Privacy Policy

1. Introduction

StarReply ("we", "us", "our") operates the StarReply application and related services (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service. By accessing or using the Service, you agree to this Privacy Policy.

2. Availability

Anyone can ask questions on StarReply from any country, unless doing so is prohibited by applicable law in your jurisdiction. Creator accounts are only available to people who live in a country supported by our payment processor, Stripe, because creators must be able to receive payouts. When you sign up, you select your country and we use it to check eligibility and to pre-fill the country for your payout setup. We store it with your account. Your bank account must be in the same country where you live. Once saved, your country can only be changed after you have been verified by Stripe and removed your payout details.

3. Information We Collect

3.1 Information You Provide (Registered Creators) StarReply accounts are passwordless — we never collect or store a password. Instead, we send a one-time 6-digit code to your email address each time you log in or confirm a sensitive account action. We may collect the following information: • Username • Email address • Country of residence (selected at sign-up, used to check payout eligibility and pre-fill your payout setup) • Profile picture • Profile description (optional, publicly visible) • Account settings and notification preferences • Records of your earnings and withdrawals • The creators you follow and the answered questions you bookmark Payout details (Creators) When you set up payouts, you enter your identity and bank details into a secure form provided by our payment processor, Stripe, which is displayed inside StarReply. Stripe collects and stores this information directly, including your legal name, date of birth, residential address, phone number, full bank account number and, depending on your country, a government ID number (for example a tax or social security number) and photo ID or supporting documents. This information is required by Stripe and applicable financial regulations to verify your identity, prevent fraud and money laundering, and ensure payouts are made securely to the right person (see Section 17). StarReply sets your payout account's business details for you: your business type is set to individual, your website is set to StarReply's website, and the statement descriptor is set to STARREPLY.IO. You are not asked to enter or change these. StarReply does not receive or store your date of birth, residential address, phone number, full bank account number, government ID number, or any photo ID or supporting document. StarReply keeps only the following payout details so we can pay you and show your payout status: • Your legal name • Your bank routing number • The last four digits of your account number • Your country and currency • Your verification status (pending review, action needed, verification failed, or verified), which we receive from Stripe and show to you under Identity Verification. If verification fails, we stop displaying your saved payout details • Your Stripe account ID (a reference that links your StarReply account to your Stripe account) Stripe is an independent company. How it handles your information is described in Stripe's Privacy Policy (stripe.com/privacy), and you may be asked to accept Stripe's own terms when you complete its form. 3.2 Information Collected From Askers Askers do not need to create an account to use StarReply. When an asker submits a question, we collect: • Email address — used solely to: - Send a verification code before submission - Send the private answer page link when the creator responds - Send a payment hold confirmation - Send transactional notifications (e.g. question expiry) • Payment card details (processed by Stripe — we do not store card numbers) • Question content • Review content, if you choose to leave one (a star rating and an optional written comment). Reviews are not linked to your name or email address when shown publicly Your email address is private. It is never shown or sent to other users — other users only ever see your username Asker email addresses are not used for marketing or sold to third parties. 3.3 Information Collected Automatically We may automatically collect: • IP address • Device and system information • Usage data (interactions within the Service) • Log and diagnostic data We use this information to operate, secure, and troubleshoot the Service, to detect abuse and fraud, and to understand aggregate usage. We do not use it to build advertising profiles. When a creator logs in, we also record the IP address and browser or device details for that login session, and keep them in security logs. We use these to detect suspicious activity and to send the new-device security notification described in Section 5a. 3.4 Payment Information Payments are processed by Stripe. We do not store full credit or debit card details.

4. How We Collect Information

We collect information: • Directly from you (e.g. account creation, settings updates, payments) • Automatically through your use of the Service • From third-party service providers

5. How We Use Your Information

We use your information to: • Provide, operate, and maintain the Service • Create and manage creator accounts • Display your profile description publicly on your profile page • Enable anyone to send a question to a creator without an account — the full ask flow (question, email verification, payment) is presented as a single scrolling page on the creator's public profile; each section (question, email, payment) reveals progressively once the previous step is completed • Enable creators to answer questions and receive payments • Display answered questions and their answers to other users of the Service (see Section 9b) • Process payments and payouts • Send transactional email notifications (see Section 5a) • Run an automated check that an answer addresses the question asked before it is sent (see Section 7) • Automatically screen reviews for profanity and slurs before they are accepted (this check runs on our own systems and the review text is not sent to a third party for it) • Run an automated check that a profile picture is appropriate before it is saved (see Section 7) • Display reviews publicly on a creator's profile (see Section 9a) • Detect and prevent fraud, abuse, and unauthorised activity • Provide customer support • Improve and develop the Service

