Privacy Policy

Who is responsible for the site

Starlight Virtual Solutions LLC, which does business publicly as Starlight Virtual Solutions (“Starlight,” “we,” “us,” or “our”), operates this website.

Questions or privacy requests can be sent to kelsey@starlightvirtualsolutions.com.

Information we receive

We receive information you choose to provide, including your name, email address, business name, project topic, and message when you use the contact form.

If you book a discovery call, Google Calendar collects your name, email address, selected appointment time, time zone, and any optional workflow details you provide. Starlight receives the booking through its company calendar and uses it to prepare for and manage your requested appointment. Google Meet provides the meeting link. Booking a call does not subscribe you to marketing.

When you buy a digital product, Stripe collects the contact, billing, and payment information required for Checkout. Starlight receives order details such as the purchaser email, amount paid, product and price identifiers, payment status, consent status, and delivery status. We do not receive or store your complete card number.

If you allow optional analytics, Google Analytics processes limited website-usage information such as the page path, general device and browser information, approximate location, and basic interactions. Starlight receives aggregated and event-based reports from that service.

Our hosting and security providers can also process ordinary technical information such as an IP address, browser or device details, request time, requested page, and error or abuse-prevention logs.

Starlight uses a cloud business-automation workspace supplied through Grok Bot. When commissioned and enabled, a verified website or social event gives the Chief of Staff an opaque work reference. The Chief assigns one role-scoped Customer Care, Sales, or Social Bot, and only that assigned Bot may retrieve the minimum verified inquiry, direct-message, comment, or reply content from Starlight’s private store through an authenticated bridge. The Bots use that content for triage, drafting, independent quality review, and a bounded response. Grok Bot may use Cursor (Anysphere), xAI/SpaceXAI, and the model provider selected within that service to process the assigned content.

Any enabled response stays bound to the verified recipient or conversation supplied by the original form or social provider. The automation cannot substitute an arbitrary recipient, is not used for cold or bulk outreach, and must apply consent, suppression, delivery-limit, quality, and opt-out checks before sending. The Chief receives the release status, safe escalation class, and outcome rather than a copy of the private message. Sensitive, unusual, or high-impact cases are held for human review.

When you comment on, reply to, mention, or message a Starlight social account, the relevant platform may provide your public account identifier, display name, message or comment text, conversation identifier, timestamp, and the information needed to reply. Starlight does not use this access to collect passwords, private contacts, or unrelated account activity.

When the social review console is enabled, reviewers sign in with their own Facebook account. We exchange the sign-in code with Meta and use its app-scoped account identifier to create a short signed review session. Facebook Login for Business also requires a business permission: we request read-only Page-list access and check whether its Page-list endpoint is available, requesting only an identifier for at most one Page. We immediately discard the result and do not retain the reviewer’s Facebook access token, name, email address, or Page data. The session contains a hash of the account identifier and permits only the selected Starlight demonstrations; it does not connect the reviewer’s social accounts for publishing.

Cookies, analytics, and in-browser tools

Optional Google Analytics is off by default. We do not request Google’s analytics script or send Google an analytics request unless you choose Accept optional cookies. We save only that analytics choice in your browser’s local storage so the site can remember it.

If you allow analytics, Google Analytics may use analytics cookies and receive the limited usage information described above. The initial reported page location omits query strings and fragments, the reported referrer is blank, and analytics does not load during a browser navigation that arrives with sensitive parameters such as session, payment, order, token, code, or email values. Later client-side page changes may include non-sensitive attribution parameters such as the referring site section. We do not include names, email addresses, contact-form messages, payment details, order IDs, or Checkout session IDs in analytics events.

Google’s Consent Mode receives analytics_storage, ad_storage, ad_user_data, and ad_personalization as denied by default. If you allow analytics, only analytics storage changes to granted; advertising storage, advertising user data, and advertising personalization remain denied. Google Signals and ads-personalization signals are disabled in this site’s configuration.

We record a contact-form lead event only after a genuine message is successfully submitted. When someone starts product Checkout, the event contains only the product name and identifier, value, and currency. You can change or withdraw your choice at any time with the Cookie settings control in the site footer. Withdrawing sends the denied consent update, removes Google Analytics cookies this site can access, and reloads the page without the Google tag.

