Privacy Policy

1. Information We Collect

We collect information you provide directly to us and information generated by your use of the Site.

Information you provide:

• Order information — your name, email address, the star name you choose, any dedication message, and the name of the honoree. For physical packages, we collect a shipping address directly from you; for digital-only packages, we obtain an equivalent billing name and address from Stripe at checkout (see Section 4).
• Order-in-progress information — if you enter your email address (or other order details) while starting an order but do not complete checkout, we may retain what you entered — including your email address — so that we can send you a reminder to finish your order. See Sections 2 and 6.
• Payment information — credit or debit card details. All payment processing is handled by Stripe, Inc. We do not store your full card number, CVV, or payment credentials on our servers.
• Contact form submissions — your name, email address, and message content when you contact us.

Information collected automatically:

• Usage data — pages visited, time on site, referring URLs, browser type, and device type, collected via Google Analytics 4 (GA4) and Ahrefs Web Analytics (a privacy-focused, cookieless analytics tool).
• Session behavior — mouse movements, clicks, scrolls, and page interactions collected via Microsoft Clarity for usability analysis. Clarity masks sensitive form fields and does not record payment information.
• Advertising and conversion data — we measure ad performance and reach relevant audiences using the Meta Pixel (Meta Platforms, Inc.), the Reddit Pixel (Reddit, Inc.), and Google Ads conversion tracking (Google LLC). This happens in two ways: through tags that run in your browser, and — for Meta and Reddit — by transmitting certain information directly from our servers. When you place an order, we share a hashed (irreversibly encoded) version of your email address, name, and location, along with your IP address, with Meta via its Conversions API; and we share your email address and an order identifier with Reddit for conversion matching. This data is used to measure conversions and to show our ads to relevant audiences on those platforms.
• IP address — logged for security purposes, rate limiting, and fraud prevention, and included in the advertising data described above.
• Cookies and session data — we use a session cookie to maintain your browsing session, along with cookies set by Google Analytics, Google Ads, Google reCAPTCHA, Microsoft Clarity, the Meta Pixel, and the Reddit Pixel for analytics, security, and advertising purposes. (Ahrefs Web Analytics does not set cookies.)

2. How We Use Your Information

We use the information we collect to:

• Process your order, assign your star, and fulfill your registration.
• Generate and email your PDF certificate, and mail your printed certificate on physical packages.
• Send you order-related emails, including an order confirmation, a shipping notification with tracking, and a request for a review after your order is delivered.
• Send you a reminder to complete your order if you begin checkout or enter your email but do not finish.
• Create and maintain your permanent public registry page.
• Respond to your inquiries and provide customer support.
• Verify your shipping address via the USPS address validation service.
• Measure advertising performance and show our ads to relevant audiences, as described in Section 1.
• Prevent fraudulent orders, spam, and abuse.
• Analyze Site usage in aggregate to improve our service.
• Comply with our legal obligations.

We send you transactional and order-related emails — such as your order confirmation, a shipping notice with tracking, a post-delivery review request, and, if you start but do not finish an order, a reminder to complete it. We do not send unrelated promotional newsletters, and we do not sell your personal information for money. If you would prefer not to receive order-reminder or review-request emails, you may ask us to stop using the contact details in Section 9. The Meta Pixel, Reddit Pixel, and Google Ads tools are used to measure ad conversions and to show our ads to relevant audiences; Google Analytics 4 and Ahrefs Web Analytics are used for traffic analysis; and Microsoft Clarity is used solely to improve site usability and is not used for advertising.

3. Public Registry Pages

When your order is complete, we publish a permanent public registry page at a unique URL (e.g., namedlight.com/star/[your-unique-id]). This page displays:

• The star name you chose
• The honoree name you provided
• Your dedication message (if any)
• The star's astronomical data (constellation, coordinates, distance, spectral class)
• A sky map image of the star's region

Your email address, shipping address, and payment information are never displayed on the public registry page. Your purchaser name is stored internally but is not shown on the public page.

Because registry pages are intended to be permanent and shareable, we do not delete them unless you submit a verified deletion request to us directly. See Section 8 (Your Rights) below.

