STARWELL
Legal · privacy

Privacy policy.

What we collect, why we collect it, who else sees it, how long we keep it, and how to get it back or get rid of it. Written plainly, because a policy you cannot read protects nobody.

Last updated: September 2026 · Version 2026-09-16 · Hermes Horizon Pty Ltd
01
Who we are
Starwell is operated by Hermes Horizon Pty Ltd (ABN 12 273 187 245), Suite 329/98-100 Elizabeth Street, Melbourne VIC 3000, Australia. We are the data controller for the information described here. You can reach us about anything on this page at support@starwell-hh.com.
02
What we collect
Your birth details: date, time and place of birth. This is the only thing a chart can be computed from, and it is the most personal thing we hold.
Your email address, and your name if you give it. Your messages to Mira, and her replies. Your purchases and which readings you own. Technical information every website receives: your IP address, your browser, and which pages you opened.
We do not ask for your gender, your address, your phone number, or anything about your health, beliefs, politics or sexuality, and you should not send them to us.
03
Why we collect it, and on what basis
Birth details, to compute your chart and write your reading. Your email, to deliver what you bought and to answer you. Your messages, so the conversation makes sense and so Mira can refer back to what you asked. Payment records, because we are required to keep them.
Where the GDPR applies, our lawful bases are: performing the contract you entered when you bought or signed up; your consent, for the weekly letter and for advertising cookies, both of which you can withdraw at any time; our legitimate interest in keeping the site running, safe and measurable; and legal obligation for tax and accounting records.
04
Who else sees it
We do not trade or rent your personal data to anyone. We do pass it to the service providers who run Starwell, each receiving only what it needs to do its job.
If you accept cookies, a hashed form of your email address also goes to Meta, Google and TikTok so we can tell whether an advertisement led to a reading. Under California law that counts as sharing. Declining cookies stops it, and you can change your mind at any time from the cookie choice on any page.
Every provider that receives personal data
ProviderWhat it doesWhat it receivesWhere
SupabaseDatabase and accountsYour account, birth details, readings and chat historyUnited States
Google (Gemini)The model behind MiraYour computed chart and the messages in your threadUnited States
StripePaymentsYour email, name and the details needed to take paymentUnited States
ResendEmail deliveryYour email address and the contents of emails we send youUnited States
SentryError monitoringTechnical error reports, which can include the page you were onUnited States
VercelWebsite hostingYour requests to the site, including IP addressUnited States
RenderChart computation hostingThe birth details needed to compute a chartUnited States
CloudflareBot and abuse screeningA challenge token and your IP addressUnited States
Google AnalyticsSite measurementPage views and a device identifier, only once you accept cookiesUnited States
Google AdsAdvertising measurementA click identifier and purchase value, only once you accept cookiesUnited States
MetaAdvertising measurementA hashed form of your email, your IP and browser, only once you accept cookiesUnited States
TikTokAdvertising measurementA click identifier and a hashed email, only once you accept cookiesUnited States
ElevenLabsVoice for marketing videoMarketing scripts only. No customer dataUnited States
05
How long we keep it
We keep each kind of information for as long as it is doing a job, and no longer.
To be straight with you about how this works today: these periods are our policy, and we apply them when you ask us to. Automatic deletion on a schedule is not running yet. We are building it, and until it is live, asking us to delete your data is what ends these periods, and we do it within 30 days. The only exception is where the law requires us to keep a record of a sale.
Retention by kind of information
WhatHow longWhy
Account and birth details12 months after your last activitySo a returning reader does not retype their birth moment
Chat transcripts24 monthsSo Mira can refer back to what you asked, across seasons
Readings you boughtSeven yearsYou keep access, and tax law requires the sale record
Purchase and payment recordsSeven yearsAustralian tax and consumer law
Consent recordsSeven years from the date givenTo show what you agreed to and when
Email suppression listIndefinitelyDeleting it would let us email you again by mistake
Analytics data14 monthsSet by the provider, and only collected if you accept cookies
The _ga cookie on your device2 yearsSet by Google Analytics, and only if you accept cookies
06
Your rights, and how to use them
You can ask for a copy of everything we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it for advertising measurement, and ask us not to email you. Where the GDPR applies you can also ask us to restrict or port your data, and you can complain to your local supervisory authority. In Australia you can complain to the Office of the Australian Information Commissioner. In California you have the right to know, delete, correct, and opt out of sharing, and we will not treat you differently for using any of them.
A copy you can take away is self-service, and you do not need an account for it. If you are signed in it downloads straight away. If you are not, or if you bought a reading without ever creating an account, the same page emails a code to the address you bought with and then hands you the file.
Download everything we hold about you as a single file, up to three times a day.
07
Correction and deletion
To have your data corrected or deleted, email support@starwell-hh.com, the same address every email from us invites a reply to. Write from the address on your account, or from the one you bought with if you never made an account, and say what you want. We answer within 30 days.
There is no self-service delete button yet. A person does it by hand, and we would rather tell you that than point you at a button that does not work. Deleting your data ends the retention periods above early, except where we are required by law to keep a record of a sale.
Unsubscribing is faster than writing to us: every marketing email has an unsubscribe link at the bottom, and it takes effect immediately.
08
Children
Starwell is for people aged 18 and over. We check the birth date you give us and refuse to compute a chart for anyone under 18. We do not knowingly collect anything from a child. If you believe a child has given us information, write to support@starwell-hh.com and we will delete it.
09
How we protect it
Data is encrypted in transit and at rest by our hosting and database providers. Access to production data is limited to the people who need it. Sign-in is by emailed code, so there is no password of yours for us to lose. We screen for bots and we rate limit the free surfaces to slow down abuse, though we will not pretend that rate limiting is a hard guarantee rather than a brake.
No service can promise perfect security, and we will not. If something happens that puts your data at risk, we will tell you and the relevant regulator as the law requires.
10
Where your data goes
We are an Australian company and most of our providers are in the United States, so your information is stored and processed there. If you are in the EEA or the UK, that is a transfer outside your region, made under the standard contractual clauses our providers offer. Ask us and we will tell you which apply.
11
Changes, and how to reach us
If we change this policy we will change the version at the top of this page. Material changes will be told to you by email if we have your address.
Write to us at support@starwell-hh.com, or Hermes Horizon Pty Ltd, Suite 329/98-100 Elizabeth Street, Melbourne VIC 3000, Australia.