Privacy Policy

StarBright CRM ("StarBright," "we," "us," or "our") provides an AI-powered customer relationship management (CRM) platform together with this marketing website. This Privacy Policy explains how we collect, use, share, and protect information when you:

• Visit our marketing website, request a demo, or contact us;
• Create an account and use the StarBright CRM platform as an agency, broker, or agent ("Customers"); or
• Interact with one of our Customers through tools powered by StarBright — for example by submitting a web form, booking an appointment, exchanging text messages, or talking with an AI voice agent or chatbot ("End Users").

By using our website or services, you acknowledge the practices described in this Policy.

StarBright operates in two different capacities depending on the data involved:

• As a data controller for information we collect about website visitors and our direct Customers (for example, account registration, billing, and support data).
• As a data processor for the contacts, leads, messages, and records that our Customers store and manage inside the CRM. In that case the Customer is the controller and is responsible for how that data is collected and used. If you are an End User and wish to exercise privacy rights over data held by a Customer, please contact that Customer directly.

Information you provide directly

When you request a demo, fill out a contact or lead form, sign up for an account, or communicate with us, we may collect your name, business name, email address, phone number, role, the industry you operate in, and any message content or preferences you share.

Account and billing information

For Customers, we collect login credentials, workspace and agency configuration, selected plan, and payment details. Card payments are processed by our payment provider (Stripe); we do not store full card numbers on our servers.

Information collected automatically

When you visit our website or use the platform, we automatically collect technical data such as IP address, browser and device type, pages viewed, referring URLs, and timestamps, gathered through cookies and similar technologies (see Section 5).

Communications data

Our platform sends and receives email, SMS/text messages, and voice calls on behalf of our Customers. Depending on the feature in use, we may process message content, phone numbers, call metadata, and (where enabled) call recordings and transcripts.

AI voice and chat interactions

When you interact with an AI voice agent or chatbot, we process the content of that conversation to generate responses and to perform CRM actions you request (such as booking an appointment or creating a contact). These interactions may be recorded, transcribed, and logged.

Our Customers can use StarBright to send appointment reminders, follow-ups, and other transactional or marketing text messages. SMS is delivered through our telecommunications provider (Twilio) and is subject to U.S. A2P 10DLC carrier requirements.

• You will only receive text messages after providing consent to the relevant business, and message frequency varies by program.
• You can opt out at any time by replying STOP, and reply HELP for assistance.
• Message and data rates may apply.
• We do not sell or share mobile phone numbers or SMS opt-in data with third parties for their own marketing purposes.

We use cookies, pixels, and similar technologies to keep you signed in, remember preferences, measure website performance, and understand how visitors engage with our marketing pages. This may include first-party session cookies and analytics or advertising technologies such as the Meta Pixel, which helps us measure the effectiveness of our campaigns.

You can control cookies through your browser settings. Disabling some cookies may affect the functionality of the website or platform.

• Provide, operate, secure, and improve the platform and website;
• Respond to demo requests, inquiries, and support, and send transactional or service-related communications;
• Power CRM features such as lead management, scheduling, invoicing, email and SMS campaigns, AI voice agents, chatbots, and workflow automation;
• Process payments and manage subscriptions;
• Personalize content, analyze usage, and develop new features and integrations;
• Detect, prevent, and address fraud, abuse, security incidents, and technical issues; and
• Comply with legal obligations and enforce our terms.

StarBright uses artificial intelligence to power voice agents, chatbots, automated replies, and content suggestions. To deliver these features, relevant content (such as a conversation, message, or prompt) may be sent to trusted AI service providers that process it on our behalf. We do not authorize these providers to use Customer or End User content to train their general-purpose models except as needed to provide the service. AI-generated output may be imperfect and should be reviewed before being relied upon for important decisions.

We do not sell your personal information. We share information only as described below:

• Service providers who help us operate the platform, including hosting, communications (Twilio for SMS and voice), email delivery (such as SendGrid or Microsoft 365), payments (Stripe), AI providers (such as ElevenLabs and OpenAI), and Google services (Calendar and Business Profile) where you choose to connect them.
• Our Customers, when you interact with a business that uses StarBright (the data you submit becomes part of that business's CRM records).
• Legal and safety disclosures when required by law or to protect rights, safety, and the integrity of our services.
• Business transfers, such as a merger, acquisition, or sale of assets, subject to this Policy.

Our service providers are bound by contractual obligations to keep information confidential and to use it only to provide services to us.

We retain personal information for as long as needed to provide our services, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Customer-controlled data is retained according to the Customer's settings and instructions, and is deleted or returned in line with our agreement when an account is closed.

We use technical and organizational safeguards designed to protect your information, including a multi-tenant architecture that isolates each agency's workspace, role-based access controls, encryption of sensitive credentials (such as connected OAuth tokens) at rest, encryption in transit, and automatic session inactivity timeouts. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of certain jurisdictions (for example, under the GDPR or U.S. state privacy laws such as the CCPA/CPRA) may have additional rights, including the right not to receive discriminatory treatment for exercising them.

To exercise these rights with respect to data we control, contact us at support@starbrightcrm.com. If your request concerns data held by one of our Customers, we will refer you to that Customer or assist them as their processor.

We may send you marketing communications about our products and features. You can opt out at any time by using the unsubscribe link in our emails or by replying STOP to marketing text messages. We will still send you essential service and transactional messages related to your account.

We and our service providers may process and store information in countries other than where you live. Where required, we use appropriate safeguards for cross-border transfers of personal information.

Some Customers operate in regulated industries, including healthcare. StarBright provides configurable safeguards (such as session timeouts and access controls) to support our Customers' compliance efforts. Customers are responsible for determining whether their use of the platform is appropriate for any sensitive or regulated data and for obtaining any required consents. You should not submit sensitive information through our public marketing forms.

Our website and services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us so we can delete it.

Our website and platform may link to or integrate with third-party websites and services. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date below and, where appropriate, provide additional notice. Your continued use of our website or services after an update means you accept the revised Policy.

If you have questions or requests regarding this Privacy Policy or your personal information, contact us at support@starbrightcrm.com.