Last updated: 21 October 2026.
1. Who we are
Starise is operated by VectAI SA, Rolle, Switzerland, with operations in Switzerland and Qatar. You can contact us about personal data at contact@starise.ai.
This notice covers the Starise marketing website and review platform. For website enquiries and business account administration, Starise is responsible for deciding how personal data is used. When a business uses Starise to collect its customers' feedback, that business generally decides the purpose of collection and Starise processes the information on its behalf. The business's own privacy notice also applies to that relationship.
2. Information we process
Website visitors. Our hosting services receive technical information needed to deliver and secure the website, such as IP address, requested resource and browser information. Google's tag also loads on most pages of the website and app from your first visit, before you make a privacy choice. Section 5 describes what it sends and the optional measurement you can choose.
Business accounts. We process registration and contact details, business and location information, account settings, subscription and transaction records, and communications with our team. Connected review profiles and account permissions are used to provide the features you request. Payment processing is handled by a payment provider; do not send payment card details to our support team.
Customer feedback. A review flow may process ratings, selected answers, written comments, a voice recording and its transcript, and a generated review draft. The business can receive feedback and associated review collection information through its dashboard. A voice transcript may be stored with the feedback record; speaking instead of typing does not make your contribution anonymous.
Reputation assessments. The checker can remember an active or completed check in session storage for up to 24 hours, so you can reopen it after refreshing the same browser tab. This stores the check reference and business label, not your location. When you use the reputation check, we process the selected public business listing, review data, nearby comparison data and the resulting metrics. We retain venue assessments to deliver reports, avoid repeat collection and improve the methodology. If you request a report, we also store your email, role, ownership/management confirmation and any monthly-customer estimate you supply. Ownership is self-attested. This information supports report delivery and a scored business record; searching a venue alone does not identify you as its owner.
Monitoring and multi-location reports. You can request a report covering several locations that you confirm you own or manage. Monitoring is separately opt-in: after email confirmation, we check the subscribed locations every thirty days by default and notify you of meaningful changes or repeated refresh failures. Every alert links to monitoring settings where you can stop. Stopping cancels future checks and queued alerts; it does not delete historical assessments. Subscription and notification records are retained to administer the service. Advertising measurement is a separate choice.
Public reviews and responses. We process review content and associated public profile information from supported review platforms to provide the review inbox, analysis and response features.
Avoid including sensitive or unnecessary personal information in feedback. In particular, do not include health records, diagnoses, financial account details or information about another person that you are not authorised to share.
3. Why we use information
We use information to provide and administer the service, prepare requested review drafts and proposed business responses, analyse feedback for the business, manage subscriptions, answer support requests, secure the service and meet legal obligations.
Where applicable data protection law requires a legal basis, account and service administration may be necessary to perform a contract; billing and regulatory records may be required by law; security and responding to business enquiries may rely on legitimate interests. Advertising measurement, and optional analytics, campaign attribution and session recording that you allow, rely on your consent. For the cookieless Google measurement and the default analytics on customer review forms described in section 5, we rely on your consent or on our legitimate interest in measuring and improving our service, as applicable in your region. Section 5 explains how to turn these off or object. Where a business is the controller of customer feedback, it is responsible for identifying and communicating the appropriate legal basis.
AI assists with transcription, drafting and analysis. A generated draft is not automatically a public review. Customers decide whether to post and do so from their own account. Do not include private details in text you intend to publish.
4. Service providers and other recipients
Delivering the service requires providers for hosting, storage, payments, AI processing and analytics. We use Microsoft Azure services, Stripe for payments, OpenAI for AI processing including voice transcription, PostHog for optional browser analytics and session recording, Google (Google Tag Manager, Google Analytics and Google Ads) for website and app measurement as described in section 5, and Meta for advertising measurement when you allow it. These providers receive the information needed for their respective functions; this is different from selling customer data or sharing it for another company's marketing.
For the reputation check, Google Places supplies listing suggestions and Apify supplies public listing/review data. Business search can use an approximate location from IPinfo, or your browser location when you choose to share it. Location is used to prioritise nearby suggestions and is not saved into the venue assessment. A bot-verification provider (Cloudflare Turnstile when enabled) processes technical information to protect the public tool. With your advertising-measurement consent, Meta may receive assessment events and a hashed report-request email for measurement and audience matching. Hashing does not make an email anonymous.
