Version 2026-10-14
Privacy Notice
Version 2026-10-14, under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR"). This is a translation: if it differs from the Italian version, the Italian version prevails.
1. Controller
Federico De Cillia, sole proprietorship GPT Chatbot di Federico De Cillia, Via Ernesto Teodoro Moneta 50, 20161 Milan, Italy, VAT IT13990330964. For any request: info@flylabs.ai; certified email (PEC) federico.decillia@spidmail.it.
2. Who this notice is for
- Users of Stellar Reviews: people who sign in to the app on behalf of a customer property.
- Visitors of the public pages and the demo.
- Review authors: for their reviews Stellar Reviews acts on behalf of the reviewed property, which is the controller (section 7).
3. Data, purposes, legal bases, retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Create and manage the account, give access, provide the service | name, email, property, role, settings | Contract (Art. 6(1)(b)) | life of the account, then 30 days |
| Service emails: sign-in links, alerts about reviews and drafts, trial, plan and payments | Contract | life of the account | |
| Purchase of paid plans and packs through Link (Stripe) | email of the account owner, business name, internal business identifier, plan or pack bought; from Stripe we receive the status of the subscription and of payments, never card details | Contract | life of the account, then 30 days |
| Service security and abuse prevention | IP address, browser, requests and technical logs | Legitimate interest (Art. 6(1)(f)) in protecting the service and customers | as long as hosting providers keep them, at most 90 days |
| Internal statistics on service use, to improve it | usage data linked to the account (drafts copied, published, edited) | Legitimate interest in improving the service | life of the account; afterwards only in aggregate form |
| Register of AI-generated drafts and public verification | non-reversible fingerprints computed from draft text, model, date | Legal obligation, Article 50 of Regulation (EU) 2024/1689 (Art. 6(1)(c)) | 5 years from generation |
| Marketing to customers about similar services | name, email | Art. 130(4) Italian Legislative Decree 196/2003; you can object at any time, including through the link in every email | until you object |
| "Try it on your reviews": confirm the request, prepare the private page with the listing's figures and the sample drafts, send you the link | email, Google listing link, non-reversible fingerprint of the IP address | Pre-contractual steps at your request (Art. 6(1)(b)); for the IP fingerprint, legitimate interest in preventing abuse (Art. 6(1)(f)) | 30 days, then only anonymous statistics remain |
| Marketing contact after the trial, only if you ticked the box for it | email, listing | Consent (Art. 6(1)(a)), which you can withdraw at any time by writing to info@flylabs.ai | 30 days from the request, or until you withdraw if sooner |
| Accounting and tax obligations, defence of rights | billing and contract data | Legal obligation; legitimate interest | 10 years |
If you sign in with Google, Google shares with us your name, your email address and an identifier of your account: we use them to sign you in and as the data of your Stellar Reviews account (first row of the table). We do not store your profile picture and we never receive your Google password. Google remains the controller of your Google account, under its own privacy notice.
Payments for paid plans and packs are handled by Link (Stripe), which sells subscriptions and packs as merchant of record and is an independent controller of payment data under its own privacy notice. When the account owner starts a purchase, we share with Stripe their email address, the business name, an internal business identifier and the plan or pack chosen, to link the payment to the right business. Stellar Reviews does not receive your card details.
If you ask for the trial on the "Try it on your reviews" page, we read the public reviews of the Google listing you give us through the review extraction provider, and an AI model writes three sample drafts. Reviews and drafts stay on a private page, reachable only from the link we send you, and after 30 days we delete them together with your email and the IP fingerprint. Of the review authors we show only the first name and the initial of the surname.
No decision based solely on automated processing produces legal or similarly significant effects on you.
4. Recipients
Data is processed by the controller and by the providers supporting it as processors, listed on the sub-processors page (hosting, database, email, AI models, review extraction). For payments, Link (Stripe) receives the data listed in section 3 as an independent controller, not as our processor. We do not sell data and do not disclose it to third parties for their own purposes.
5. Transfers outside the EU
Some providers are based in the United States. Transfers rely on the EU-US Data Privacy Framework, for certified providers, or on the European Commission's Standard Contractual Clauses, as indicated on the sub-processors page. Database and application functions are in the European Union (Frankfurt).
6. Cookies
We use only necessary technical cookies: the sign-in session and form protection. We do not use profiling cookies or third-party analytics cookies, so no consent banner is needed. If you reach the sign-up from the button on the trial page, a technical cookie remembers for 30 days which trial you opened, to fill in the listing link for you.
7. If you wrote a review
The property you reviewed uses Stellar Reviews to read the public reviews of its listings and prepare replies. For that data the property is the controller; Stellar Reviews is a processor and handles only what is public on the platform (name or pseudonym, text, rating, dates). To exercise your rights, contact the property; if you write to us, we forward the request. A review deleted from our systems stays on the platform until you remove it there.
If a property owner asks for the trial on the "Try it on your reviews" page before becoming a customer, for the reviews read in that trial we are the controller (section 1), on the basis of our legitimate interest in showing the property owner how the service works (Art. 6(1)(f)): we keep them for 30 days and show only the first name and the initial of the surname.
8. Your rights
You can request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interest, by writing to info@flylabs.ai. We reply within one month. You can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your country.
9. Changes
If we change this notice we update the version at the top and, for significant changes, inform users by email or in the app.