Important Policy Update

We updated our Terms of Service, Privacy Policy and Refund Policy, effective August 15, 2026. Please review the updated policies before your next purchase. Commercial warranty claims normally follow the product description, selected variant and warranty conditions shown at the time of purchase.

Privacy Policy

This Privacy Policy explains how Stellar processes personal data in connection with our storefront, checkout, customer accounts, support, warranty claims, fraud prevention and communications. SellAuth and other service providers may also process personal data under their own privacy notices, as controllers or processors depending on the processing activity.

Last Updated: 15 August 2026
1

Who We Are & How to Contact Us

  • Controller: Stellar™ — operator of stellar-shop.xyz.
  • Privacy contact: open a Discord ticket titled "Privacy Request" at discord.gg/stellarmarket.
  • Where another provider determines its own purposes and means of processing, that provider may act as a separate controller for that processing.
2

Data We Collect

2.1Account & Order Data
  • Name, handle or Discord username when supplied.
  • Email address used for checkout, delivery or account access.
  • Order or invoice ID, purchased product and variant, quantity, price, currency, payment status and timestamps.
  • Customer account, balance, coupon, affiliate or referral information where those features are used.
2.2Support & Warranty Evidence
  • Messages and information you provide in support tickets.
  • Screen recordings, screenshots, claim links, account logs and other evidence voluntarily supplied for diagnostics, delivery verification or warranty claims.
  • Evidence may contain identifiers such as your account email. Please avoid including unrelated private or sensitive information.
2.3Technical & Security Data
  • IP address, approximate country or region, browser or device information and user-agent data where processed by our storefront, checkout or security providers.
  • Timestamps, rate-limit information, session/security events and anti-abuse signals.
  • Fraud-risk indicators, dispute history and limited blacklist or abuse-prevention records.
2.4Discord Data
  • Discord username, user ID, server ID, ticket content and related interaction data when you use our Discord community or support system.
2.5Payment Data
  • Payment method, payment status and transaction or processor reference information where available to us.
  • We do not intentionally store full payment-card credentials. Card, banking and cryptocurrency payment details may be processed by SellAuth and/or the payment provider you select.
2.6Marketing & Referral Data
  • Email address, subscription or unsubscribe status and campaign interaction information where provided by our email platform.
  • Affiliate codes, referral identifiers, coupons and attribution information where you use our affiliate or promotional features.
2ACookies & Similar Technologies

Essential technologies may be used for checkout, login, session management, security, fraud prevention and basic site functions. Blocking them may prevent parts of the store from working. If optional analytics, advertising or other non-essential technologies are enabled, they will be used only in accordance with applicable consent requirements.

3

Why We Use Your Data (Legal Bases)

Contract
  • Processing and delivering orders.
  • Providing account access and customer support.
  • Verifying and handling warranty or replacement claims.
Legitimate Interests
  • Preventing fraud, abuse, duplicate claims and chargeback abuse.
  • Protecting accounts, systems and service reliability.
  • Establishing, exercising or defending legal claims.
Legal Obligations / Consent
  • Keeping records required by accounting, tax or other applicable law.
  • Responding to valid requests from competent authorities.
  • Consent where required for optional cookies or marketing communications.

Where we rely on legitimate interests, we use personal data only where those interests are not overridden by your rights and freedoms. Where we rely on consent, you may withdraw it at any time without affecting processing that was lawful before withdrawal.

4

Who We Share Data With

  • SellAuth: storefront, checkout, customer accounts, invoices, balance, tickets, delivery and related platform functions.
  • Payment providers: to authorize, confirm, refund or investigate payments and disputes.
  • Discord: when you communicate with us or participate in our server.
  • Hosting, email, security and anti-fraud providers: where needed to operate and protect the store.
  • Upstream suppliers or fulfilment partners: only where reasonably necessary to deliver a product, verify a warranty issue or obtain a replacement, and only with data relevant to that purpose.
  • Professional advisers or authorities: where reasonably necessary to comply with law, protect legal rights or respond to a valid legal request.

We do not sell personal data. We also do not require customers to provide unrelated personal information for support or warranty verification.

5

International Data Transfers

Some service providers may process personal data outside Bulgaria or the European Economic Area. Where the GDPR requires safeguards for an international transfer, the relevant controller or processor must rely on a lawful transfer mechanism, such as an adequacy decision or appropriate safeguards including Standard Contractual Clauses, as applicable.

6

Data Retention

  • Order, payment and accounting records: kept for the period required by applicable accounting, tax, payment-dispute and legal obligations.
  • Support and warranty evidence: normally kept for up to 24 months after the relevant support matter, or longer where reasonably necessary for an active warranty, dispute, fraud investigation or legal claim.
  • Marketing data: kept until you unsubscribe, withdraw consent where consent is the basis, or the data is no longer needed. A minimal suppression record may be kept to respect your opt-out.
  • Security / blacklist records: kept only for as long as reasonably necessary and proportionate to prevent repeated fraud or abuse, with retention reviewed rather than automatically kept forever.
7

Security

We use reasonable technical and organizational measures appropriate to the nature of the data and risks involved, including access controls, account security and service-provider security features. No online service can guarantee absolute security, so customers should avoid sending unnecessary passwords, identity documents or sensitive information.

8

Your GDPR / EEA Rights

  • Request access to personal data we hold about you.
  • Request rectification of inaccurate data.
  • Request erasure where the legal conditions are met.
  • Request restriction of processing in applicable circumstances.
  • Object to processing based on legitimate interests in applicable circumstances.
  • Request data portability where the GDPR conditions are met.
  • Withdraw consent at any time where processing is based on consent.
  • Lodge a complaint with a competent supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (CPDP).

To exercise a privacy right, open a Discord ticket titled "Privacy Request". We may request only the information reasonably necessary to verify your identity or locate your data. GDPR requests are generally answered within one month, subject to lawful extensions for complex or numerous requests.

Bulgarian supervisory authority: Commission for Personal Data Protection (CPDP).

9

Fraud Screening & Automated Checks

Our storefront, payment providers or security tools may automatically evaluate technical and transaction signals to detect fraud, abuse, duplicate claims, VPN/TOR activity or other risk indicators. These checks may cause an order to be flagged, delayed or refused. Where applicable law gives you a right to human review of a solely automated decision producing legal or similarly significant effects, you may request that review through support.

10

Minors

Our Terms of Service set a minimum age of 13 and require parental or guardian consent for customers under 18 where applicable. Where consent is legally required for a particular data-processing activity and the law requires parental authorization, that requirement also applies.

11

Changes to This Privacy Policy

We may update this Privacy Policy when our services, providers, security practices or legal obligations change. The current version will be published on this page with an updated revision date. Material changes may also be announced through our normal customer communication channels.

Privacy questions?

Open a Discord ticket titled "Privacy Request".

Open a Ticket