. **Clause 18**: disputes are resolved before the courts of Ireland 8. **Annex I** of the SCCs is populated with Annex 1 of this DPA (Customer as data exporter, Starlight as data importer); **Annex II** with Annex 2 of this DPA; **Annex III** with Annex 3 of this DPA 9. The audit provisions of Clauses 8.9(c) and (d) are subject to Section 8 of this DPA; certification of deletion under Clauses 8.5 and 16(d) is provided on written request; Customer is responsible for any notifications to Data Subjects under Clause 15.1(a) and, under Module Three, for notifying its own Controllers --- # Sub-processors Last updated: August 20, 2026 The third parties that process personal data to run Starlight, where they are, and how we notify you of changes. A sub-processor is a third party that processes personal data on Starlight's behalf to deliver the Service. This page is the authoritative list referenced by our [Privacy Policy](/privacy) and incorporated as Annex 3 of our [Data Processing Addendum](/dpa). Every vendor here is bound by a written agreement with data-protection obligations at least as protective as the DPA, and none may use personal data to train AI models. > **Info:** Safeguard column: **DPF** means the vendor is certified under the EU-US Data Privacy Framework (and its UK and Swiss extensions); **SCCs** means we rely on the EU Standard Contractual Clauses with the UK Addendum; **None required** means the vendor receives no personal data from Europe in a form that constitutes a restricted transfer (for example, keyword queries or company domains only). ## Infrastructure | Sub-processor | Purpose | Data shared | Location | Safeguard | | --- | --- | --- | --- | --- | | [Vercel, Inc.](https://vercel.com/legal/privacy-policy) | Application hosting, serverless compute, cookieless analytics, and the AI Gateway that routes our model calls | All application traffic, request logs, model prompts in transit | United States | DPF | | [Supabase, Inc.](https://supabase.com/privacy) | Authentication and the production Postgres database (AWS us-east-2) | Account data and all application data at rest | United States | DPF | ## AI models | Sub-processor | Purpose | Data shared | Location | Safeguard | | --- | --- | --- | --- | --- | | [Amazon Web Services, Inc. (Amazon Bedrock)](https://aws.amazon.com/privacy/) | Hosts the primary outreach-writing model (Moonshot AI's Kimi K2.5) in AWS US regions. Starlight pins every writer call to this host through the Vercel AI Gateway, so prompts never reach Moonshot AI's own API | Prospect business context, your product and brief, cached research facts | United States | DPF | | [Meta Platforms, Inc.](https://www.meta.ai/) | Judging, planning, and chat agent reasoning (Muse Spark) | Prospect business context, drafts being evaluated, your instructions to the agent | United States | DPF | | [xAI Corp.](https://x.ai/legal/privacy-policy) | X (Twitter) search for Social listening, query parsing, scoring and classification (Grok) | Search queries, public post text, lead titles and companies being scored | United States | SCCs | | [Anthropic, PBC](https://www.anthropic.com/privacy) | Outage fallback for the writer and judges (Claude) | Same as the model it stands in for | United States | DPF | | [Google LLC](https://policies.google.com/privacy) | Grounded reply drafting with Google Search (Gemini); also the Gmail and Calendar APIs you connect | Reply threads being drafted, prospect context | United States | DPF | | [OpenAI, L.L.C.](https://openai.com/policies/privacy-policy/) | Web research on prospects and companies, meeting prep, the draft revision pass, and the outreach fallback tier (GPT-6) | Prospect names, titles, and companies being researched; web search results; drafts being revised and their prompt context | United States | DPF | ## Lead and company data | Sub-processor | Purpose | Data shared | Location | Safeguard | | --- | --- | --- | --- | --- | | [Apollo.io (ZenLeads Inc.)](https://www.apollo.io/privacy-policy) | Lead search, contact and company enrichment, phone reveals, job-change detection | Search filters, names, companies, LinkedIn URLs submitted for matching | United States | SCCs | | [Openmart, Inc.](https://www.openmart.com/privacy) | Local-business database behind Local search: business listings (name, address, phone, website, published inboxes, social links, ratings, ownership) and owner / decision-maker contact lookup for businesses you search | The business category and area you search, and the