Privacy

Stella is operated by [legal entity name], registered at [registered address]. For anything in this policy, write to [privacy contact address].

Where this policy refers to data protection law it means the UK and EU General Data Protection Regulation. The supervisory authority you can complain to is [relevant authority, e.g. Autoriteit Persoonsgegevens].

• Your email address, because it is how you sign in and how we reach you. There is no password to store.
• The name your clients pay — your business or legal name — which is registered against the account details we issue, because the payer's bank checks it.
• Payment records: the amount, currency, date, the reference, and the name of whoever paid you, as the bank reports it.
• The wallet addresses you add, and every payout sent to them.
• Identity details for verification: legal name, date of birth, nationality, home address, phone number, and the type and number of an identity document. See below for where these go and what we keep.
• Technical records: your IP address when you request a sign-in code or submit an identity check, used to rate limit those requests, and a session identifier stored in a cookie so you stay signed in.

Your theme preference is stored in your browser and never sent to us. We use no analytics, no advertising tags, and no third-party cookies.

The document itself — the photograph of your passport or ID card, and the selfie taken with it — is captured by our payment provider's verification provider and goes directly to them. It does not pass through Stella's servers and we never hold a copy.

What we keep from an identity check is deliberately narrow:

• the decision, and the reason for it
• the name, date of birth and nationality the check was made against
• the document type and the last four characters of its number
• the date, version and IP address recorded when you accepted the provider's terms

We do not keep your home address or phone number after they have been passed to the provider that needs them.

• To perform our contract with you — you cannot be paid without an account, deposit details, and a wallet to send to.
• To meet legal obligations — identity verification, sanctions screening and record-keeping under anti-money-laundering law.
• Our legitimate interests — preventing fraud and abuse, rate limiting, and keeping records that let us show what happened to someone's money.

• Lightspark (Grid) holds the fiat balance, issues the account details your clients pay into, runs identity verification, and executes payouts. Your name, email, phone, address, date of birth, nationality and every transaction are processed by them.
• Their verification provider captures and checks identity documents. Lightspark selects it by region; at the time of writing it is Sumsub.
• Our hosting and infrastructure providers, who store the database this service runs on.
• Authorities, where the law requires it — for example a suspicious activity report, which we are generally not permitted to tell you about.

We do not sell personal data, and we do not share it for anyone else's marketing. Some of these providers are outside the UK and EEA; transfers rely on [transfer mechanism — e.g. standard contractual clauses].

Records of payments, conversions, payouts and identity checks are kept for [retention period — commonly five years after the account closes], because anti-money-laundering law requires it. Closing your account does not delete them, and we cannot agree to delete them earlier.

Sign-in codes expire in ten minutes. Sessions expire after fourteen days. Rate-limit records are discarded once their window passes.

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, object to how we use it, ask us to restrict use, or ask for it in a portable form. Write to [privacy contact address] and we will respond within one month.

Some of these have limits. We cannot delete records the law requires us to keep, and we cannot verify an identity without the details that verification needs — which means an account that refuses them cannot be used to receive money.

You can complain to your supervisory authority at any time, without asking us first.

Sign-in is by emailed code rather than a password, so there is no password of yours for us to lose. Session cookies are HTTP-only. Requests for codes and identity checks are rate limited. Every change an operator makes to an account is recorded with who made it and why.

If this policy changes in a way that affects you, we will tell you by email before it takes effect. The date at the top is when it last changed.