Privacy Policy

starc · Version 1.5 · Effective: September 20, 2026

This Privacy Policy explains how we collect, use, and protect your personal data when you use our services, including our website at starcinvest.com and the starc mobile app (iOS and Android). It applies to all features available during the pre-launch period, including waitlist signup, school course inquiries, referral features, and paper trading challenges.

1. Data Controller

NextGen Wealth Labs GmbH
Wörther Straße 21, 10405 Berlin, Germany
Handelsregister: HRB 280358 B, Amtsgericht Charlottenburg
Managing Directors: Hubertus Neuhaus, Leo Richter
Email: hello@starcinvest.com

You can contact our Data Protection Officer at dsb+starc@freshcompliance.de. For any privacy-related questions, you can also contact us at the email address above.

2. What We Collect

The personal data we collect depends on how you interact with our services.

2.1 Website, Waitlist Signup, and School Course Inquiries

When you sign up for our waitlist on starcinvest.com, we collect your email address through the waitlist form.

When you submit a school course inquiry through our website, we collect your name, the name of the school, and your school email address. Your role and any message or preferred time period are optional.

When you visit our website more generally, we may use cookies and similar technologies as described in Section 2.3. Strictly necessary technologies (such as remembering your cookie preferences) are used without consent on the basis of § 25(2) TDDDG. All other cookies and tracking technologies are only set with your prior consent, which you can give, refuse, or withdraw at any time via our cookie banner and the "Cookie settings" link in the footer.

2.2 Mobile App (Registration and Use)

When you register for and use the starc mobile app, we collect the following data:

Data	When Collected	Purpose
Email address	At registration	Account creation, communication
Username	At registration	Public profile display, leaderboards
University affiliation	At registration	Community features, product personalisation
Authentication data	At registration / login	Verifying your identity (email OTP, Apple Sign-In, or Google Sign-In)
Push notification token	When you enable notifications	Delivering push notifications to your device
Challenge activity data	During paper trading challenges	Running challenges, calculating rankings, awarding prizes
Group membership data	When you create or join a group	Managing group features, determining prize eligibility
Referral data	When you share or use a referral link	Tracking referrals, adjusting waitlist positions
In-app interaction data	During app use	Product analytics and improvement
Device and error data	During app use	Crash reporting and stability monitoring

2.3 Cookies and Tracking Technologies

Our website uses cookies and similar technologies (such as pixels, local storage, and scripts). Cookies are small text files stored on your device by your browser. We use the following categories:

Strictly necessary — Technologies required for the website to function and for you to use features you have requested (for example, storing your cookie consent choice and our first-party referral attribution). These are used without consent on the basis of § 25(2) TDDDG and Art. 6(1)(f) GDPR.
Analytics — Technologies that help us understand how visitors use our website, which content performs well, and where the user experience can be improved. This includes pseudonymised event data and session recordings with input masking (we never see what you type). Data is hosted on EU infrastructure. If you later sign up for the waitlist, we associate events with a one-way cryptographic hash derived from your waitlist token, not with your email address.
Marketing — Technologies that help us measure the effectiveness of our advertising on social media platforms, build audiences for retargeting, and identify users with similar interests (lookalike audiences). These technologies transmit data, including a pixel identifier and event data such as page views, to the relevant advertising platform, which may combine it with your account on that platform.

Legal basis. Strictly necessary technologies are based on § 25(2) TDDDG and Art. 6(1)(f) GDPR (our legitimate interest in operating a functional website). All analytics and marketing technologies are based on your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG).

Your choices. You can accept, refuse, or change your cookie preferences at any time using our cookie banner or the "Cookie settings" link in the footer. Detailed information about the specific tools and providers we use, including the cookies they set, is available in the cookie banner's preference modal. Rejecting analytics and marketing cookies has no effect on your ability to use the website or join the waitlist. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

2.4 Data Excluded from Advertising Measurement

The iOS advertising measurement described in Section 2.5 does not transmit your starc account identity or financial information to the measurement provider. It uses installation-level attribution data rather than a cross-app advertising identifier. These exclusions apply to advertising measurement, not to other features you use.

2.5 Paid Acquisition Measurement (iOS App)

Purpose and data

We use a mobile attribution and advertising measurement provider to understand how paid advertising contributes to installations of our iOS app and registration events, and to improve our campaigns. The provider receives app, measurement-software and operating-system versions, device type, language, timestamps, an installation identifier, IP address and the approximate location derived from it, and information about installations, app launches and sessions. These data come from the app and relevant attribution sources. Installation identifiers and technical information can be personal data even though we do not send your starc account identity for this purpose.

Registration and excluded data

The app can send a registration event when you complete the onboarding steps in the app, without additional event parameters, value or revenue. The event does not verify successful account creation on our servers, an identity check, a brokerage account opening or a financial transaction. Previously completed registrations are not reported retrospectively. For this measurement, we do not send your starc user ID, name, email address, phone number, hashed identity, referral or invitation credentials, identity-verification documents, account or brokerage status, deposits, holdings, orders, transactions, balances or other financial information.

