Privacy Policy

01What We Collect

• Account details: your name, email address, and a securely hashed password (we never store plaintext passwords).
• Firm details you submit for scans: firm name, website, city, state, practice area, and phone number.
• Payment records: handled entirely by Stripe. We receive confirmation of payment and a customer reference, never your card number.
• Basic usage data: IP addresses for security and rate limiting, and standard server logs.

02Cookies & Visitor Identification

We use essential cookies to keep you logged in and keep the Service secure. Separately, if you accept cookies via our consent banner, we load one analytics tag from our provider Instantly.ai (served via Leadsy). This tag attempts to identify the business visiting our site and, where a match is found in the provider's database, may associate the visit with business contact details such as a company name, work email, or LinkedIn profile. We use this solely to understand which firms are researching Darkstar and to follow up about our services.

This tag only loads after you click Accept in the cookie banner. Choose “Essential only” and it never loads. You can clear your choice by deleting this site's local storage in your browser. We do not use advertising networks or resell visitor data.

03Report Data

The competitive data in your reports - rankings, ads, reviews, backlinks - is compiled from publicly available sources and third-party data providers. It concerns public marketing activity of businesses, not private individuals.

04How We Use It

• To generate and deliver your intelligence reports.
• To operate your account, dashboard, and report vault.
• To send transactional email: report delivery, login links, account confirmation, and (if enabled) rank alerts and monthly rescan notices. You can turn alert emails off in Settings.
• To prevent fraud and abuse of the platform.

We do not sell your data, and we do not share your scan history or reports with anyone but you.

05Service Providers

We rely on a small set of processors to run the Service: Stripe (payments), Resend (email delivery), Upstash and Vercel (hosting and data storage), Instantly.ai / Leadsy (consent-based visitor identification, see Section 02), and the data APIs used to compile reports. Each receives only what it needs to do its job.

06Retention

Reports are retained for 90 days from creation, after which they expire automatically. Account records persist while your account is active. You can delete individual reports at any time from Settings, or contact us to delete your account entirely.

07Security

Passwords are hashed with scrypt, sessions are cryptographically signed, and all traffic is served over HTTPS. No system is perfectly secure, but we design for defense in depth and limit what we store in the first place.

08Your Rights

You can access, correct, or delete your personal data at any time. Most of this is self-serve in Settings; for anything else, contact us and we will handle it promptly.