Privacy Policy

When you submit the “Join us” form on our site, we collect:

• Name — to address you personally in follow-up communications.
• Email address — to contact you about upcoming sessions and volunteering opportunities.
• Area of interest — to match you with the right programs.
• IP address and browser user-agent — collected automatically for security and spam prevention. The IP address is stored in partial or hashed form and is not used for tracking.

We do not collect payment information, government IDs, or sensitive personal data.

• To contact you about Starlight events, volunteering opportunities, and outreach programs.
• To coordinate citizen-science activities in your area.
• To improve our programs based on interest and demand.
• To detect and prevent spam or abusive form submissions.

We do not sell, rent, or trade your personal information to third parties. We do not use your data for advertising profiling or automated decision-making.

Under the EU General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act 2023 (DPDP Act), we rely on the following lawful bases:

• Consent — by submitting the join form, you consent to us contacting you about Starlight programs. You may withdraw consent at any time by emailing us.
• Legitimate interests — we process IP addresses and user-agent strings to protect our site from spam and abuse, which we consider a legitimate interest that does not override your rights.

Our website is built on Lovable Cloud and uses Supabase for data storage. Your information is stored in PostgreSQL databases hosted by Supabase on Amazon Web Services infrastructure. Data is stored in the region configured for your Supabase project.

If you are located in the European Economic Area (EEA), your data may be transferred to and processed in countries outside the EEA. Supabase maintains appropriate safeguards for such transfers in accordance with GDPR requirements.

Supabase acts as a data processor on our behalf — it stores and processes your personal data only according to our instructions. We have entered into appropriate data processing agreements with Supabase. Their own privacy policy is available at supabase.com/privacy.

We do not use Google Analytics, Meta Pixel, or any advertising tracking technologies on this website. No third-party advertising or analytics cookies are set.

This website does not use advertising cookies or third-party analytics tracking (e.g., Google Analytics, Meta Pixel). No consent banner is required for our current setup.

Supabase may set a technical session cookie if you are accessing protected resources. This cookie is strictly necessary for the operation of our authentication system and does not track you across sites.

Our hosting platform (Cloudflare) may log anonymised request metadata (IP address, URL, timestamp) for security and performance purposes in accordance with their own privacy policy.

We retain your contact information for a maximum of 3 years from the date of submission, or until you ask us to delete it — whichever comes first. After this period, data is permanently deleted from our database.

If you would like your data removed before the 3-year window, please email us at starlight.darkskies@gmail.com with the subject line “Data Deletion Request”. We will process your request within 30 days.

Starlight may use artificial intelligence tools to assist with content creation, program planning, or internal communications. Where AI-generated content appears on this site, it is reviewed and approved by a human team member before publication.

We do not use AI to make automated decisions about individuals that produce legal or similarly significant effects. We do not train AI models on data submitted through our forms.

FTC Disclosure: In compliance with the Federal Trade Commission's guidelines on transparency, we disclose that this organisation may use AI-assisted tools in its operations.

Depending on your location, you may have the following rights regarding your personal data:

• Right to access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate data.
• Right to erasure — ask us to delete your data (“right to be forgotten”).
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to withdraw consent — withdraw your consent to processing at any time.
• Right to object — object to processing based on legitimate interests.

To exercise any of these rights, contact us at starlight.darkskies@gmail.com. We will respond within 30 days. We may need to verify your identity before processing your request.

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with your local data protection supervisory authority.

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you additional rights:

• Right to know — the categories and specific pieces of personal information we collect about you.
• Right to delete — request deletion of personal information we have collected from you.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share your personal information with third parties for cross-context behavioural advertising. No opt-out is required.
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

To exercise your CCPA rights, contact us at starlight.darkskies@gmail.com.

Our programs are open to all ages, but our website and forms are directed at adults and older minors acting with parental awareness. We do not knowingly collect personal information from children under 13 without verifiable parental consent, in accordance with the Children's Online Privacy Protection Act (COPPA).

If you are under 13, please have a parent or guardian contact us on your behalf. If we become aware that we have inadvertently collected data from a child under 13 without consent, we will delete it promptly.

We may update this policy as our programs or technology change. When we make material changes, we will update the “Last updated” date at the bottom of this page. The latest version will always be available at starlight.org/privacy.

We encourage you to review this policy periodically. Continued use of our site or services after changes constitutes acceptance of the updated policy.

Questions about this privacy policy or how we handle your data? Reach our team at starlight.darkskies@gmail.com. We aim to respond to all privacy enquiries within 5 business days.