Privacy Policy

The data controller is the operating entity identified on the Operator Identification page (Brazilian CNPJ 66.180.802/0001-39). For any privacy matter, including to exercise your rights, contact the Data Protection Officer (DPO) at contact@starplace.net.

We collect only what we need to operate the marketplace:

• Account data: email, password hash, display name, RSI handle, optional Discord handle, role (buyer/seller/admin), creation and last-login timestamps.
• Verification data: for sellers and for buyers above the verification threshold — government-issued identification, selfie, proof of address. Stored with encryption at rest and segregated from the marketplace database.
• Transaction data: listings, orders, prices (denominated in USD by default), payout details, payment-processor tokens. We do not store full card numbers — those are handled exclusively by PayPal on its own infrastructure.
• Delivery data: the RSI gift email you provide for an order is shared with the matched seller for that specific order only.
• Hangar / inventory data: if you install our optional browser extension, the Star Citizen items in your RSI hangar/pledges that it syncs so you can list them — see section 12.
• Support and dispute data: messages, attachments, screenshots, and any evidence you submit.
• Technical data: IP address, user agent, device fingerprint, session identifiers, request logs, error traces.
• Cookies and similar technologies: see our Cookie Policy.

We rely on the following legal bases, mapped to the regime that applies to you:

• Performance of a contract (GDPR art. 6(1)(b); LGPD art. 7, V): creating your account, processing orders, holding the order through PayPal during the dispute window, releasing payouts, providing support.
• Compliance with a legal obligation (GDPR art. 6(1)(c); LGPD art. 7, II): anti-money-laundering checks, tax reporting, responding to lawful requests by authorities.
• Legitimate interests (GDPR art. 6(1)(f); LGPD art. 7, IX): fraud prevention, platform security, abuse monitoring, basic product analytics. We balance these against your rights; the documented balancing test is available on request.
• Consent (GDPR art. 6(1)(a); LGPD art. 7, I): non-essential cookies, marketing communications, and any processing we ask you to opt into explicitly. You may withdraw consent at any time without affecting the lawfulness of past processing.

We do not sell your personal data. We share data only with subprocessors who help us run the marketplace, under data processing agreements requiring confidentiality and adequate security:

• PayPal — our payment processor and funds custodian. Receives the transaction data necessary to process payments, run risk checks, and operate disputes and chargebacks. PayPal is an independent data controller for the data it collects on its own platform; see PayPal's privacy statement at paypal.com.
• Hosting and infrastructure provider — operates the servers that store and serve the application.
• Email provider — receives your email address and message contents for transactional emails (sign-up, order updates, password reset).
• Identity verification provider — receives identity documents to perform KYC checks where required (typically before high-value payouts).
• Other sellers, only as needed: the buyer's RSI gift email is shared with the matched seller for the specific order, so the seller can deliver the gift via CIG's official system. Sellers process this data as our processor under the Seller Data Processing Addendum.
• Authorities — where required by law, court order, or a lawful request from a competent authority.

A full, current list of subprocessors and their jurisdictions is available on request to contact@starplace.net.

StarPlace operates from Brazil and serves users globally. Some of our subprocessors are located outside your country. When personal data is transferred internationally we rely on the legal mechanisms permitted under the regime that applies to you:

• For EEA/UK users (GDPR / UK GDPR): European Commission adequacy decisions where available; the EU Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum; supplementary measures based on a transfer impact assessment.
• For Brazilian users (LGPD art. 33): ANPD adequacy decisions where available; specific guarantees (clauses, binding corporate rules); or your specific consent where applicable.
• For California users (CCPA/CPRA): we make the disclosures required under California law and respond to consumer requests as described below.

We keep your data only as long as needed for the purpose it was collected:

• Account data: while your account is active, plus 5 years after closure to comply with tax and AML record-keeping obligations under Brazilian law (governing law of the operating entity).
• Transaction records: 5 years from the transaction date (Brazilian tax and AML record-keeping requirement).
• KYC documents: 5 years from the end of the business relationship.
• Support and dispute logs: 3 years from resolution.
• Server and security logs: 12 months (minimum 6 months under Brazilian Marco Civil art. 15).

After the retention period, data is deleted or anonymized so that it can no longer identify you.

