Privacy Policy

1. Who we are & how to contact us

Controller: heystar, operator of heystar.world.

Privacy contact: [email protected]

EU/EEA matters: handled under GDPR by our privacy team at the address above.

Georgia: requests under Georgian data law may also be sent to [email protected].

2. What personal data we collect

We collect account data, including name, username, email, password (hashed), country, date of birth or age confirmation, and profile details.

We collect booking and content data, including requests you submit, recipient details you provide, messages, reviews, and the Star Videos associated with your account.

We collect payment data, including billing details, transaction amounts, currency, partial card data and identifiers provided by our payment processors. We do not store full card numbers.

We collect usage and device data, including IP address, device and browser type, app version, pages and features used, timestamps, and cookie or similar identifiers.

We collect communications, including support tickets, emails and other correspondence with us.

We collect limited partner data from payment providers, fraud-prevention partners and login providers you choose to use.

You may choose to provide recipient information about third parties (for example, the person a Star Video is for). You must have the right to share that information, and you should only share what is necessary.

3. How and why we use your data (legal bases)

We create and manage your account, provide the Platform and process bookings between Customers and Stars on the basis of performance of a contract (GDPR Art. 6(1)(b)).

We process payments, issue refunds and credits, and prevent and detect fraud on the basis of contract, legal obligation and legitimate interests (Art. 6(1)(b), (c), (f)).

We provide customer support and respond to your requests on the basis of contract and legitimate interests (Art. 6(1)(b), (f)).

We keep the Platform secure, moderate content, enforce our Terms, and comply with the DSA on the basis of legal obligation and legitimate interests (Art. 6(1)(c), (f)).

We comply with tax, accounting and other legal obligations, including VAT, on the basis of legal obligation (Art. 6(1)(c)).

We improve and develop the Platform and analytics on the basis of legitimate interests, and consent where required (Art. 6(1)(f), (a)).

We send marketing communications and use non-essential cookies on the basis of consent (Art. 6(1)(a)); you may withdraw consent at any time.

Where we rely on legitimate interests, we balance those interests against your rights and freedoms, and you may object as described in Section 7.

4. Cookies & similar technologies

We use strictly necessary cookies to operate the Platform, and only with your consent analytics and marketing cookies. You can manage your preferences through our cookie banner and your browser settings. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

5. How we share your data

Stars and Customers: to enable a booking, relevant request and recipient details are shared between the Customer and the Star involved in that transaction.

Service providers (processors): hosting, payment processing, analytics, communications and fraud-prevention providers acting on our instructions under data-processing agreements.

Legal and safety: authorities, regulators or other parties where required by law, to respond to lawful requests, or to protect the rights, safety and property of users, the public or heystar.

Corporate transactions: in connection with a merger, acquisition or sale of assets, subject to this Policy.

We do not sell your personal data.

6. International transfers

We primarily store and process data within the EU/EEA. Where data is transferred to a country outside the EU/EEA (for example, to a service provider, or to Stars or Customers located in Georgia or elsewhere) that is not covered by an EU adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary measures where needed. Transfers involving individuals in Georgia are also handled in accordance with Georgian data-transfer rules. You may request a copy of the relevant safeguards via [email protected].

7. Your rights

Subject to applicable law, you have the right to: access your personal data; rectify inaccurate data; erase data; restrict or object to processing; data portability; and withdraw consent at any time. You also have the right to lodge a complaint with a supervisory authority.

EU/EEA: you may complain to your local Data Protection Authority, or to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Georgia: you may complain to the Personal Data Protection Service of Georgia.

To exercise any right, contact [email protected]. We will respond within the time limits set by applicable law (generally one month under the GDPR).

8. How long we keep your data

We keep personal data only as long as necessary for the purposes described above, including to provide the Platform, comply with legal obligations (for example, accounting and tax records, typically up to seven years under Estonian law), resolve disputes and enforce our agreements. When data is no longer needed we delete or anonymise it.

9. Children

The Platform is not directed to children below the applicable age of digital consent. We do not knowingly collect data from children below that age without appropriate consent. If you believe a child has provided us data without proper consent, contact us and we will take appropriate action.

10. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls and monitoring. No method of transmission or storage is completely secure; we maintain procedures to handle any suspected data breach in line with our legal obligations, including notifying authorities and affected individuals where required.

11. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, where required, notify you of material changes. Your continued use of the Platform after the effective date constitutes acknowledgement of the updated Policy, to the extent permitted by law.