Privacy Policy — MY STAR

MY STAR is a Georgian business that sells handmade leather wallets, bags, belts and accessories through the website mystar.ge. This policy covers the data collected through this website, the accounts created on it, and the orders placed through it.

We collect different data depending on how you use the site. Specifically:

Account information. If you create an account with an email and password, we store your name, email address, and a securely hashed version of your password — we never store your password in readable form. If you sign in with Google, we receive your name, email address, and profile photo directly from Google, and you don't create a separate password with us.

Order and delivery information. When you place an order, we collect the recipient's name, phone number, delivery city and address, and any additional notes. If you use the map option to indicate the delivery location, we also store the GPS coordinates (latitude/longitude) of the point you selected — this helps us plan delivery accurately. Because that is more precise than a written address, we want you to know it is stored.

Payment information. We do not collect or store your card number, expiry date, or CVC code. During payment you are redirected to the secure page of Bank of Georgia or TBC Bank — card details are entered there and never pass through our servers or database. We only receive confirmation of whether the payment succeeded or failed, along with the payment identifier.

Content you submit. If you leave a product review, we store your rating, written comment, and any attached photos or videos.

Communication with the AI assistant. If you use the chat on the site, the text you type is sent to Google's Gemini AI service to generate a reply. Please do not share information in the chat that you would not want processed by a third-party AI system.

Technical and usage data. We briefly store your IP address to prevent abuse — for example, so no one can place hundreds of fake orders or login attempts in a short time. This is not linked to your account and is not kept for long. We also use Vercel Analytics to understand general site traffic (pages viewed, general location at the country/region level, device type); it is privacy-focused, uses no tracking cookies, and does not build an individual profile of you.

We use the data described above in order to: process and fulfil your orders; plan and track delivery; let you sign in and view your order history; answer your questions; send you order-status notifications (order confirmed, shipped, etc. — these are not optional, as they are necessary to fulfil the order); send you promotional emails about new products, discounts and restocks, only if you have opted in, always with a one-click unsubscribe link; prevent fraud and misuse of the site; and improve the site based on non-identifying, aggregate usage data.

Where applicable, we process your data on the following bases: necessity for the performance of a contract — we need the delivery details and payment confirmation to fulfil the order you placed; consent — for promotional emails and the information you send in the chat, which you can withdraw at any time; and legitimate interest — for fraud prevention and basic site analytics, taking your right to privacy into account.

We do not sell your data and never will. However, we share specific data with the external services that make the website work. Each receives only what is necessary for its function:

• Cloudinary — stores product photos and the images/videos uploaded with reviews.
• Resend — sends our transactional emails (order confirmations, verification links, password resets) and, where you have consented, promotional emails.
• Google — provides the "Sign in with Google" feature (receiving your email/name/photo if you use it) and powers the AI chat (receiving the text you type).
• Bank of Georgia and TBC Bank — process card payments on their own secure pages; they receive the order amount and identifier, not your full account details.
• Upstash — briefly stores IP addresses for abuse prevention; these records are deleted automatically.
• Vercel — provides website hosting and the privacy-focused analytics noted above.

Our infrastructure is not limited to the territory of Georgia. Depending on the service provider, data may be stored or processed in the European Union or the United States, in addition to or instead of Georgia. Each provider listed above maintains its own security and compliance standards; we choose providers that meet current industry security practices.

We use a small number of cookies, each for a specific, limited purpose: a session cookie that keeps you signed in after logging in, and — if the site is temporarily running in early-access mode — an early-access cookie that remembers you already have early access. Vercel Analytics works without tracking cookies. We do not use any advertising or cross-site tracking cookies.

Account data is kept for as long as your account is active. If you close your account, we delete your profile data, subject to the exception for order records described below.

Order records are kept longer than an active account — even if you later delete your account or request erasure of your data. This is because Georgian accounting and tax regulations require us to retain sales records for a defined number of years. We will always tell you if an erasure request can only be partly fulfilled for this reason, and we will delete everything that is not legally required to be kept.

Chat conversations with the AI assistant and IP-address records are short-lived and deleted automatically; we do not build a history of them.

Review content (ratings, comments, photos, videos) is kept for as long as the review is published, or until you ask us to remove it.

You have the right to: access the personal data we hold about you; correct it if it is inaccurate or out of date; delete it, subject to the exception for order records described above; withdraw consent to promotional emails at any time, via the link in any promotional email or by contacting us directly; and object to processing based on legitimate interest.

To exercise these rights, write to us at hello@mystar.ge. We aim to respond within 30 days.

If you believe we have handled your data improperly and the matter cannot be resolved with us, you have the right to lodge a complaint with the Personal Data Protection Service — the state body responsible for enforcing data-protection law in Georgia.

MY STAR is not intended for children, and we do not knowingly collect data from anyone under 18. Creating an account and placing an order means you are old enough to enter into a binding purchase contract under Georgian law.

Passwords are never stored in readable form — only as a one-way cryptographic hash that cannot be reversed. All connections between your browser and our site are encrypted (HTTPS). Login attempts are rate-limited, making automated password guessing practically impossible. Card payments never pass through our servers at all, as described in section 2. No system is absolutely secure, but we take reasonable, industry-standard measures.

We may update this policy from time to time — for example, if we start using a new service provider, or if our legal obligations change. The "Last updated" date above always reflects the current version. If a change materially affects the use of already-provided data for promotional purposes, we will email you directly.

Questions, requests, or comments about this policy or your data: hello@mystar.ge.