Privacy policy
Version 2026-10-22.
Controller
Asmir Mehic, Marktgasse 58, 1090 Vienna, Austria, support@steller.work — see the imprint. We have not appointed a data protection officer; Steller's processing does not require one.
This website
steller.work is a static site. It sets no cookies, runs no analytics or tracking and loads nothing from other websites. Our hosting provider, Cloudflare, processes your IP address as our processor to deliver the pages and protect them from attacks (legitimate interest, Art. 6(1)(f) GDPR), and keeps these logs only as long as needed for that.
The Steller app
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Email address, or your Google account identity if you sign in with Google | Account and sign-in | Contract (Art. 6(1)(b) GDPR) | While the account exists |
| Projects, drawings, models, imported images and prompts | Providing the service | Contract (Art. 6(1)(b) GDPR) | Until you delete them or your account; see inactive accounts in the terms |
| Render results | Providing the service | Contract (Art. 6(1)(b) GDPR) | Recent results 30 days; kept results while the account is active |
| Balance, top-ups, refunds, payment transaction IDs and per-render charges | Billing and legal record-keeping | Contract; for the 7-year retention, legal obligation (Art. 6(1)(b) and (c) GDPR) | 7 years; after account deletion linked only to a random token, without email or name. Never images or prompts. |
| Operational logs | Security and operations | Legitimate interest in security and operation (Art. 6(1)(f) GDPR) | 30 days; never images or prompts |
We do not collect your work for analysis or model training at launch. Any future analysis would be opt-in.
The app uses only cookies or browser storage that are strictly necessary for signing in and for saving your work on your device. They need no consent, so Steller shows no cookie banner.
Processors
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in, file storage | Frankfurt, Germany |
| Render | Application hosting | Frankfurt, Germany |
| RunPod | GPU rendering | EU data centres |
| Brevo | Sign-in and service emails | EU (France, Belgium) |
| Sentry | Error monitoring | EU |
| Better Stack | Uptime monitoring | USA |
| Cloudflare | DNS, website hosting, bot protection at sign-in (Turnstile) | Worldwide network; company in the USA |
| Backblaze B2 | Backups | EU |
Each processor works under a data processing agreement. Several are companies outside the EU/EEA, in the USA or Singapore; where personal data leaves the EU/EEA, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the standard contractual clauses in its agreement.
If you choose Sign in with Google, Google confirms your identity to us as an independent controller, under its own privacy policy; we receive your email address and your Google account ID.
Payments
Paddle sells top-ups as our reseller and merchant of record and processes your payment and billing data as an independent controller, under its own privacy notice. Paddle's main entity is in the United Kingdom, for which the EU has an adequacy decision. We receive from Paddle what we need for your balance, such as the transaction ID, amount, currency and status, never your card details.
Deletion and export
Deleting your account removes your content within 24 hours; backup copies expire within 30 days, and deletions are re-applied if a backup is ever restored. Financial records are kept as described above. You can export your data as a ZIP archive once every 24 hours.
Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection, and you can withdraw any consent you gave at any time. Contact support@steller.work; we answer within one month. You can also complain to the Austrian data protection authority (Datenschutzbehörde) or your local authority.