5a. Email Notifications

StarReply sends transactional emails to both creators and askers. These are not marketing emails. Asker emails (always sent — these are essential transaction communications): • Confirmation that a question was sent and a payment hold placed • Notification that their question has been answered, with a link to their private page • Notification that their question was cancelled after going unanswered for 24 hours, or sooner if their bank released the payment hold early (hold released, no charge) • A one-time review reminder sent approximately 36 hours after an answer is received, while the 72-hour review window is still open Creator emails (always sent — cannot be disabled): • Confirmation that your answer was sent successfully • A daily payout confirmation when a payout has been processed • A payout has failed due to invalid bank details (escalating reminders sent daily for the first 7 days, weekly until day 28, monthly until day 90, then on day 365 and day 730 — after which reminders cease) • A security notification whenever your account is logged into on a new device, since this automatically signs out any other active session (see Section 8 and Section 12) Creator emails (on by default — can be turned on or off in Settings > Notifications): • A new question has been received Asker email addresses are used solely for the transactional communications listed above and are never used for marketing.

6. Payments and Financial Information

StarReply facilitates one-time payments: • When an asker submits a question, a payment hold (authorisation) is placed on their card immediately — no money leaves their account yet • The hold is captured (charged) only when the creator answers • If no answer within 24 hours, the hold is released automatically and the asker is never charged. On rare occasions a card issuer may release the hold even earlier, at their own discretion — if this happens before the creator answers, the question is cancelled and the asker is never charged. StarReply also checks that the hold is still active when a creator opens a question to answer it, so creators do not spend time on a question that can no longer be paid • Askers may cancel their question at any time before an answer is sent — the hold releases immediately • StarReply retains a 20% commission on each completed payment — creators receive a clean 80% • Stripe processing fees are paid by StarReply out of its 20% commission — creators are never charged extra • If a payment is later disputed, charged back or refunded, creators are never charged for it and their earnings are not reversed — that risk is carried by StarReply • Bank account details, along with legal name, date of birth, address, and (where required) a government ID number and photo ID, are collected from creators by Stripe solely to verify their identity and facilitate payouts, as required by our payment processor and applicable financial regulations, including to prevent fraud and money laundering and to ensure payouts are made securely to the right person (see Section 17) • Creators initiate their own withdrawals from Settings once verified (minimum withdrawal $10) — StarReply does not automatically send earnings to bank accounts Account Credit At our discretion, StarReply may grant an asker's account a credit balance (for example, to resolve a support issue). Any such credit is automatically applied as a discount to that asker's future questions, capped at 10% off the question price per question, until the balance is used up. If a question is cancelled or its payment hold expires unanswered, any discount applied from that credit balance is automatically returned to the asker's balance. Payouts Earnings from an answered question are held for 48 hours. Once that hold period has passed with no active dispute, they are released to the creator's available balance. This is checked automatically each day and whenever a creator opens their earnings. Creators then withdraw their available balance to their verified bank account from Settings (minimum withdrawal $10). Once a withdrawal is sent, it typically arrives in your bank account within 1–2 business days for Australian bank accounts and 3–5 business days for bank accounts in other countries. Exact times vary by bank. Analytics Dashboard Creators have access to an Analytics & Payouts section within Settings that displays a full breakdown of their revenue, answered questions, payout history, and customer statistics — all scoped to their current account. Creators may also export a date-filtered CSV of their daily payouts — useful for tax purposes or tracking earnings from StarReply to their bank account. All earnings data is isolated to the creator's current account creation date; data from any prior account using the same email address is never included.

