Privacy Policy

Last updated: June 10, 2026

This Privacy Policy explains what personal data STELLAR FlyPods collects when you use our website and online shop (stellarflypods.com and shop.stellarflypods.com), why we collect it, how we protect it, and what rights you have under the General Data Protection Regulation (GDPR) (EU) 2016/679. The STELLARvibe mobile app is covered by a separate STELLARvibe Privacy Statement.

1. Who we are

STELLAR FlyPods is a product of Dedal Trade Limited (also registered as DEDAL TRADE Co., Ltd., Hong Kong).

Data controller:
Dedal Trade Limited
237 Queen’s Road, Hong Kong SAR
Email: info@stellarstlr.com
Website: stellarflypods.com

If you have any questions or requests regarding your personal data, contact us at info@stellarstlr.com.

2. What data we collect and why

We collect only the data necessary to process your order and operate our website.

2.1 Order and payment data

When you place an order, we collect:

• Full name
• Billing and shipping address
• Email address
• Phone number (optional, used for delivery updates)
• Payment information — card details, Apple Pay, or Google Pay tokens

Payment data is processed exclusively by our payment processor, Airwallex. We never see, store, or have access to your full card number, CVV, or bank account details. Airwallex is PCI DSS Level 1 certified.

Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

2.2 Account data (optional)

If you choose to create an account at checkout, we store your name, email address, and order history so you can track your orders and manage your STELLARvibe settings in future.

Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

2.3 Newsletter and marketing emails

If you tick the newsletter opt-in at checkout, we store your email address and send you occasional updates about new products, exclusive offers, and sound tips. You can unsubscribe at any time via the link in any email we send.

Legal basis: Art. 6(1)(a) GDPR — your explicit consent.

2.4 Gift message

If you enter a gift message at checkout, it is printed on a card included in the parcel and stored with your order record.

Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

2.5 Website usage data (cookies, analytics and server logs)

Our web server automatically records your IP address, browser type and version, pages visited, time spent, and referring URL. We use session cookies to maintain your shopping cart across pages; these expire at the end of your browser session or after 48 hours.

With your consent, we also use analytics and advertising cookies and tags — Google Analytics (loaded via Google Tag Manager) and the Meta (Facebook) Pixel — to measure website performance and the effectiveness of our marketing. These load only after you accept them in our cookie banner, and you can change or withdraw your choice at any time via the “Cookie preferences” link in the footer. Google tags additionally operate under Google Consent Mode v2, set to “denied” by default until you consent. A full, current list of cookies and tags is available in our Cookie Policy.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest) for essential session cookies and server logs; Art. 6(1)(a) GDPR (your consent) for analytics and advertising cookies.

3. How we share your data

We share your data only with the third-party service providers necessary to operate our shop and website:

• Payment processing — Airwallex (secure processing of card, Apple Pay, and Google Pay transactions)
• Hosting — Hetzner Online GmbH, Germany (EU)
• Shipping — our delivery carrier, to deliver your order
• Transactional email — Brevo (order confirmations and delivery updates)
• Marketing email — Klaviyo (only if you opt in to our newsletter)
• Analytics & advertising — Google (Analytics, Tag Manager) and Meta (Facebook Pixel), loaded only with your consent

We do not sell, rent, or trade your personal data to any third party. All processors are bound by data processing agreements compliant with GDPR Chapter V.

4. International transfers

Our payment processor, Airwallex, processes payments from EEA customers through its European entity; where any payment data is transferred outside the EEA it is protected by Standard Contractual Clauses (SCCs) approved by the European Commission under Art. 46(2)(c) GDPR. Where you consent to analytics and advertising, Google and Meta may process data in the United States, also under Standard Contractual Clauses. We do not otherwise transfer your personal data outside the EEA.

5. Data retention

• Order records (name, address, items, price) — 7 years (legal and tax obligation)
• Payment transaction records — 7 years (legal and tax obligation)
• Account data — until you request deletion or close your account
• Newsletter subscription — until you unsubscribe
• Server logs — 90 days
• Session cookies — end of browser session / 48 hours

After the retention period, your data is securely deleted or anonymised.

6. Your rights under GDPR

If you are in the European Economic Area (EEA), you have the following rights:

• Right of access (Art. 15) — Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — Ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17) — Ask us to delete your data. Note: we may be required to retain order and payment records for 7 years to comply with legal obligations.
• Right to restrict processing (Art. 18) — Ask us to pause processing while a dispute is resolved.
• Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format.
• Right to object (Art. 21) — Object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)) — Withdraw newsletter or cookie consent at any time.

To exercise any of these rights, email us at info@stellarstlr.com. We will respond within 30 days. You also have the right to lodge a complaint with your local Data Protection Authority (DPA). A list of EU DPAs is available at edpb.europa.eu.

7. EU representative (Article 27 GDPR)

As a company established outside the EU that offers goods to individuals in the EEA, we are in the process of appointing an EU representative under Article 27 GDPR. Until the appointment is published here, EEA data subjects may contact us directly at info@stellarstlr.com for any data protection matter.

8. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent version.