Regardless of where you live, you can request access to, correction of, and deletion of your personal data. The exact catalog of rights and the response deadline depend on your residence:

• EEA / UK (GDPR / UK GDPR): access, rectification, erasure, restriction of processing, data portability, objection (including to processing based on legitimate interests), the right not to be subject to solely automated decisions with significant effects, and the right to lodge a complaint with a supervisory authority. Response within 1 month, extendable by 2 months for complex requests.
• Brazil (LGPD art. 18): confirmation, access, correction, anonymization/blocking/deletion of unnecessary or excessive data, portability, deletion of consent-based processing, information about sharing, information about the consequences of refusing consent, withdrawal of consent, complaint to the Brazilian Data Protection Authority (ANPD). Response within 15 days.
• California (CCPA/CPRA): right to know, right to delete, right to correct, right to opt out of sale/sharing (we do not sell or share personal data), right to limit use of sensitive personal information, right to non-discrimination. Response within 45 days, extendable once for another 45 days.
• Other jurisdictions: we apply the equivalent rights granted by your local law on a best-efforts basis.

Send your request to contact@starplace.net. We may ask you to verify your identity before fulfilling a request. We will not charge a fee for the first request in any 12-month period.

You can also delete your account yourself at any time in Settings → Delete account. Records we must keep by law (section 6) stay only for their retention period.

StarPlace is not directed at minors. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18. If we learn that an account belongs to a minor, we will close it and delete the data, except where we are required by law to retain it.

We use industry-standard technical and organizational measures to protect your data: encryption in transit (TLS), encryption at rest for sensitive fields, role-based access control, audit logging, regular backups, and a documented incident-response process. No system is perfectly secure. In the event of a personal-data breach that creates risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, you directly — within 72 hours under GDPR art. 33, and in a reasonable timeframe under LGPD art. 48.

Fraud-prevention systems (ours and PayPal's) may automatically flag or block transactions that match high-risk patterns. You have the right to request human review of any automated decision that materially affects you (GDPR art. 22; LGPD art. 20). Send the request to contact@starplace.net; we will respond within 15 business days.

We offer an optional browser extension ("StarPlace Hangar Sync") that helps you list the Star Citizen items you can gift without typing them in by hand. Installing and using it is entirely your choice — the marketplace works without it, and you can enter listings manually instead.

What it does. When you are logged in to your account at robertsspaceindustries.com, the extension reads the pages of your RSI Hangar / Pledges (the ships, game packages and upgrades you own) and sends their contents to StarPlace, where our servers parse them to build your list of giftable items. It runs either automatically when you open your RSI pledges page, or when you trigger a sync from the StarPlace site.

What it accesses, and what it does not. The extension reads your RSI session cookie solely to make those page requests on your behalf. It never sees, asks for, or stores your Roberts Space Industries password, and it does not access your RSI payment details or any RSI data beyond your pledges/hangar pages. All of the extension's code ships inside the extension package; it does not download or execute remote code.

• Data collected: the contents of your RSI Hangar / Pledges pages (item names, types and quantities). On StarPlace this becomes part of your account and inventory data (see section 2) and is used only to populate the items you can offer on the marketplace.
• Browser permissions it requests: access to robertsspaceindustries.com and starplace.net; read access to your cookies for those sites (to use your existing RSI session); detection of when you navigate to your RSI pledges page; and local storage (to remember when your hangar was last synced).
• Where the data goes: only to StarPlace. The extension transmits your hangar data to our servers and to no third party.
• Legal basis: performance of our contract with you and your explicit request to use the feature (GDPR art. 6(1)(b); LGPD art. 7, V). You can withdraw at any time by removing the extension.
• Removing it: uninstalling the extension from your browser stops all extension data collection immediately. Hangar items already synced to your StarPlace account are retained and deleted under section 6, or earlier on request (section 8).

StarPlace is an independent marketplace and is not affiliated with, endorsed by, or sponsored by Cloud Imperium Games or Roberts Space Industries; "Star Citizen" and related marks belong to their respective owners.

We may update this Policy. Material changes will be posted on this page with a new "Last updated" date and, when significant, notified to you by email. Continued use of StarPlace after the new version takes effect means you accept the updated Policy.

Privacy questions, requests, or complaints: contact@starplace.net. You may also lodge a complaint with your national data-protection authority — for example, the ANPD in Brazil, your national supervisory authority in the EEA, the ICO in the UK, or the California Privacy Protection Agency.