Privacy Policy

Stellar ("we", "us") lets you build a professional profile at stellarhq.co. This policy explains what personal data we process, why, and the rights you have under Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and similar laws. We are the data controller for the data described here. Contact us at privacy@stellarhq.co.

What we collect

• Account data: your name, email address, and a hashed password. Your sign-in email is never shown on your profile.
• Profile content you add: username, display name, headline, about text, experience, education, skills, projects, links, photos, and optional contact details. Each item has its own visibility setting, and nothing is public until you publish.
• Security data: sessions (device type and browser), and a security activity log (sign-ins, password and username changes). IP addresses in the log are stored only as a keyed hash.
• Photos: we re-encode every upload and keep only resized copies. Location (GPS) and camera metadata are removed and the original file is not stored.
• Analytics (only with your consent): pages viewed and basic events, under a random identifier, never your name or email. Form inputs are never recorded.

Why we use it (legal bases)

• To provide the service (contract): your account, your profile, and the features you use, such as share images and résumé PDFs.
• To keep accounts safe (legitimate interest): bot protection, rate limits, security emails, and the activity log.
• To improve Stellar (consent): analytics, only if you accept them. You can withdraw consent at any time in Settings → Privacy or the cookie banner.

We don't sell your data, and we don't use it for advertising.

Who processes it

• Cloudflare, Inc.: hosting, database, file storage, email delivery, bot protection (Turnstile), and image and PDF rendering.
• PostHog: product analytics and error reports, only if you consent.

These providers may process data outside Thailand, including in the United States and the European Union. We rely on their contractual data-protection commitments (such as standard contractual clauses) as the safeguard for these transfers.

How long we keep it

• Account and profile data: until you delete your account.
• After you ask to delete your account, your profile is hidden immediately and everything is erased after a 30-day grace period. Your username stays reserved, without any personal data, so nobody can impersonate you.
• Security activity log: 180 days.
• Database backups: up to 30 days, after which deleted data is gone from backups too.

Your rights

You can, at any time:

• Access and take your data: Settings → Your data → Download my data.
• Correct it: edit anything in your dashboard and settings.
• Delete it: Settings → Your data → Delete my account.
• Control what's public and whether search engines may list your profile: Settings → Privacy.
• Withdraw consent to analytics, object to processing, or ask us to restrict it, by contacting us.

If you believe we've mishandled your data, you can complain to Thailand's Personal Data Protection Committee (PDPC). We'd appreciate the chance to fix it first: privacy@stellarhq.co.

Security and breaches

We use encryption in transit, strict separation of sign-in data from profile data, and access controls on every request. If a breach is likely to affect your rights, we will notify the PDPC within 72 hours of becoming aware of it and notify affected users without undue delay.

Cookies

We use strictly necessary cookies for sign-in, security, and remembering your theme. These don't need consent. Analytics cookies are set only if you accept them.

Children

Stellar is not intended for children under 16, and we don't knowingly accept their accounts.

Changes

If we make material changes, we'll tell you by email or in the app before they take effect.