Privacy notice

Controller and contact

StarMap Creator, Nicolaus-Ehlen-Str. 13, 59063 Hamm (Westf), Germany. The controller is the individual operating StarMap Creator identified in the legal notice. Email: contact@starmapcreator.com. The contact form is also available.

Operator and contact details (legal notice)

Scope

This notice covers the public landing page and, when enabled, the waitlist. User accounts, Google sign-in, payments and the private star-map application are outside this offering. No advertising services or personal usage profiles are included. The initial offering is intended for adults.

Delivery and security

Your IP address and technical connection data are processed temporarily to deliver the website. The website application and its reverse proxy do not keep access logs containing visitor IP addresses, complete request URLs or form contents. The purpose and legitimate interest are secure delivery and prevention of abuse; the legal basis is Article 6(1)(f) GDPR. Separately, the email provider processes technical delivery data as described in the section on recipients and locations.

Waitlist and consent

Participation is optional. The data processed includes your email address, selected language, request and confirmation times, status, expiry date and the versions of the consent and privacy notice shown to you. The purpose is one email about the availability of and access to StarMap Creator. Confirmed participation is based on your consent under Article 6(1)(a) GDPR. Notification requires an email address and its confirmation. This is not a purchase, trial subscription, immediate access or regular newsletter.

Confirmation and abuse prevention

After your request, a confirmation email is sent. Its link opens a page; only a further explicit click activates participation. Confirmation links expire after 48 hours and can be used once. Secret link values are hashed in the database and encrypted in the unsent mail queue. A hidden form field, time-bound single-use checks and volume limits help prevent automated requests. IP addresses are processed temporarily in memory only; derived rate-limit values protected by a temporary key expire within one hour and are never written to disk. These security and request-verification measures are based on Article 6(1)(f) GDPR; the operator’s legitimate interest is preventing unauthorised signups, spam and automated abuse.

Withdrawal and deletion

You can withdraw at any time using the unsubscribe link in the waitlist emails or by contacting contact@starmapcreator.com, without an account. Withdrawal applies to future processing. Unconfirmed entries expire after 48 hours. Confirmed entries are deleted no later than twelve months after confirmation or 30 days after the availability email is handed to the mail server, whichever is earlier. Automatic cleanup runs regularly while the service operates and before further delivery. Unsubscribing removes the active entry and pending emails.

Backups and recovery

Encrypted database backups in the dedicated backup directory on the web server are retained for no more than 30 days. Deleted records may remain in existing backups until expiry and are not used further. A recovery journal kept separately from database backups contains only secret-key-derived entry identifiers, deletion or delivery events and their times, without email or IP addresses. Journal events expire after 60 days. Before reuse, restored data is checked against the verified current journal in an isolated environment. Deleted entries, unconfirmed requests and queued mail are removed, and previous notifications are taken into account. If this check cannot be completed reliably, the restored waitlist data is not released for live operation or email delivery.

Country totals without visitor identification

Landing-page views are counted by country. The connection IP is looked up immediately on the server used for StarMap Creator using a locally stored DB-IP country database and is not saved afterwards. Only accumulated page views by country, by calendar day (Europe/Berlin), and by calendar day and country are stored. Continents are grouped from country codes using a local statistical mapping. Private administration displays daily charts for all views or selected countries and continents, including the entire available daily history. The start of daily country counting is recorded once as a technical timestamp; it is not a visit timestamp. Missing daily values or country breakdowns from before counting began are not reconstructed retroactively. There are no visit events, per-visit timestamps, visitor IDs, stored IP addresses, fingerprints or links to waitlist entries. No external IP lookup occurs. Unknown countries use ZZ. Reloads and bots may count; these figures do not identify nationality or unique people. Aggregate totals are retained until this statistics feature is discontinued. The basis for the temporary country lookup is Article 6(1)(f) GDPR; the operator’s legitimate interest is understanding broad regional demand without personal visitor profiles.

Recipients and locations

Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, is the hosting provider for the website, waitlist database and email processing. The website and waitlist database run on the server used for StarMap Creator in Nuremberg; the mailboxes use Hetzner web hosting with server locations in Germany. Provider-managed backups may be stored within the European Union. The email provider processes recipient addresses, message content and technical delivery data. Hetzner specifies seven days for mail server logs and 14 days for web hosting backups; the operator’s database backups and recovery journal are described separately above. A data processing agreement with Hetzner is in place. Your own email provider may operate outside Germany or the EU; worldwide delivery cannot be guaranteed to remain exclusively within these areas. The country database is downloaded separately as a public file; no visitor data is transmitted for that download. Hetzner also makes daily Cloud backups of the server disk using seven rotating backup slots. Copies of the dedicated backup directory may remain within these server backups until the corresponding slot rotates. The recovery procedure does not use database backups older than 30 days and requires a verified current recovery journal.

Contact form and enquiries

The contact form processes your email address, message, selected language and, optionally, your name or username. Your message is transmitted over an encrypted connection to the contact mailbox at Hetzner. Its content is not additionally stored in the website database, and no automatic reply is sent to the supplied address. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual enquiries, otherwise Article 6(1)(f) for handling your enquiry and preventing abuse, or Article 6(1)(c) for statutory data protection obligations. Attachments are not supported. Time-bound single-use checks, a hidden field and volume limits help prevent spam; IP addresses are processed only temporarily in memory for this purpose. The technical database stores only expiring aggregate counters, without sender addresses, messages or IPs. General enquiries are deleted six months after handling is completed; necessary records of data protection requests are generally deleted three years after completion, unless another statutory obligation applies. The operator handles and deletes messages in the mailbox. Provider backups may retain copies until the retention period described in these notices ends.

Your rights

Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You may withdraw consent at any time for the future without affecting the lawfulness of earlier processing. Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. You may complain to a supervisory authority, including the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, PO Box 20 04 44, 40102 Düsseldorf, Germany, www.ldi.nrw.de/kontakt. No automated decisions with legal or similarly significant effects are made.

Manual protection against waitlist spam

After manual review, obvious spam signups may be deleted and blocked for 30 days without a separate notification. The waitlist entry and queued waitlist emails are deleted. Only a keyed HMAC of the normalized email address, the start and expiry of the block are stored to detect repeat signups; the blocklist contains no plain-text address. A block can be lifted early and expires automatically. A separate pseudonymous restore journal prevents deletions or unblocks being reversed by regular backups for up to 60 days. Administrative actions are recorded for 365 days without copying addresses. The basis is Article 6(1)(f) GDPR to prevent abusive signups and unwanted confirmation emails. Objections or clarification requests can use the stated contact channel.