website domains and names of businesses in your results; no account data | United States | None required | ## Email and verification | Sub-processor | Purpose | Data shared | Location | Safeguard | | --- | --- | --- | --- | --- | | [Resend, Inc.](https://resend.com/legal/privacy-policy) | Transactional email from Starlight itself (welcome, invites, notifications, booking confirmations) | Recipient name and email, message content | United States | SCCs | | [Clearout](https://clearout.io/privacy-policy/) | Email address verification before a draft is sent | Recipient email addresses | India | SCCs | ## Payments | Sub-processor | Purpose | Data shared | Location | Safeguard | | --- | --- | --- | --- | --- | | [Stripe, Inc.](https://stripe.com/privacy) | Subscription billing, hosted checkout, and the billing portal | Billing name, email, payment method (card numbers never reach Starlight) | United States | DPF | ## Social and web search | Sub-processor | Purpose | Data shared | Location | Safeguard | | --- | --- | --- | --- | --- | | [SerpApi, LLC](https://serpapi.com/legal) | Google Maps results for Local search; Google results for Reddit threads and G2/Capterra reviews | Search queries (business types, locations, keywords); no account data | United States | None required | | [Perplexity AI, Inc.](https://www.perplexity.ai/hub/legal/privacy-policy) | Web search behind prospect and company research, signal and news detection, meeting prep, website scans, and Reddit and LinkedIn discovery in Social listening, called through the Vercel AI Gateway | Search queries, which can include a prospect's name, title, and company; no account data | United States | SCCs | | [HarvestAPI (Aventra Technologies Limited)](https://harvestapi.io/) | LinkedIn public post search for Social listening | Keyword phrases; no account data | Hong Kong | None required | | [Reddit, Inc.](https://www.reddit.com/policies/privacy-policy) | Reddit Data API to read the full text of public threads surfaced in Social | Thread identifiers; no account data | United States | None required | | [TinyFish, Inc.](https://www.tinyfish.ai/privacy-policy) | Web search for Reddit threads, public LinkedIn posts, and G2/Capterra reviews in Social listening, and fetching the public pages those searches return (thread and post bodies, cited news articles) | Search keyword phrases and public page URLs; no account data | United States | None required | ## Maps and media | Sub-processor | Purpose | Data shared | Location | Safeguard | | --- | --- | --- | --- | --- | | [Logo.dev](https://logo.dev/privacy) | Company logos shown in the app | Company domain names only | United States | None required | | [MapTiler AG](https://www.maptiler.com/privacy-policy/) | Map tiles for Local search and the Metrics globe, loaded by your browser | Your IP address and the map area viewed | Switzerland | None required | | [OpenStreetMap Foundation (Nominatim)](https://osmfoundation.org/wiki/Privacy_Policy) | City boundary outlines for Local search, fetched server-side | Place names only | United Kingdom | None required | ### Notes - **Amazon Web Services, Inc. (Amazon Bedrock)**: Bedrock does not store prompts or completions and does not use them to train models. The model weights are Moonshot AI's; Moonshot receives no data. - **Openmart, Inc.**: Receives only search terms and the public identity of businesses already in your results (name, website domain). SerpApi remains the fallback provider for Local search. - **Perplexity AI, Inc.**: Perplexity states it does not use API customer data to train models. - **HarvestAPI (Aventra Technologies Limited)**: Receives only the keyword phrases compiled from your listening skill, never names, emails, or account data, so no personal data is transferred to it. - **TinyFish, Inc.**: Receives only the keyword phrases compiled from your listening skill and the URLs of public pages its own searches returned, never names, emails, or account data, so no personal data is transferred to it. ## Services You Connect These are your own providers. Starlight exchanges data with them only when you connect an account and only on your instruction, under your agreement with that provider. They are listed for completeness and are not sub-processors. | Service | Purpose | Data exchanged | | --- | --- | --- | | Gmail and Google Calendar | Send outreach, read replies to threads Starlight started, sync meetings | Outreach messages, reply threads, calendar events | | Microsoft Outlook and Microsoft 