Advertising platforms

The provider processes installation-level data; its processing is not limited to anonymous or aggregated information. This iOS integration does not collect IDFA or IDFV and does not request Apple's App Tracking Transparency permission.

When measurement starts and local storage

In the enabled iOS version, measurement can start when you select an Apple, Google or email sign-in option, before sign-in succeeds. Cancelling or failing sign-in does not automatically stop it. When completed onboarding is restored, measurement can start automatically without a new choice and can run on subsequent launches. The app stores installation-local eligibility and registration-handling records without a starc user ID. These records survive logout and account deletion and are reset when the app's stored data is removed. Removing local data does not itself erase information already held by the measurement provider.

Retention

We retain mobile advertising measurement data held by us or the measurement provider for up to 24 months, then delete or anonymise it. We delete it earlier when it is no longer needed or in response to a valid deletion request. This period is separate from the 12-month period for website and mobile product analytics in Section 7. The installation-local technical records follow the separate storage rule described above.

Your choices and requests

Website cookie preferences do not control this mobile measurement. To stop future mobile advertising measurement or request deletion of measurement data, email hello@starcinvest.com. We handle these requests through our email process. There is no separate in-app measurement switch. You can also use this address for access, objection and other privacy requests. Your rights and complaint routes in Section 8 remain available.

3. How and When Your Data Is Stored

3.1 Website Waitlist Signup

When you enter your email address in our website signup form, it is saved to our database immediately, before you click the confirmation link in your verification email. We do this to complete the signup process you initiated and to prevent fraudulent or duplicate signups.

If you do not confirm your email address within 30 days, it will be automatically deleted from our systems.

3.2 School Course Inquiries

When you submit the course inquiry form, your information is transmitted through Cloudflare Email Sending to the email mailbox used to handle the inquiry. It is stored there so that we can respond to your inquiry and document any further correspondence. We do not maintain a separate website database for course inquiries.

3.3 Mobile App Registration

When you register through the mobile app, your account data (email, username, university) is stored upon successful completion of the registration process. Authentication is handled securely through a dedicated authentication service provider.

4. Purposes and Legal Basis

We process your personal data for the following purposes:

Purpose	Data Used	Legal Basis (GDPR)
Temporarily storing your email to complete the website signup process (before confirmation)	Email	Legitimate interest (Art. 6(1)(f)) — completing user-initiated registration, preventing fraud
Managing your waitlist position and sending service-related messages	Email, referral data	Performance of a contract / pre-contractual measures (Art. 6(1)(b))
Responding to and further handling your school course inquiry	Name, school, school email address and, where provided, role, message, and preferred time period	Pre-contractual measures (Art. 6(1)(b)) where your inquiry is intended to enter into a contract; otherwise our legitimate interest (Art. 6(1)(f)) in responding to business inquiries
Providing and operating the mobile app (account management, challenges, groups, leaderboards)	Email, username, university, challenge data, group data	Performance of a contract (Art. 6(1)(b))
Authenticating your identity	Email, authentication data	Performance of a contract (Art. 6(1)(b))
Delivering push notifications you have opted into	Push notification token	Consent (Art. 6(1)(a))
Sending product updates, launch announcements, and feature news	Email	Consent (Art. 6(1)(a)), obtained via double opt-in (website) or explicit in-app opt-in
Product analytics and improvement (mobile app, excluding the advertising measurement in Section 2.5)	In-app interaction data (pseudonymised)	Consent (Art. 6(1)(a)), obtained via in-app consent prompt
Website analytics and product improvement	Pseudonymised event data, session recordings (input-masked), device and browser data	Consent (Art. 6(1)(a)) in conjunction with § 25(1) TDDDG, obtained via the website cookie banner
Measuring advertising performance and reaching similar audiences on social media platforms	Pixel identifier, event data (e.g., page views), advertising platform cookies	Consent (Art. 6(1)(a)) in conjunction with § 25(1) TDDDG, obtained via the website cookie banner
Crash reporting and app stability monitoring	Device and error data	Legitimate interest (Art. 6(1)(f)) — ensuring a stable, functional service

We will not send you unrelated marketing or promotional content from third parties.

We treat your personal data with strict confidentiality and do not sell or rent it. The recipients and purposes for website advertising and mobile Paid Acquisition Measurement are described separately in this policy. We only disclose personal data to recipients where this is necessary to operate our services, comply with legal obligations, or where you have given your consent.

Within our organisation, personal data may be accessed by those teams and employees who require it to operate, maintain, support, and improve our services. Access is strictly role-based and limited to what is necessary for the respective purpose.

We share personal data with carefully selected service providers that support our business operations. These include, in particular, providers of cloud hosting and database infrastructure, transactional email delivery services, authentication and identity verification services, push notification delivery services, website and product analytics tools, advertising measurement and audience platforms, as well as crash reporting and error monitoring services. Where such service providers process personal data on our behalf, we conclude data processing agreements pursuant to Article 28 GDPR, ensuring that personal data is processed solely in accordance with our instructions and in compliance with applicable data protection standards. For website advertising measurement, we and the platform act as joint controllers within the meaning of Art. 26 GDPR with respect to the collection and transmission of event data; the relevant joint-controller arrangement is referenced in our cookie banner.

