Starfield Labs Privacy Notice

1. Who is responsible

Starfield Inc., a Delaware corporation, 2140 South DuPont Highway, Camden, Kent County, Delaware 19934, USA ("Starfield", "we") is the controller of the personal data described here. Contact us about privacy at support@starfield.net.

When an organization runs an event and receives participants' contact details, it uses them as its own controller, under its own privacy notice.

2. What we collect and why

We do not sell your personal data, and we do not use it to train AI models. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

3. Who we share it with

We use these service providers. Each but Meta processes data only on our instructions, under contract; Meta's role is set out below the table:

Meta: only if you accept Advertising, each time you sign up, enroll in an event, create a team, or submit a project, we send Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, the action's name and time, an ID that lets Meta count it once, the event's ID when the action is in an event, your email address hashed, and the Meta ad you clicked in the last 90 days, if any. For an action in your browser we also send your IP address and browser. An enrollment or submission an AI agent makes for you is sent without them, and a team an agent creates is not sent. Meta matches this to its accounts and tells us which of our ads led to the action. We ask Meta to apply Limited Data Use wherever it places you in a US state whose privacy law calls for it.

We and Meta are joint controllers for collecting and sending this data; Meta then uses it as its own controller, under its own privacy policy, which says how to use your rights with Meta. If you withdraw Advertising, we send nothing more and delete the ad click we hold, but we cannot delete from Meta what it has already received.

We also share data:

• with event organizers and judges, for the events you enter;
• with other members, as you choose: your teammates see your team activity, and anyone sees what you make public;
• on our Discord server, where we post announcements and winners, which may include team names and usernames;
• with GitHub or Google, if you sign in with them, which tells them you signed in to Starfield Labs;
• with authorities, when the law requires it, or to protect people's safety or our rights;
• with a buyer or successor, if Starfield's business is sold or merged, under this notice.

4. International transfers

We keep our main data in the EU. Some providers process data in the US or elsewhere. We rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses and the UK addendum.

5. How long we keep it

6. Your rights

Depending on where you live, you have the right to access, correct, delete, or export your data, to object to or restrict our use of it, to withdraw consent at any time, and to complain to a data protection authority, such as the one where you live or work. You can do most of this yourself in your settings; for anything else, email us. We answer within one month. We will not treat you differently for using your rights.

7. Deleting your account

You can delete your account in your settings. We then erase your personal data across Starfield Labs, normally within 24 hours, and always within 30 days, and email you when it is done. After deletion:

• What you added to things others own, such as a team's project, stays, shown as by "a deleted member".
• Your team chat messages and files are erased, leaving a note that a deleted member's message was removed.
• We keep, linked only to an internal ID and with no name or email: your terms acceptances, accepted statements and cookie choices for 6 years; and a minimal record that the account existed and was deleted, with a locked copy kept for 6 years, so a backup restore cannot bring your data back.
• We keep records the law requires, for the period it requires.
• Copies already sent to an event's organizations are in their control.
• What we sent to Meta, if you accepted Advertising, is in Meta's control.

8. Exporting your data

You can ask for a copy of your data in your settings. We gather it from every part of Starfield Labs into one archive, with a README that explains each file, and email you when it is ready. Only you can download it, for 7 days.

9. AI agents

When you connect an agent, the agent's provider may receive data the agent reads from Starfield Labs on your behalf. That provider handles it under its own terms and privacy notice, not ours. You can see what your agents did, and revoke them, in your settings.

10. Cookies and similar storage

We store only what Starfield Labs needs to work, unless you accept Analytics or Advertising in our cookie banner. You can change your choice at any time with "Cookie settings" in the footer. Your choice lasts 6 months or until this notice changes.

We honor Global Privacy Control. If your browser sends it, Advertising starts off and "Accept all" leaves it off; it turns on only if you switch it on yourself in "Cookie settings".

11. Age

Starfield Labs is for people 16 or older. If we learn that someone younger has an account, we delete it.

12. Security

We protect your data with encryption in transit and at rest, access controls, sign-in without passwords, and an audit log of staff actions. See /security.

13. Changes

We post each new version here with its date, and keep earlier versions at /privacy/ followed by their version.