The free tools on this site, including the Operations Scorecard and the browser-based outline tool, run entirely in your browser. Your answers and drafts are not transmitted to us, saved, or reviewed.

If you allow optional analytics, we count when a Scorecard attempt starts and when its result is displayed. These events do not include your answers, written response, score, or recommendation. A completed Scorecard is not a submitted inquiry.

When you buy a digital product, Checkout happens on Stripe’s own secure domain. Stripe sets the cookies it needs there for payment security and fraud prevention, under Stripe’s privacy policy.

The social review console uses essential, secure cookies for its five-minute sign-in request and review session of up to 30 minutes. These cookies are unavailable to page scripts. Signing out removes the review-session cookie. A delivery confirmation records the selected demonstration, public provider result identifier, and confirmation time; it does not contain the reviewer’s profile or access token.

How we use information

• Respond to inquiries and discuss requested services.
• When enabled, use role-based automation to triage, draft, review, and deliver bounded customer and prospective-client follow-up.
• Process and verify purchases.
• Deliver private product access and customer support.
• Prevent spam, fraud, misuse, and duplicate fulfillment.
• Maintain business, tax, payment, and dispute records.
• Operate, troubleshoot, and improve the website.

Service providers

We use Google Calendar and Google Meet for appointment booking, calendar invitations, scheduling messages, and discovery calls. Opening the booking link takes you to Google’s service; its own terms and privacy practices apply there.

We share information only as needed with providers that perform work for the website and business. Current providers include Vercel for website hosting, private storage, guarded API tools, and provider-bound delivery; Cloudflare for encrypted D1 operational and private state and scheduled operations; Cursor (Anysphere) for Grok Bot account, cloud-computer, plugin, conversation, routine, and automation infrastructure; xAI/SpaceXAI when its model or service is used by Grok Bot; Stripe for Checkout and payment processing; Resend for contact and product-delivery email; Meta for connected Facebook, Instagram, and Threads interactions; LinkedIn only if its Page connection is later commissioned; and—only if you allow analytics—Google Analytics for website-usage measurement.

Those providers process information under their own terms and privacy practices. Grok Bot uses cloud storage and may use model providers with their own processing and retention terms. When role-based automation is enabled, only the assigned Bot receives the content needed for its step; provider-bound recipient and conversation identifiers remain in Starlight’s guarded bridge. Stripe handles payment credentials directly; Starlight does not store complete card details on this website.

These providers process information in the United States. If you visit from another country, information you submit is transferred to and handled by these United States providers.

Retention and security

We keep information only as long as reasonably needed for the purposes described here, including support, accounting, tax, fraud prevention, and legal obligations. Retention periods differ by record type and provider. We minimize the content sent for each automated task and keep conversation, consent, suppression, delivery, and quality records only as needed to operate and verify the service.

When role-based automation is enabled, information handled by Grok Bot, Cursor, xAI/SpaceXAI, or another selected model provider is also subject to that provider’s retention and deletion process. Deleting a Starlight-controlled record does not by itself prove deletion from a provider’s systems.

We use practical safeguards including encrypted HTTPS connections, restricted server credentials, signed payment webhooks, private file storage, expiring download links, and access controls. No online system can promise absolute security, so please do not send passwords, payment-card numbers, or sensitive client information through the contact form.

Your choices and requests

You may ask what personal information Starlight holds about you, request a correction, or ask us to delete information that we are not required to retain. Email your request from the address connected to the inquiry or order so we can verify it.

You may ask for human-only handling of a new or ongoing conversation and may opt out of non-transactional follow-up at any time. Starlight applies provider-specific suppression and opt-out signals before an enabled automated response may be sent.

For information received through a connected social platform, follow the Social Account Data Deletion instructions.

Payment records may also be available through Stripe. Some records must be retained for accounting, tax, fraud, dispute, or legal purposes. Nothing in this policy limits privacy rights that apply where you live.

Children, changes, and related terms

This business website and its products are intended for adults operating or working with a business. We do not knowingly collect information from children.

We may update this policy when the website, providers, or legal requirements change. The effective date above identifies the current version.

Digital-product purchases are also covered by our Terms and Digital Product Refund Policy.