We use Cloudflare Email Sending to transmit school course inquiries. In doing so, Cloudflare processes the information contained in the form and technical delivery data to the extent necessary to accept, transmit, and deliver the email. The inquiry is then stored in the email mailbox we use to handle it.

We may also disclose personal data where required by law, or where such disclosure is necessary to comply with legal obligations or lawful requests by public authorities, courts, or law enforcement agencies, to enforce our terms and conditions or other agreements, to investigate potential violations, to prevent or address fraud, security, or technical issues, or to protect our rights, property, users, or the public.

6. International Data Transfers

Your personal data is primarily stored and processed within the European Union.

Some of the service providers we engage may be located outside the European Union or the European Economic Area, in particular in the United States. Where personal data is transferred to third countries, such transfers are carried out only where permitted under Articles 44 et seq. GDPR and are subject to appropriate safeguards. These safeguards include in particular reliance on adequacy decisions (such as the EU–U.S. Data Privacy Framework, where applicable), the use of Standard Contractual Clauses approved by the European Commission, and additional technical and organisational measures to ensure an adequate level of data protection.

Information about recipients and applicable transfer safeguards can be requested at hello@starcinvest.com.

We assess the data protection and security posture of each recipient and ensure that appropriate technical safeguards (such as encryption and access controls) are in place. These safeguards are reviewed on an ongoing basis and updated as necessary to reflect legal or regulatory developments. If the legal framework for any transfer changes, we will implement appropriate alternative safeguards or cease the transfer.

7. Data Retention

We retain your personal data as follows:

Unconfirmed website signups: Automatically deleted after 30 days.
Confirmed waitlist members and app users: Retained for the duration of the waitlist / pre-launch period and for up to 6 months after the starc app launches publicly, or until you request deletion, whichever comes first.
School course inquiries: Stored in the email mailbox used to handle them for as long as necessary to respond, manage further correspondence, and comply with statutory retention obligations. We then delete the inquiry unless another legal basis permits or requires continued storage.
Challenge and Group data: Retained for the same duration as your account data.
Website and mobile product analytics, excluding the separate advertising measurement in Section 2.5: Retained in pseudonymised form for up to 12 months, then deleted or further anonymised.
Mobile advertising measurement: Up to 24 months, as described in Section 2.5.
Crash reports: Retained for up to 90 days.
After deletion from our systems: Your data is removed from our active systems and backups within 30 days of the deletion event.

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

Access (Art. 15) — Request a copy of the personal data we hold about you.
Rectification (Art. 16) — Request correction of inaccurate data.
Erasure (Art. 17) — Request deletion of your data ("right to be forgotten").
Restriction (Art. 18) — Request that we limit how your data is processed.
Data portability (Art. 20) — Receive your data in a structured, machine-readable format.
Objection (Art. 21) — Object to processing based on legitimate interest. Where we process your data on the basis of legitimate interest (see Section 4), you may object at any time. We will then cease processing unless we can demonstrate compelling legitimate grounds.
Withdraw consent (Art. 7(3)) — Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

How to exercise your rights: You can unsubscribe from emails at any time using the link in every message. You can disable push notifications in your device settings. For website cookies, use the "Cookie settings" link in the footer to change or withdraw your consent at any time. For all other requests, email us at hello@starcinvest.com. We will respond within 30 days.

Right to lodge a complaint: If you believe we are processing your data unlawfully, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI)
Friedrichstraße 219, 10969 Berlin, Germany
www.datenschutz-berlin.de

You may also contact the supervisory authority in your EU/EEA member state of residence.

9. Provision of Data

Providing your personal data is voluntary. It is not a statutory requirement. However, certain data is necessary to use our services:

Email address: Required to join the waitlist (website) or create an account (app).
Name, school, and school email address: Required to submit a course inquiry through the form and for us to respond. Your role, message, and preferred time period are optional.
Username and university: Required to register for the mobile app.

If you choose not to provide this data, you will not be able to use the relevant features of our services. Refusing analytics or marketing cookies on the website does not affect your ability to use the website or join the waitlist.

10. Automated Decision-Making

We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Waitlist rankings are determined by referral activity and signup order. Challenge rankings are determined by simulated trading performance. These calculations are algorithmic but do not constitute automated individual decision-making within the meaning of Art. 22 GDPR.

11. Data Security

We protect your data using industry-standard security measures, including encryption in transit (TLS/SSL), secure cloud infrastructure hosted within the European Union, access controls that restrict who within our team can access personal data, and secure authentication mechanisms (OTP, OAuth).

12. Children

Our services are intended for users aged 16 and older. We do not knowingly collect personal data from individuals under 16. If you believe we have inadvertently collected data from a person under 16, please contact us and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (and, for app users, via push notification or in-app notice) before the changes take effect. The version and effective date shown at the top of this page always reflect the most recent version.

14. Contact

For any privacy-related questions, requests, or complaints:

NextGen Wealth Labs GmbH
Email: hello@starcinvest.com
Wörther Straße 21, 10405 Berlin, Germany