Privacy Policy

1. Introduction

This Privacy Policy explains how StellPanel ("StellPanel", "we", "us") collects, uses, discloses, and protects personal data when you use our booking, business-management, and website platform (the "Service"), available at stellpanel.com and its subdomains.

This Policy is written to meet the requirements of the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Ukrainian Law "On Personal Data Protection" (No. 2297-VI), and applicable US state privacy laws (including the California Consumer Privacy Act, as amended by the CPRA). We apply the same standard of care to all users regardless of location.

2. Who We Are

The Service is provided by Individual Entrepreneur Baran Mykola Ihorovych ("ФОП Баран Микола Ігорович"), a sole proprietor registered in Ukraine (simplified taxation, group 3).

Contact for all privacy and data protection matters: support.stellpanel@gmail.com.

For most of the personal data described below, StellPanel acts as the data controller. For one category of data — personal data about your own clients that you or your staff enter into the Service (see Section 4) — StellPanel acts as a data processor on your instructions, and you (the business using StellPanel) are the controller. This distinction matters because it determines who is legally responsible for what, and it is explained throughout this Policy.

3. Data We Collect About You (Account Holders)

Account data: email address, first and last name, nickname, and (optionally) a profile picture, collected when you register and use the admin panel.

Business data: the name, subdomain/custom domain, currency, and similar operational details of the business(es) you register — this describes your business, not a natural person, but may include your own name or contact details if you use them in your business profile or public website.

Team data: if you invite employees, we store their name, role, and work-schedule information so the Service can manage bookings and permissions correctly.

Payment-related data: we do not collect or store your card number. Billing is handled by Paddle, our payment processor (Section 8). We retain only the minimum data needed to identify your subscription — plan, quantity, and status.

Technical and log data: IP address, browser type, device information, and access logs, collected automatically for security, fraud prevention, and to operate the Service (via our hosting provider, Vercel).

4. Data About Your Clients (Processed on Your Behalf)

If you use StellPanel to accept bookings, you or the people booking with you may enter personal data about your own clients: name, phone number, email address, and an optional note left by the client at the time of booking.

For this data, StellPanel is a data processor, not a controller. You — the business — decide why this data is collected and what it is used for, and you are responsible for having a lawful basis to collect it (typically, performance of your own contract with your client) and for providing your own clients with any notice required by the law that applies to you.

We process this data solely to operate the booking and calendar functionality of the Service, on your instructions, and we do not use it for our own purposes (such as marketing). A dedicated Data Processing Agreement is available on request by contacting support.stellpanel@gmail.com.

5. How We Use Data

To provide, maintain, and secure the Service, including your account, calendar, bookings, and business website.

To process billing through Paddle and manage your subscription.

To send transactional emails you need to use the Service — email confirmation, password reset, booking notifications. These are not marketing and cannot be opted out of while your account is active.

To respond to support requests sent to support.stellpanel@gmail.com.

To detect, prevent, and investigate fraud, abuse, or security incidents.

To comply with legal obligations, such as tax and accounting record-keeping.

6. Legal Bases for Processing (EU/UK GDPR)

Performance of a contract — processing your account and business data to provide the Service you signed up for.

Legitimate interests — for security, fraud prevention, and improving the Service, balanced against your rights.

Legal obligation — where processing is required by tax, accounting, or other applicable law.

Consent — only where we ask for it separately, for example for optional marketing communications (which we do not currently send, but may in the future, always with an opt-out).

Under Ukrainian Law No. 2297-VI, the equivalent grounds apply: performance of a contract to which you are a party, and compliance with our legal obligations.

7. Cookies and Local Storage

We use a small number of strictly necessary cookies and browser storage items: to remember your language preference, and to keep you signed in to the admin panel. We do not use third-party advertising or cross-site tracking cookies.

Because these cookies are strictly necessary for the Service to function, we do not display a cookie-consent banner for them, consistent with guidance from EU and UK data protection authorities on strictly necessary cookies.

8. Who We Share Data With

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes. We share data only with service providers (sub-processors) who help us run the Service, under contractual confidentiality and data-protection obligations:

Supabase — database, authentication, and file storage. Our primary database is hosted in the EU (Frankfurt, Germany).

Vercel — hosting and content delivery for our websites and applications.

Resend — delivery of transactional emails (account confirmation, password reset, booking notifications).

Paddle — payment processing and billing, acting as merchant of record for subscription purchases (Section 7 of our Terms of Service).

We may also disclose data where required by law, to comply with legal process, or to protect the rights, property, or safety of StellPanel, our users, or others.

9. International Data Transfers

Your core account and booking data is hosted in the EU (Frankfurt). Some of our service providers (including Vercel and Resend) are based in or process data in the United States. Where personal data is transferred outside the EU/UK/Ukraine, we rely on the safeguards those providers make available, such as Standard Contractual Clauses, to ensure an adequate level of protection.

10. Data Retention

Account and business data is retained for as long as your account is active, and for a reasonable period afterward to comply with our own legal, tax, and accounting obligations.

Audit log entries (a record of changes made in the admin panel) are automatically deleted after 7 days.

If a business is deactivated for non-payment or an expired trial, its data is paused, not deleted — access is restricted, but the underlying data is kept so the business can be reactivated. A business you choose to delete yourself is kept for a 7-day recovery window before permanent deletion.

You may request deletion of your account and associated data at any time by contacting support.stellpanel@gmail.com, subject to Section 11.

11. Your Rights

If you are in the EU or UK, you have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to lodge a complaint with your local data protection supervisory authority.

If you are in Ukraine, you have equivalent rights under Law No. 2297-VI, including the right to know what data we hold about you, to request correction or deletion, and to withdraw consent where processing is based on consent.

If you are a California resident, you have rights under the CCPA/CPRA to know what personal data we collect, to request deletion, and to non-discrimination for exercising these rights. We do not sell personal data, so there is no sale to opt out of.

To exercise any of these rights, contact support.stellpanel@gmail.com. We will respond within the timeframe required by the law that applies to you.

12. Children's Privacy

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal data from individuals under 18. If you believe a child has provided us with personal data, contact support.stellpanel@gmail.com and we will delete it.

13. Security

We use industry-standard safeguards, including encrypted connections (HTTPS), database-level access control (Row Level Security), and role-based permissions within the Service, so that users only ever access data they are authorized to see. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

14. Changes to This Policy

We may update this Policy from time to time. We will update the "Last updated" date above, and, for material changes, notify account holders by email.

15. Contact Us

For any question about this Policy or your personal data, contact us at support.stellpanel@gmail.com.