Privacy Policy

01What We Collect

• Account details: your name, email address, and a securely hashed password (we never store plaintext passwords).
• Firm details you submit for scans: firm name, website, city, state, practice area, and phone number.
• Payment records: handled entirely by Stripe. We receive confirmation of payment and a customer reference, never your card number.
• Basic usage data: IP addresses for security and rate limiting, and standard server logs.

02Cookies & Visitor Identification

We use essential cookies to keep you logged in and keep the Service secure. Separately, if you accept cookies via our consent banner, we load one analytics tag from our provider Instantly.ai (served via Leadsy). This tag attempts to identify the business visiting our site and, where a match is found in the provider's database, may associate the visit with business contact details such as a company name, work email, or LinkedIn profile. We use this solely to understand which firms are researching Darkstar and to follow up about our services.

This tag only loads after you click Accept in the cookie banner. Choose “Essential only” and it never loads. You can clear your choice by deleting this site's local storage in your browser. We do not use advertising networks or resell visitor data.

03Report Data

The competitive data in your reports - rankings, ads, reviews, backlinks - is compiled from publicly available sources and third-party data providers. It concerns public marketing activity of businesses, not private individuals.

04How We Use It

• To generate and deliver your intelligence reports.
• To operate your account, dashboard, and report vault.
• To send transactional email: report delivery, login links, account confirmation, and (if enabled) rank alerts and monthly rescan notices. You can turn alert emails off in Settings.
• To prevent fraud and abuse of the platform.

We do not sell your data, and we do not share your scan history or reports with anyone but you.

05Connected Google Accounts & Marketing Platforms

The client portal shows each client their own marketing performance. To do that, with your authorization, we connect to third-party platforms through their official APIs, including Google Analytics, Google Search Console, Google Ads, Google Business Profile, Meta (Facebook Pages and Instagram), call tracking, and review platforms.

What we access from Google. When you or your firm authorize the Darkstar Marketing application, we request read-only access to: website analytics data (sessions, users, events, and traffic sources from Google Analytics), search performance data (queries, clicks, impressions, and average position from Search Console), advertising performance data (spend, clicks, impressions, conversions, and campaign structure from Google Ads), and business listing data (ratings, reviews, and location details from Google Business Profile). We do not request access to your Gmail, Drive, Contacts, Calendar, or any data unrelated to marketing reporting.

How we use it.This data is used only to build reports and dashboards for the client whose accounts it came from, and to let Darkstar Marketing staff manage that client's campaigns. It is never sold, never used for advertising to you, never used to build profiles of individual people, and never shown to any other client. Data from one client's accounts is strictly isolated from every other client.

Limited Use disclosure.Darkstar Marketing's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except as needed to provide or improve the reporting features you see, to comply with law, or as part of a merger or acquisition with prior notice. Humans do not read this data except with your permission, for security purposes, to comply with law, or for internal operations where the data has been aggregated or de-identified.

Storage and retention. Authorization tokens are stored encrypted at rest and used only to refresh your reports on a schedule. Report data pulled from connected accounts is cached for up to 30 days and summarized into historical trend points that are retained for up to 400 days so that your dashboard can show change over time. When an engagement ends, connected-account data is deleted within 30 days of request.

Revoking access. You can disconnect at any time by revoking the Darkstar Marketing application from your Google Account permissions page, by removing our manager access inside the relevant Google or Meta product, or by emailing john@darkstarsystem.com. Revocation stops all further data pulls immediately.

06Service Providers

We rely on a small set of processors to run the Service: Stripe (payments), Resend (email delivery), Upstash and Vercel (hosting and data storage), Instantly.ai / Leadsy (consent-based visitor identification, see Section 02), and the data APIs used to compile reports. Each receives only what it needs to do its job.

07Retention

Reports are retained for 90 days from creation, after which they expire automatically. Account records persist while your account is active. You can delete individual reports at any time from Settings, or contact us to delete your account entirely.

08Security

Passwords are hashed with scrypt, sessions are cryptographically signed, and all traffic is served over HTTPS. No system is perfectly secure, but we design for defense in depth and limit what we store in the first place.

09Your Rights

You can access, correct, or delete your personal data at any time. Most of this is self-serve in Settings; for anything else, contact us and we will handle it promptly.