Privacy Policy

Last updated: 19 October 2026

Star Relay Systems (“we”, “us”) provides CRM software to businesses worldwide. This policy explains what personal information we collect, why, who can see it, where it goes, how long we keep it, and the rights you have. It applies to our website and to the products Lead Pipeline, Lead Suite and Meridian. We follow South Africa’s Protection of Personal Information Act (POPIA), and we extend the rights below to customers in the European Economic Area, the United Kingdom and US states with privacy laws, such as California.

1. Our role: controller and processor

• Account and billing information (your name, email, business name, plan, usage logs): we decide why and how it is used, so we are the “controller” (POPIA: “responsible party”).
• Leads and customer information you enter into your CRM: you decide why and how it is used, and we hold it on your behalf as your “processor” (POPIA: “operator”). You are responsible for having a lawful basis to store it and for honouring your own contacts’ rights. We act only on your instructions and will help you respond to their requests.
• Customers who need a data processing agreement (for example, under GDPR) can request one at the address in section 12.

2. What we collect

• Account details: name, email address, business name, role, a securely hashed password and, if you switch on two-step verification, the authenticator link needed to check your codes.
• CRM content: leads, contact details, notes, values, follow-up dates, team members and settings that you or your team enter.
• Billing details: your plan, subscription status, country and payment confirmations. Card details are handled by our payment providers; we never see or store full card numbers.
• Enquiries: what you type into our contact form.
• Technical information: basic logs such as last login time, IP address and security events, used to keep accounts safe.

Please do not enter highly sensitive data (such as health records, government ID numbers, payment card numbers or information about children) into the CRM unless you have a clear legal basis and need to.

3. Who can see your information

• You and your team, according to the roles you give them (agent, team lead, admin).
• Other customers: never. All customers’ records sit in one secured system, separated by database access rules so that each business can only read and change its own records.
• Star Relay Systems: the owner has administrator access across customers, used only to operate the service, fix problems you report, handle billing, prevent abuse and keep the system secure. No one else at Star Relay Systems has this access.

4. Why we use it, and our legal basis

• To create your account and deliver the service you pay for (performance of a contract).
• To take payment, send receipts and manage subscriptions (contract and legal obligations such as tax records).
• To send service emails: verification, password resets, billing notices and important changes (contract and legitimate interest). We do not send marketing email without your consent, and you can opt out at any time.
• To answer enquiries and give support (legitimate interest).
• To protect the service against fraud, abuse and unauthorised access (legitimate interest and legal obligations).

We do not sell or rent personal information, we do not share it for cross-context behavioural advertising, and we do not use the leads in your CRM for our own marketing or to train AI models.

5. Who we share it with

We use service providers (sub-processors) that process information for us under written commitments. Our current categories and providers are:

• Database, authentication and serverless functions: Supabase
• Transactional email delivery: Resend
• Payments: Paddle, which acts as merchant of record for all customers (older South African subscriptions, if any, may still be processed by PayFast until they are moved)
• Website hosting and content delivery: Cloudflare (and Netlify, where used)

We will update this list when providers change, and for significant changes we will tell customers by email. We may also disclose information where the law requires it, or to protect the rights and safety of our customers and the public.

6. International transfers

We operate from South Africa and our providers may store and process information in other countries, including the United States and the European Union. Where information leaves your country, we rely on safeguards such as contracts with standard data-protection clauses, adequacy decisions and the providers’ own certifications, so that it keeps a comparable level of protection.

7. How we protect it

• Information is encrypted in transit, and passwords are stored hashed, never in plain text.
• Database-level access rules keep each business’s records separate.
• Email verification, a minimum password length and optional two-step verification protect logins.
• Administrator access is restricted to the owner, and security events are logged.

No system is perfectly secure. You can help by using strong, unique passwords, turning on two-step verification and removing team members who leave your business.

8. How long we keep it

• Active accounts: while your subscription is active.
• After cancellation: your account is terminated or paused as set out in the Terms of Use. You can export your data during the 5 days after cancellation. After the account is terminated, we delete your business’s CRM content within 30 days of a deletion request, or within 90 days if you made none, except where the law requires us to keep records.
• Billing and tax records: kept for as long as the law requires (typically five to seven years, depending on the country).
• Security logs: up to 12 months.
• Backups: deleted data may remain in encrypted backups for up to 35 days before being overwritten.

9. Your rights

Depending on where you live, you may have the right to ask us to confirm what personal information we hold about you, give you a copy (including a portable copy), correct it, delete it, restrict or object to certain processing, and withdraw consent where we rely on it. California residents also have the right to know what is collected and to opt out of sale or sharing (we do neither). We will not treat you differently for using these rights.

If your information was entered into a CRM by your employer or another business, that business is the responsible party and you should contact them first; we will help them respond. To use a right with us, email us from the address on your account. We aim to reply within 30 days. If you are unhappy with our response, you may complain to your local regulator, for example South Africa’s Information Regulator (inforegulator.org.za), your EU data-protection authority, the UK Information Commissioner’s Office or your state attorney general.

10. If something goes wrong

If a security compromise affects personal information, we will notify affected customers without undue delay, and the Information Regulator and other authorities where the law requires, with what happened, what information was involved and what you can do.

11. Cookies and similar technologies

We do not use advertising trackers. The site stores a small amount of data in your browser only to keep you signed in and to remember your light or dark preference. If we later add analytics or advertising tools, we will update this section and ask for consent where required.

Children

The service is for businesses and is not intended for anyone under 18. We do not knowingly collect information from children.

Changes to this policy

If we change this policy, we will update the date above and, for significant changes, tell customers by email before they take effect.

12. Contact

Information Officer and privacy contact: the owner of Star Relay Systems — hello@starrelaysystems.co.za.