A business using the review flow receives the feedback collected for it. When you choose to publish a review, the selected review platform processes it under its own terms and privacy policy, and the review may become public. Opening a booking link takes you to Calendly, whose own privacy notice applies.
Information may also be disclosed when required by law, to protect legal rights, or as part of a business reorganisation subject to applicable data protection requirements. We do not sell personal data.
5. Website privacy choices
Optional analytics, campaign attribution and advertising measurement start off, except on customer review forms as described below. Accept enables all three; Reject disables all three. Cookie settings lets you choose the purposes separately; advertising measurement also requires campaign attribution. Closing the settings dialog without saving does not change your choice. Use Privacy choices on the website or in the app to reopen the settings at any time. You can use both with optional settings off.
When enabled, PostHog receives page and interaction events, browser and device information, and network information such as your IP address. In the app, analytics may associate activity with your signed-in user and business. This helps us understand site use; it should not be understood as anonymous collection.
Session recording. With analytics enabled, PostHog may record your sessions in the app on customer review pages and on most signed-in business pages. A recording captures what appears on screen and what you type, including names, email addresses, phone numbers, review text and other form entries. Passwords, one-time and verification codes, payment card fields, API keys, tokens and links that give access to an account or payment page are hidden or not recorded. Audio, video, embedded third-party frames, network request contents and console logs are not recorded. Sign-in, signup, password, account settings and billing pages are not recorded. Recordings help us find and fix problems and support you. They are not anonymous.
On this marketing website, session recording and automatic form or click capture are disabled. Events are sent for selected interactions, and page-view measurement uses the page path rather than the full query string.
When campaign attribution is enabled, the st_attr cookie remembers the campaign that brought you to Starise, including campaign labels, entry page, referring website and time of visit. It lasts up to ninety days and may be shared with the Starise app during signup. Turning campaign attribution off removes the cookie and stops this website from adding saved campaign details to app links. Turning analytics off stops PostHog analytics and session recording, and Google Analytics cookies. Reject turns off all three optional purposes, including advertising measurement. Neither stops the cookieless Google measurement described below. The app inherits the website’s choice on Starise subdomains (starise.ai and app.starise.ai).
We store your choices in a shared Starise cookie and, when available, local browser storage under starise_privacy_choice for 180 days, together with a settings version, save time and expiry time. This preference cookie lets the app inherit a choice made on the landing website without asking again. Changes apply in the current tab immediately; another open website or app tab checks the shared choice when it becomes active or reloads. The choice is not saved to your account or synchronised across devices.
A partner referral code may be carried within your current signup session to connect your account to the intended partner. This is separate from advertising measurement.
Your theme preference may also be stored to remember the appearance you selected. PostHog analytics identifiers on this marketing site use memory rather than persistent analytics cookies; its SDK may store a separate opt-in or opt-out preference flag in local storage. The landing website’s PostHog integration does not automatically save campaign parameters or referrer information. Browser controls can remove stored information, which may cause the site to ask for your choice again. If settings cannot be saved, optional tracking stays off for that visit.
Google measurement without cookies. The website and app load Google's tag, through Google Tag Manager, on most pages from your first visit. Until you allow analytics, the tag runs with every Google consent setting denied. In that state it sets and reads no cookies, sends no analytics or advertising identifier, and removes ad click identifiers from the data. Google may still receive basic page-visit information: the page location with sensitive details removed, the website that referred you, your consent settings, and browser and network information, including your IP address. Google can use this information in aggregated and modelled measurement reports. This happens before you choose, after Reject, and when analytics is off. Google's tag is not loaded on admin or partner pages or on test deployments. It is also not loaded on links that carry sign-in or invitation codes unless you have allowed analytics. To object to this measurement, contact us; you can also prevent it by blocking Google Tag Manager in your browser settings or with a content blocker.
Google Analytics with your consent. With analytics enabled, Google Analytics also sets analytics cookies (such as _ga) that recognise your browser across visits. Starise supplies page locations with sensitive app path details and unrelated query parameters removed; campaign parameters are included only when campaign attribution is allowed.