365 Calendar | Send outreach, read replies to threads Starlight started, sync meetings | Outreach messages, reply threads, calendar events | | HubSpot, Salesforce, Attio | Two-way contact sync with your CRM | Contact and company records you choose to import or export | | LinkedIn, X, Reddit (via the Chrome extension) | Deliver approved messages and read your own messaging and search results in your browser | Nothing is sent to these platforms by Starlight's servers; see the Chrome Extension section of the Privacy Policy | ## How We Notify You of Changes - Before a new sub-processor begins processing personal data, we update this page and email the owner of every workspace at least **15 days** in advance - You may object on reasonable data-protection grounds within that window by emailing [legal@joinstarlight.com](mailto:legal@joinstarlight.com). If we cannot resolve the objection, you may terminate the affected Service as your remedy, as set out in Section 7 of the [DPA](/dpa) - Replacing a vendor with an equivalent one, or a vendor changing its own corporate name or hosting region, is announced the same way ## Change Log | Date | Change | | --- | --- | | September 24, 2026 | Added Perplexity AI, which now runs the web searches behind prospect research, signals, meeting prep, and Social listening. OpenAI's GPT-6 now reads those search results and writes the research, a job xAI's Grok did before; Grok still handles X search, parsing, and scoring. | | September 2, 2026 | Added Openmart, a local-business database that now supplies Local search results in its supported markets and looks up owner contacts for businesses in your results before Starlight falls back to web research. SerpApi remains listed and in use as the Local search fallback. | | August 30, 2026 | Added TinyFish, which now performs the web searches behind Social listening's Reddit and review discovery and fetches the public pages those searches return. SerpApi remains listed and in use as the fallback search provider and for Local search. | | August 20, 2026 | First published as a standalone list. Added Amazon Web Services (Bedrock, which hosts the Kimi K2.5 writer model), Meta Platforms, OpenAI, Resend, Clearout, SerpApi, HarvestAPI, Reddit, Logo.dev, MapTiler, and OpenStreetMap Foundation, all of which were already in use but were missing from the table in the Privacy Policy. Writer-model calls were pinned to the Bedrock host the same day; before that the Gateway could route them to Moonshot AI's own API. | --- # Security Last updated: August 20, 2026 How Starlight protects your data: hosting, encryption, tenant isolation, AI data handling, and vulnerability disclosure. Starlight holds the keys to your mailbox, your calendar, your CRM, and a list of people you are trying to win. This page describes, factually, how we protect that. It is the public version of Annex 2 of our [Data Processing Addendum](/dpa). Where we have not yet done something, we say so. ## Hosting and Infrastructure - The application runs on **Vercel** (serverless, United States). The database is **PostgreSQL on Supabase**, hosted on AWS in `us-east-2` (Ohio). Both providers hold SOC 2 Type II reports and publish their own security documentation - Production is the only environment that holds customer data. Preview and development environments use separate databases - Secrets (API keys, encryption keys, OAuth client secrets) live in Vercel's encrypted environment store and are never committed to source control ## Encryption - **In transit**: TLS 1.2+ on every connection, including between the app and the database - **At rest**: the database, backups, and file storage are encrypted at rest by our providers (AES-256) - **Integration tokens**: OAuth refresh and access tokens for Gmail, Outlook, calendars, and CRMs are additionally encrypted in the application with **AES-256-GCM** under a key held outside the database, so a database-only compromise does not expose mailbox access - **Extension and MCP tokens** are stored as hashes; the plaintext exists only in your browser or client ## Authentication and Access - Sign-in is **passwordless**: Google OAuth or an emailed magic link. There are no passwords to leak, reuse, or brute-force - You can sign out of every session from Settings, revoke any connected integration from Connectors, and revoke extension and MCP tokens individually - MCP access uses OAuth 2.1 with PKCE, short-lived hashed authorization codes, and rotating refresh tokens - Internal access to