Privacy Policy

This policy covers the RevStar CompRate application and the marketing pages at shiningstar.software. It is published by Shining Star Software, which is the controller of the personal data described here.

It does not cover third party websites we link to, or the booking and travel sites whose publicly published rates we display.

Account information. Your email address, your display name, your role on the account, and the identity provider you signed in with. We do not store passwords; we sign you in with a one time email link or with Google.

Property information. The hotel details you enter: name, street address, city, state, country, geographic coordinates, room count, star rating, currency, time zone, property type, minimum rate floor, and the competitors you choose to track.

Commercial information. Your plan, trial status, subscription status and billing history. Payments are processed by Stripe; we receive the last four digits of the card, the card brand, the billing country and the outcome of each charge. We never receive or store your full card number.

Usage and technical information. Pages and features used, requests to our interface, the time of a refresh, IP address, browser and device type, and error diagnostics. Our servers write request logs that include IP addresses.

Communications. Emails you send us for support or billing, and your notification preferences including the local hour at which you want alerts.

Referral program. If you join our referral program: your email address, the code in your referral link, the name a check should be made out to and the mailing address you give us, and what you have earned and been paid. If you signed up through a partner's referral link, we record which partner referred your account.

We do not knowingly collect government identifiers, health information, biometric data, precise device location, or information about your guests. Please do not enter guest personal data into the Service.

• To provide the Service: create your account, show competitor rates for your property, generate observations, send the alerts you ask for.
• To bill you: run the trial, take subscription payments, issue receipts, and handle refunds or disputes.
• To support you: answer your questions and investigate problems you report.
• To keep the Service secure and working: rate limiting, abuse and fraud prevention, error monitoring, backups.
• To enforce fair use of the free trial: we keep a record of each trial, holding your normalized email address (lower case, without any plus tag, and without the dots in a Gmail address), the property's name and its location, so that one property does not repeatedly receive free trials under different addresses.
• To improve the Service: in aggregated or deidentified form that does not identify you, your property or any individual.
• To meet legal obligations: tax and accounting records, and responding to lawful requests.

Where the law requires a legal basis, we rely on performance of our contract with you for providing and billing the Service, our legitimate interests for security, abuse prevention and improvement, your consent where we ask for it, and compliance with legal obligations for record keeping.

We use a small number of service providers, each bound by contract to process data only on our instructions and to protect it:

We may also disclose data to professional advisers, to a successor in a merger or acquisition with notice to you, and to authorities where we are legally required to do so.

Automated observations. To produce written pricing observations we send an AI model, run by one of the providers above, a summary of competitor rates, your own published rate, and nearby public events. That summary contains your property name and market. It does not contain your email address, billing details or any guest information.

Referral partners. If you signed up through a partner's referral link, that partner can see the name, city and state of each hotel on your account, the plan each is on, and the commission each has earned them, so they can check what they are paid. They cannot see your email address, your rates, your competitors, your billing details or anything else in your account.

Data is stored and processed in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed there, where data protection law may differ from your own. Where a transfer mechanism is required, we rely on the European Commission standard contractual clauses or an equivalent safeguard through our providers.

• Account and property records: for as long as your account is open.
• Detailed rate history, event records and generated observations: 60 days, after which older rows are deleted automatically by a scheduled job. Summary information needed for your charts may be kept longer.
• After you close your account: we delete your account and property data within 90 days, except where we must keep records longer.
• Billing and tax records: kept for the period required by law, normally seven years, held by us and by Stripe.
• Security and request logs: up to 90 days for the application, and longer for aggregated security records.
• Free trial records: kept after a property or an account is deleted, so that trial limits remain effective. Each holds the normalized email address that started the trial, the property's name and location, and the trial's dates.

We encrypt data in transit with TLS and at rest. Application secrets are held in a managed secret store and are never committed to source control. Access to production systems is limited to personnel who need it, over federated sign in with multifactor authentication. We log administrative actions on customer accounts, including any support impersonation.

No service is perfectly secure. If a breach affects your personal data we will notify you and any regulator as required by law, without undue delay.

Subject to your location and to verification, you may ask us to:

• Access: confirm what we hold about you and get a copy.
• Correct: fix inaccurate information; most fields you can edit yourself in Settings.
• Delete: close your account and delete your data, subject to records we must keep.
• Port: receive your property and rate data in a machine readable format.
• Object or restrict: ask us to stop or limit certain processing based on legitimate interests.
• Withdraw consent: where we relied on consent, without affecting prior processing.
• Opt out of marketing: every marketing email has an unsubscribe link. Service messages such as sign in links, receipts and security notices are not marketing and continue while your account is open.

To exercise any of these, email privacy@shiningstar.software from the address on your account. We respond within 45 days and may extend once where permitted, telling you why. We do not charge a fee and we will not treat you differently for exercising a right.

Texas residents. Under the Texas Data Privacy and Security Act you have the rights to confirm, access, correct, delete, obtain a portable copy, and to opt out of targeted advertising, sale of personal data, and certain profiling. We do not carry out any of those three activities. If we decline a request you may appeal by replying to our decision; if the appeal is denied you may contact the Office of the Texas Attorney General.

California residents. Under the CCPA as amended you have rights to know, delete, correct, and to opt out of sale or sharing. As stated in section 4 we do not sell or share personal data. You may use an authorized agent, with proof of authorization.

EEA and UK residents. You may lodge a complaint with your supervisory authority. We ask that you contact us first so we can try to resolve it.

We set two strictly necessary cookies: one that keeps you signed in, and one that protects sign in against cross site request forgery. Your theme and the property you last viewed are remembered in your browser's local storage, not a cookie, and that information never leaves your device. If you arrive through a partner's referral link, local storage also keeps that link's code for up to 90 days. It is sent to us only if you sign up, so the partner can be credited, and it is deleted from your browser when you do.

We do not use advertising cookies, we do not sell or share personal data for cross context behavioral advertising, and we do not run third party analytics or session recording scripts in the application. See Your Privacy Choices for how this applies under state privacy laws, including Global Privacy Control.

Your browser can block cookies, but the Service will not be able to sign you in without the session cookie. Stripe, on its own hosted checkout and billing pages, may set its own cookies under its own privacy notice. Those pages are not operated by us.

The Service generates pricing observations automatically. These are suggestions for you to review. They do not produce legal or similarly significant effects on any individual, and no decision about a person is made solely by automated means. You can ignore any suggestion, and nothing is applied to your rates automatically.

The Service is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy. If a change is material we will notify you by email or in the application before it takes effect. The Last updated date above always reflects the current version.

Privacy questions and rights requests: privacy@shiningstar.software
General support: support@shiningstar.software
Billing: billing@shiningstar.software

See also our Terms of Service and Refund and Cancellation Policy.