Advertising measurement. Advertising measurement is a separate choice. When you allow it, Google Ads and Meta may set advertising cookies (such as _gcl_au and _fbp) and our advertising tags run. Starise can retain Google or Meta ad click identifiers and browser user-agent information for up to ninety days, and send signup, trial and first confirmed payment outcomes to the corresponding advertising platform. The acquisition cookie stores opaque references linking a permitted visit to its account outcome; it does not contain your email address. When you sign up, sign in or complete signup from an emailed link in the app, the app also gives Google's tag your account email, normalised and hashed with SHA-256 in your browser. Google uses it to measure which ads lead to signups (Google calls this enhanced conversions). This does not happen on customer review pages, admin pages or partner pages. Where enhanced matching is enabled, our servers may also send a normalised, hashed account-owner email with a consented signup outcome to Google or Meta so they can match the outcome when an ad click identifier is missing. Hashing does not make the email anonymous. We do not backfill matching identities for older accounts or replay outcomes that lacked permission. Earlier choices that only allowed analytics or campaign attribution do not enable advertising measurement. Turning advertising measurement off removes retained click identifiers, stops passing your hashed email to Google's tag, and blocks pending advertiser deliveries. Events already received by a provider are subject to that provider’s retention controls. Live advertising delivery is disabled on Canary and test deployments.
These controls apply to optional browser analytics on the Starise website and app. Essential account, security, billing and service records continue to support the service. Confirmed account creation, verification, trial access, setup and payment facts can remain in our own operational records even when optional tracking is declined; declining does not authorize exporting these records or customer identifiers to advertising platforms or optional analytics providers. Third-party websites have their own privacy controls. Withdrawing consent stops future optional collection; it does not automatically delete events already received. You can contact us to request deletion where applicable.
Customer review forms. On customer review forms in the app, if you have not made a privacy choice on the Starise website or app, analytics and campaign attribution are on by default for up to 180 days, and advertising measurement stays off. This means PostHog analytics, session recording and Google Analytics cookies can run on the form. A recording may capture what you see and type, including your review, but passwords, one-time and verification codes, payment card fields and other secrets are hidden. You can turn analytics and attribution off from Privacy choices on the form and still leave your review. An explicit choice, including Reject or turning analytics off, always overrides this default.
Regional pricing. On global pages that include pricing, your browser may contact Country (api.country.is) to estimate your country from your IP address. The request sends no cookies, form information or page referrer. We use only the country result to select a price list; we do not request precise device location or store the returned IP address. The country result may be cached in session storage under starise_pricing_country for up to 24 hours. A region you explicitly choose is saved in local storage under starise_pricing_market for up to 180 days. Regional page URLs always use their own prices. If lookup or storage is unavailable, the site still works and global pricing defaults to USD. This pricing functionality is separate from optional analytics and campaign attribution.
6. Retention
Retention depends on the purpose of the record: account information supports the active service relationship; feedback supports the business's use of the service; billing records may need to be kept for statutory accounting obligations; and security or dispute records may need to be kept while an issue is investigated or resolved. Legal obligations can require retention after an account closes.
The marketing website's local retention periods are stated above. For the retention applicable to your business account, customer feedback or provider-held records, contact us with the relevant account or business name. If a business collected your feedback, contact that business about its retention instructions as well.
7. International processing
Starise operates in Switzerland and Qatar and uses service providers that may process information in other countries. Applicable data protection laws may require safeguards for international transfers. Contact us for information about the processing locations and transfer arrangements relevant to your account before providing data that is subject to a localisation or transfer restriction.
8. Security
We use access controls and technical safeguards to protect the service and restrict access to people who need it for their work. No system can guarantee absolute security. Contact us promptly if you believe an account or personal information has been compromised. We handle breach notifications in accordance with applicable law and our contractual obligations.
9. Your rights
Depending on the law that applies, you may have rights to access, correct or delete information, restrict or object to processing, receive a portable copy, or withdraw consent where consent is the basis for processing. Some requests are subject to legal exceptions. You may also complain to the data protection authority responsible for your jurisdiction.
Email contact@starise.ai to make a request. Tell us which business or service is involved so we can locate the relevant records. We may need proportionate information to verify your identity; do not send identity documents unless requested through an appropriate channel. We respond within the time required by applicable law and explain any lawful extension.
Where a business controls the feedback you provided, we may need to refer your request to that business or assist it in responding. Removing information from Starise does not necessarily remove a review you have published on Google, TripAdvisor or another platform; use that platform's controls for the public review.
10. Children and changes to this notice
Business accounts are intended for people authorised to act for a business. Review flows are not directed at children. Do not submit a child's personal information through a review flow without a lawful basis and any necessary permission.
We update this notice when our practices change and show the revision date above. Where required, we provide additional notice or request a new consent. A policy update does not itself constitute consent to optional tracking or a new use of personal data.