Privacy Policy

1. Introduction

At Stellar Water ("we", "us", or "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at stellarwater.com or purchase our products. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site.

2. Data Controller

For the purposes of the General Data Protection Regulation (GDPR), UK GDPR, and other applicable data protection laws, the data controller is:

3. Information We Collect

We may collect information about you in a variety of ways, including:

3.1 Personal Data You Provide

Personal information you voluntarily provide to us when you:

• • Create an account (name, email, profile photo)
• • Place an order (billing and shipping address, payment information)
• • Subscribe to our newsletter (email address)
• • Set up a water subscription (delivery preferences, schedule)
• • Contact customer support (name, email, message content)
• • Participate in our loyalty program (purchase history, preferences)

3.2 Automatically Collected Data

Information automatically collected when you visit our site:

• • IP address and approximate location
• • Browser type and version
• • Device type and operating system
• • Pages visited and time spent on pages
• • Referring website addresses
• • Session identifiers and cookies

4. Legal Basis for Processing (GDPR)

Under GDPR and UK GDPR, we process your personal data based on the following legal grounds:

5. How We Use Your Information

We use the information we collect to:

• • Process and fulfill your orders and subscriptions
• • Process payments and prevent fraud
• • Deliver products to your specified address
• • Manage your account and preferences
• • Send order confirmations and shipping updates
• • Provide customer support and respond to inquiries
• • Send marketing communications (with your consent)
• • Improve our products, website, and services
• • Detect, prevent, and address security issues
• • Comply with legal obligations

6. How We Share Your Information

We may share your information in the following situations:

• • Service Providers: Third-party vendors who perform services on our behalf (see section 9)
• • Shipping Partners: Delivery companies to ship your orders
• • Payment Processors: Stripe for secure payment processing
• • Legal Purposes: When required by law or to protect our rights
• • Business Transfers: In connection with a merger, sale, or acquisition
• • With Your Consent: When you explicitly agree to share your information

Important: We do not sell your personal information to third parties. California residents can opt-out of any future data sharing via our Data Rights page.

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• • Encryption of data in transit (TLS/SSL)
• • Encryption of data at rest
• • PCI-DSS compliant payment processing
• • Access controls and authentication
• • Regular security assessments
• • Employee training on data protection

While we take reasonable steps to protect your data, no method of transmission over the Internet or electronic storage is 100% secure.

8. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy:

• • Account data: Retained while your account is active, plus 3 years after deletion for legal compliance
• • Transaction records: 7 years for tax and accounting purposes
• • Subscription data: Retained for the duration of your subscription plus 2 years
• • Marketing data: Retained until you unsubscribe or request deletion
• • Customer support records: Retained for 3 years after your last interaction
• • Anonymous analytics: Retained for 26 months

9. Third-Party Services

We use the following third-party service providers:

• • Clerk (clerk.com) - Authentication and user management
• • Convex (convex.dev) - Database and real-time data sync
• • Stripe (stripe.com) - Payment processing
• • Vercel (vercel.com) - Website hosting and deployment

Each provider has their own privacy policy governing their use of your data.

10. Your Privacy Rights

10.1 Rights Under GDPR (EU/UK)

If you are in the European Union or United Kingdom, you have the following rights:

• • Right of Access (Art. 15): Request a copy of your personal data
• • Right to Rectification (Art. 16): Request correction of inaccurate data
• • Right to Erasure (Art. 17): Request deletion of your personal data
• • Right to Restrict Processing (Art. 18): Request limitation of processing
• • Right to Data Portability (Art. 20): Receive your data in a machine-readable format
• • Right to Object (Art. 21): Object to processing based on legitimate interests
• • Right to Withdraw Consent (Art. 7): Withdraw consent at any time

10.2 Rights Under CCPA (California)

California residents have the following additional rights:

• • Right to know what personal information is collected
• • Right to delete personal information
• • Right to correct inaccurate personal information
• • Right to opt-out of sale/sharing of personal information
• • Right to limit use of sensitive personal information
• • Right to non-discrimination for exercising rights

10.3 Rights Under PIPEDA (Canada)

Canadian residents have the following rights:

• • Right to access your personal information
• • Right to challenge accuracy and completeness
• • Right to withdraw consent at any time

To exercise any of these rights, please visit our Data Rights page or contact us at privacy@stellarwater.com.

11. Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority:

• • EU: Your national Data Protection Authority
• • UK: Information Commissioner's Office (ICO) - ico.org.uk
• • Canada: Office of the Privacy Commissioner - priv.gc.ca
• • California: California Privacy Protection Agency - cppa.ca.gov

12. International Data Transfers

Your information may be transferred to and processed in countries outside your country of residence, including:

• • United States (where our service providers operate)
• • Jamaica (where our operations are based)

When we transfer data internationally, we use appropriate safeguards including:

• • Standard Contractual Clauses (SCCs) approved by the EU
• • UK International Data Transfer Agreements
• • Adequacy decisions where applicable

13. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

You can manage your cookie preferences at any time through our cookie consent tool or your browser settings.

14. Children's Privacy

Our services are intended for users who are at least 13 years old. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@stellarwater.com, and we will delete such information from our systems.

15. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page, updating the "Last Updated" date, and where required by law, sending you an email notification. You are advised to review this Privacy Policy periodically for any changes.

16. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact our privacy team:

We aim to respond to all privacy-related inquiries within 30 days.