7. Data Sharing

We do not sell personal information. We may share information with: • Payment processors (e.g. Stripe) — to process payments, verify creator identity and send payouts • Email delivery providers (e.g. Resend) — solely to send transactional notifications • AI service providers — when you choose a profile picture, the image is sent to an AI model (accessed through Vercel's AI Gateway, currently provided by Google, with OpenAI as a backup) solely to check that it is appropriate before it is saved. We do not send your name or email address with it. When a creator submits an answer, the text of the question and the answer is sent to an AI model (accessed through Vercel's AI Gateway, currently provided by Google, with OpenAI as a backup if the primary model is unavailable) solely to check that the answer addresses the question before it is sent (see Section 5). We do not send your email address, payment details, or identity or bank details for this check • Infrastructure and hosting providers (e.g. Supabase, Vercel) • Professional advisers or authorities where required by law

8. Cookies and Similar Technologies

StarReply sets only one cookie of its own, used solely to maintain your logged-in session once you have verified a 6-digit code sent to your email. That cookie contains only a random session identifier — never your email, username, or any other account data — which we match against a session record stored on our servers to confirm you are logged in. A session stays active for 30 days from your most recent visit and automatically extends each time you return, so an account you use regularly will not be logged out simply because 30 days have passed since you first logged in. For your security, logging in on a new device automatically ends any other active session on your account, and we send a notification to your email address whenever this happens. If you did not initiate that login, this lets you know immediately so you can secure your account. We do not use cookies, device fingerprints, or IP addresses to identify you for login or rate-limiting purposes — every login and verification code is checked against your email address alone. Third-party technologies Pages that load Stripe's payment or identity verification forms may cause Stripe to set its own cookies or similar technologies for fraud prevention and security. These are controlled by Stripe and described in its Privacy Policy (stripe.com/privacy). We also use Vercel Web Analytics to measure page views and usage in aggregate; it does not use cookies to track you across websites. We do not use advertising or marketing cookies.

9. Data Retention and Account Isolation

• Personal information is retained while your account is active • When an account is deleted, personal data is removed or de-identified where reasonably practicable • The payout details we keep (legal name, bank routing number, last four digits of your account number, and verification status) are removed from our systems when an account is deleted, and we also delete your payout account with our payment processor, Stripe • Stripe is an independent company and may keep certain identity and financial records after deletion where it is legally required to (for example, anti-money-laundering and financial record-keeping obligations). StarReply cannot access or remove those records. How Stripe handles them is described in Stripe's own privacy policy • Askers' email addresses and question content are kept for as long as needed to deliver the private answer page, provide support, prevent abuse, and meet financial record-keeping obligations. Askers can request deletion by contacting us (see Section 16) • Content and records associated with completed transactions (such as answers, earnings and withdrawals) may be retained for legal and financial record-keeping • If you delete your account and re-register with the same email address, your new account starts with a clean slate — no data from your previous account (questions received, earnings, answered Q&As, or notification preferences) carries over

9a. Reviews

After receiving an answer, askers may leave a review on their private page within 72 hours of the answer being received. • Reviews are publicly visible on the creator's public profile • Reviews include a star rating (1–5 stars) and an optional written comment (up to 200 words) • Reviews are anonymous — the reviewer's identity is never displayed publicly • One review is permitted per answered question • Reviews are not available for a question that has no real topic or substance (for example, random characters or a bare greeting), because the answer to such a question is not checked for quality • Reviews cannot be edited after submission • Honest criticism is welcome, but reviews must not contain profanity or slurs, including racial, religious, and other hateful slurs, or disguised versions of them (for example with symbols, numbers, or spacing). Reviews that do are automatically blocked and cannot be submitted • StarReply may remove reviews that violate our content guidelines • The asker's email address may be used to send a one-time review reminder approximately 36 hours after the answer is received

9b. Questions and Answers Shown to Other Users

When a creator answers a question, the question and the answer may be displayed to other users of the Service — for example in the creator's list of answered questions and in the feeds of users who follow that creator. Users can also bookmark answered questions. • An asker's email address is not displayed to other users in the app. Where an asker has a StarReply account, their username may be shown alongside the question • Please do not include personal, confidential, or sensitive information in a question, because the question and its answer may be seen by others • You can ask us to remove a question or answer that contains your personal information by emailing starreplyio@gmail.com • Reviews are described separately in Section 9a The answer is also delivered to the asker privately, through a private link sent to their email address.

