Privacy notice

Platform privacy

Last updated: 8 November 2026

Who we are

Stellara is a VIP table management platform for live events. It is run by Renzo Puccini, an individual based in the European Union. You can reach us at support@stellaravip.com.

This notice covers the Stellara platform: the app used by event organisers and their teams. Our public website has its own notice at stellaravip.com/privacy.

We have two roles, depending on whose information it is:

Information organisers keep about their guests (VIP clients, bookers, ticket buyers, bookings and payments): the event organiser decides what to collect and why, so the organiser is responsible for it (the "responsible party" under South Africa's POPIA, the "controller" under the EU GDPR). We only process it on their behalf, under a written agreement. If you are a guest, the organiser's own privacy notice applies, and questions about your information should go to them first. We will pass on any request we receive.
Information about people who use the platform (organiser owners and team members): we are responsible for this, and the rest of this notice explains how we handle it.

What we collect about platform users, and why

Name, email address, role and organisation: to create your account, sign you in and show your team who did what. Basis: performing our agreement with your organisation, and our legitimate interest in running the platform.
Sign-in records, two-factor status and security events: to keep accounts and organisers' data secure. Basis: legitimate interest in security, and our legal obligation to protect personal information.
Activity log of changes you make (who, what, when): so organisers can see and audit changes to their records. Basis: the legitimate interest of the organiser and us in an accurate record, and financial record keeping.
An organiser's legal, tax and bank details (for a sole proprietor, these are personal): so the organiser's documents carry the right details. Bank account numbers are encrypted. Basis: performing the agreement.
Messages you send to support: to answer you. Basis: legitimate interest in providing support.
Product usage events without contact details, and error reports with personal information removed: to find bugs and improve the platform. Basis: legitimate interest in a working product.

We do not sell personal information, use it for advertising, or build profiles of you for anyone else. We do not collect identity numbers or tax reference numbers.

Google Sheets and your Google data

Stellara can connect to Google Sheets so an organiser can bring ticket sales into the platform from a sheet instead of uploading a file.

What we access: only the Google Sheets files you choose in Google's file picker. We cannot see any other file in your Google Drive. We ask for Google's narrowest file permission ("drive.file").
What we do with it: we read the rows of the sheet you chose and import the ticket and buyer information into your organisation's event, exactly as if you had uploaded the file. We never change or delete your sheet.
What we store: the imported records, a reference to the chosen sheet, and an access token so "Refresh from source" can read it again. We store the token encrypted. You can disconnect at any time in Stellara or in your Google Account's security settings, which removes our access.
What we never do: we do not use Google data for advertising, sell it, use it to train AI or machine-learning models, or let people read it except where you ask us to (for example, for support), for security, or where the law requires.

Stellara's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Where it is held, who helps us, and for how long

The platform's data is held in the European Union, in Amazon Web Services' Frankfurt region (Germany). It is not hosted in South Africa today. For organisers in South Africa, this is a cross-border transfer covered by our written agreement and by the GDPR, which applies to us.

Service providers who process data for us: Supabase (database and sign-in), Amazon Web Services (email and encrypted backups), Vercel (runs the app), Sentry (error reports, personal information removed), PostHog (product usage, no contact details), Namecheap (forwards support email) and Google (only if you connect Google Sheets). Several are US companies; they process our data in the EU under data protection terms that include the European Commission's standard contractual clauses where needed.

How long we keep it:

Account details: while you are a member of an organisation on Stellara; after that your name is removed from your account.
Activity log entries: 7 years, because they form part of organisers' financial records.
Support emails: up to 2 years after the conversation ends.
Backups: up to 28 days.

The platform uses only cookies it needs to work: keeping you signed in, and remembering access to a password-protected client map. There are no analytics or advertising cookies in the app.

All data is encrypted in transit and at rest; bank account numbers are encrypted again field by field; each organisation's data is kept separate and this is tested automatically; two-factor sign-in is available to every user.

Your rights

You can ask us for a copy of your information, to correct it, delete it, restrict or object to how we use it, or to send it to you in a portable format. Email support@stellaravip.com; we answer within one month. If your request is about information an organiser holds about you as a guest, we will pass it to that organiser.

If you are unhappy with how we handle your information, please tell us first. You can also complain to a data protection authority: in the EU, the authority where you live or work, or where we are based; in South Africa, the Information Regulator (inforegulator.org.za).

Changes

If we change this notice in a way that matters, we will tell organisation owners by email before it takes effect.