4. Third-Party Service Providers

We share limited information with the following third parties solely to operate the Site and fulfill orders:

• Stripe, Inc. — payment processing. Your card data goes directly to Stripe and is subject to Stripe's Privacy Policy; we never receive or store your full card number, CVV, or payment credentials. For digital packages, we do receive the billing name and address Stripe collects at checkout, which we store in the same way as a shipping address in order to maintain accurate order and tax records.
• Resend, Inc. — transactional email delivery. Your name, email address, and order details are transmitted to Resend to send your order, shipping, review-request, and order-reminder emails.
• Google LLC — Google Analytics 4 for aggregate usage and conversion data; Google Ads for conversion tracking and remarketing; Google reCAPTCHA for bot and spam prevention on our contact and administrator login forms; and the Google Maps API for address autocomplete on the order form. Subject to Google's Privacy Policy.
• Ahrefs Pte. Ltd. — Ahrefs Web Analytics, a privacy-focused, cookieless tool used to measure website traffic. Subject to Ahrefs' Privacy Policy.
• Meta Platforms, Inc. — the Meta Pixel tracks page visits and conversion events in your browser, and we additionally send Meta, via its Conversions API, a hashed (irreversibly encoded) version of your email address, name, and location together with your IP address, to measure advertising performance and deliver our ads to relevant audiences on Facebook and Instagram. Subject to Meta's Privacy Policy.
• Reddit, Inc. — the Reddit Pixel tracks page visits and conversion events; on order completion we also share your email address and an order identifier with Reddit for conversion matching and to deliver our ads to relevant audiences on Reddit. Subject to Reddit's Privacy Policy.
• Microsoft Corporation — Microsoft Clarity, a behavioral analytics tool that records session interactions (clicks, scrolls, mouse movements) to help us improve the Site. Clarity masks sensitive inputs and does not capture payment data. Subject to Microsoft's Privacy Policy.
• United States Postal Service (USPS) — address validation for US shipping addresses. Only your shipping address is transmitted.
• Alasky / CDS (Strasbourg astronomical Data Center) — we retrieve sky chart images from the CDS HiPS service using your star's coordinates. No personal data is transmitted.

We do not sell, rent, or trade your personal information for money, and we do not share it with third parties for their own independent marketing. We do share data with the advertising and analytics providers listed above to measure and deliver our own advertising. Some state privacy laws define "sale" or "sharing" broadly enough to include this kind of cookie- and pixel-based advertising activity; where those laws apply, you may opt out by disabling cookies in your browser, using the opt-out tools offered by Google, Meta, and Reddit, or contacting us using the details in Section 9.

5. Nevada Privacy Rights (NRS 603A)

If you are a Nevada resident, you have specific rights under the Nevada Privacy of Information Collected on the Internet from Consumers Act (NRS Chapter 603A) and Nevada Senate Bill 220.

Right to opt out of sale: You may request that we do not sell your covered information. We do not currently sell personal information to third parties. However, you may submit a verified opt-out request at any time by emailing us at the address in Section 9. We will respond within 60 days.

Right to know: You may request information about the categories of personal information we have collected about you and the purposes for which we use it.

Right to correct or delete: Subject to applicable exceptions, you may request correction or deletion of your personal information. See Section 8 for how to submit such a request.

We will not discriminate against you for exercising any of these rights.

6. Data Retention

We retain your personal information for as long as necessary to:

• Maintain your active registry registration and fulfill any ongoing service obligations.
• Comply with applicable tax, financial, and legal record-keeping requirements (typically 7 years for transaction records).
• Resolve disputes and enforce our Terms and Conditions.

If you start an order but never complete payment, we keep the information you entered for a short period so we can send you a reminder to finish; these incomplete orders are then removed. Email addresses captured from started-but-unfinished orders are likewise retained only for this limited reminder purpose. Contact form messages are delivered to our email and kept only as long as needed to respond to you and maintain a reasonable record of the correspondence.

7. Security

We implement reasonable administrative, technical, and physical safeguards to protect your personal information, including:

• HTTPS encryption for all data in transit.
• Payment data handled exclusively by PCI-DSS compliant Stripe — we never see or store your full card details.
• Rate limiting on user-facing forms, and CAPTCHA (Google reCAPTCHA) on our contact and administrator login forms.
• Access to administrative functions restricted and protected by password authentication over an encrypted connection.
• Security headers (CSP, X-Frame-Options, X-Content-Type-Options) on all responses.

No method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security, but we take reasonable measures to protect your data.

8. Your Rights and Choices

You may contact us to:

• Access — request a copy of the personal information we hold about your order.
• Correct — request correction of inaccurate information (e.g., a misspelled name on your certificate).
• Delete — request deletion of your personal information. Note: we may be required to retain certain transaction records for legal and financial compliance purposes. Deleting your data will remove your registry page.
• Opt out of data sale — as described in Section 5, we do not sell data, but you may submit a formal opt-out request.

To exercise any of these rights, email us at the address in Section 9 with the subject line "Privacy Request." We will verify your identity and respond within 60 days (or within 30 days for straightforward requests).

9. Children's Privacy

The Site is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us immediately and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top of this page. Continued use of the Site after any change constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.