production follows least privilege. Infrastructure accounts use multi-factor authentication ## Tenant Isolation Every record belongs to a workspace, and every query is scoped to the workspace of the signed-in user. Underneath that, **PostgreSQL row-level security is enabled on every table**, and a CI check blocks any schema change that would create a table without it. Teammates see only their own workspace. ## Least-Privilege Integrations - Gmail and Outlook: we read only threads Starlight started and replies to them, never the rest of your inbox. Our use of Google data complies with the Google API Services User Data Policy, including Limited Use - Calendars: read events and create the meetings you book; nothing else - CRMs: sync only the records you choose to import or export - Chrome extension: acts in your own browser with your own session. Starlight never holds LinkedIn, X, or Reddit credentials. Before any automated send, the extension verifies it is in the right conversation with the exact approved text, and aborts otherwise. Full data flows are in the [Privacy Policy](/privacy) ## AI Data Handling - We do not train models on customer data, and our agreements with model providers prohibit them from doing so. Zero-data-retention terms are enabled where a provider offers them - Model calls are routed through the Vercel AI Gateway or directly to the provider over TLS; the providers are listed on the [Sub-processors](/subprocessors) page - Text that originates from prospects or public posts is wrapped as untrusted data in every prompt, so a message cannot instruct the model - Every outbound draft is scored by an independent judge model for fabrication before it can be sent automatically; a person reviews everything else ## Backups and Availability - The database is backed up daily by Supabase with the retention of our plan; backups are encrypted and stored in the same region - Deleting your account deletes your workspace data immediately from the live database; it ages out of backups within the retention window - Vercel provides automatic failover and DDoS mitigation at the edge ## Logging and Monitoring - Application and request logs are retained by our hosting providers for a limited window and used for debugging and abuse detection - Security-relevant events (sign-ins, token issuance and revocation, integration connects, agent runs, sends) are recorded as activity on the account - Dependencies are monitored for known vulnerabilities and updated promptly ## Vulnerability Disclosure We welcome good-faith security research. Report vulnerabilities to [legal@joinstarlight.com](mailto:legal@joinstarlight.com) with a description, steps to reproduce, and impact. Please do not open a public issue. A machine-readable version of this policy is at [/.well-known/security.txt](https://joinstarlight.com/.well-known/security.txt). | Stage | Target | | --- | --- | | Acknowledge report | 3 business days | | Initial assessment | 7 business days | | Fix for critical issues | 14 business days | ### Scope - **In scope**: joinstarlight.com, its API, the MCP server, the Chrome extension, authentication and authorization, data handling and isolation - **Out of scope**: third-party services we use, social engineering, denial of service, and issues already known or reported ### Safe harbor We will not pursue legal action against researchers who make a good-faith effort to avoid privacy violations, data destruction, and service disruption; only test accounts they own or have permission to test; report promptly and do not exploit beyond what is needed to demonstrate the issue; and do not disclose publicly before a fix is in place. ## Incident Response If we confirm a security incident affecting personal data, we contain it, assess scope, and notify affected customers without undue delay, with the facts known at the time and the steps we recommend. Where Starlight is the controller and the law requires it, we notify the supervisory authority within 72 hours. Where we are a processor, we notify the customer so they can meet their own obligations. ## Compliance Status > **Info:** Starlight does not yet hold its own SOC 2 or ISO 27001 certification. Our infrastructure providers do, and we make their reports available under NDA on request. A signed [Data Processing Addendum](/dpa) with Standard Contractual Clauses is available to every customer. Questions about security, including vendor questionnaires, go to [legal@joinstarlight.com](mailto:legal@joinstarlight.com).