10. Payout Verification & Bank Details Management

You may add or remove your identity verification and bank details at any time from Settings without deleting your StarReply account. To change any of your payout details, including your bank details, you remove your payout details and add them again, which means completing identity verification again. Identity verification is performed by our payment processor and is required before you can withdraw funds or answer questions. We do not perform identity verification ourselves — you enter your information directly into a secure form provided by our payment processor, Stripe, which is displayed inside StarReply. Removing your payout details will: • Remove your identity verification and payout information from our systems • Delete your payout account with our payment processor, Stripe (Stripe may keep certain records where legally required, as described in Section 9) • Pause payouts and prevent you from answering new questions until your details are re-added and re-verified

11. Your Rights

You may: • Access your personal information • Update or correct your information • Remove your payout account • Delete your account • Manage email notification preferences in Settings > Notifications Requests can be made via the contact details below.

12. Security

We implement reasonable technical and organisational measures to protect your information. StarReply does not use passwords — creators sign in with a one-time 6-digit code sent to their email address, and sensitive account actions (such as changing your email or deleting your account) require the same kind of one-time code. Codes are generated using a cryptographically secure random process, expire after 3 minutes, and can be attempted only 3 times per 30-minute period before further attempts are temporarily blocked, regardless of where or how the attempts are made. Keeping your email account secure is therefore essential to keeping your StarReply account secure. Only one device may be logged into a StarReply account at a time. Logging in on a new device automatically ends any other active session, and we email the account's registered address whenever this happens so you can act quickly if it wasn't you. However, no system is completely secure, and we cannot guarantee absolute security.

13. Children

The Service is not intended for children under 13 years of age, and we do not knowingly collect personal information from them. If we learn that we have, we will delete it. If you believe a child under 13 has provided us with information, contact us at starreplyio@gmail.com. Creator accounts and payouts are only available to people aged 18 or over (or the age of majority where they live, if higher), as required by our payment processor.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will change the Last updated date at the top of this page, and for material changes we will take reasonable steps to let you know (for example by email or an in-app notice). Continued use of the Service after any changes constitutes acceptance of the updated policy.

15. Global Availability

StarReply is available globally. Your information may be stored and processed in countries other than your own. By using the Service, you consent to such transfers in accordance with applicable law.

16. Data Subject Rights

Subject to applicable law, you have the right to: • Request access to your personal information • Request correction of inaccurate information • Request deletion of your information (subject to legal retention obligations) • Object to processing of your information Requests can be made by contacting starreplyio@gmail.com. We may need to verify your identity before acting on a request (for example, by asking you to confirm a one-time code sent to your registered email address). We aim to respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with your local data protection or privacy authority (for example, the Office of the Australian Information Commissioner in Australia).

17. Compliance with Regulatory Obligations

StarReply complies with applicable laws and regulations regarding payment processing and identity verification (Know Your Customer / anti-money-laundering requirements). The identity and bank details collected from creators by Stripe, and the limited payout details StarReply keeps (see Section 3.1), are used solely to verify identity and facilitate payouts, and are not used for any other purpose. Why we require this information Because StarReply pays creators real money, financial regulations require our payment processor to verify who is receiving funds before payouts are enabled. This information is collected so that Stripe can: • Confirm that you are who you say you are, and that your earnings are paid to the right person • Prevent fraud, identity theft, money laundering, terrorist financing and other financial crime • Comply with legal obligations such as Know Your Customer and tax reporting requirements that apply in your country • Make sure payouts reach a bank account that belongs to you, keeping creators and askers safe We understand that sharing personal and identity details is not always welcome. It is required to offer paid payouts securely and lawfully, and we cannot enable payouts without it. Stripe, not StarReply, collects and stores your identity and bank details (see Section 3.1). We may be required to disclose your information to government or regulatory authorities as required by applicable law.

18. Third-Party Links

The Service may contain links to third-party websites (such as payment processors or regulatory bodies). We are not responsible for the privacy practices of third-party sites. We encourage you to review their privacy policies before providing any information.

19. Dispute Resolution

Any disputes regarding this Privacy Policy or the collection and use of your information shall be resolved in accordance with applicable law.

20. Contact

For privacy-related enquiries: Email: starreplyio@gmail.com