Legal

Privacy Policy

Last updated: Oct 15, 2026

1. Who we are

Star Flow XL LLC ("SFXL", "we", "us") is a Wyoming limited liability company. Our address is 30 N Gould St Ste N, Sheridan, WY 82801. We run a business-to-business sourcing platform at starflowxl.online. It is for business users only and not for consumers. Contact: contact@starflowxl.online.

2. Data we collect

• Through our RFQ and contact forms: name, business email, phone (optional), company name and country, role, and product details (description, HS code, quantities, reorder frequency, FOB and target cost).
• Through email and order coordination: correspondence, purchase-order summaries, shipment documents and supplier contact details.
• Quote request form: when you submit the form at /quote, the details you enter (company, name, work email, product, specifications, quantity, destination and timeline) are stored in our database hosted by Cloudflare, Inc., and our team is notified. The form is protected by Cloudflare Turnstile, which processes technical signals (such as IP address and browser characteristics) to block automated abuse. The contact page can still prepare a request in your own email app instead.
• SFXL Academy checklist signup: when you submit the form at /academy/checklist, we store your name, company, work email, country, and a timestamped record of your consent to receive the checklist and related Academy follow-up emails, in our Cloudflare-hosted database (preview or production as configured). The form is protected by Cloudflare Turnstile.
• Client portal and staff accounts: if we open an account for you, we store your email, username, a salted password hash (never the password itself), an encrypted two-factor authentication secret, hashed recovery codes, your order status updates and links to order documents, and security records of sign-in attempts (time, IP address and result) used for rate limiting and account protection.
• Technical data: We do not use analytics or advertising cookies. If you sign in to the client portal, we set one strictly necessary session cookie (sfxl_sid) that expires after 12 hours or when you sign out. Our hosting provider may process standard server logs (such as IP address and request time) to deliver and secure the site.

We do not knowingly collect sensitive personal data or data from children.

3. How we use it and our legal bases

• To answer RFQs, prepare quotes and coordinate orders. Legal basis: steps before a contract and performance of a contract (GDPR art. 6(1)(b); LGPD art. 7, V).
• To introduce you to suppliers, inspection companies, freight forwarders and customs brokers that you choose to work with (same bases).
• To invoice fees, keep records and meet legal obligations (GDPR art. 6(1)(c); LGPD art. 7, II).
• To prevent fraud, secure the platform and improve our services. Legal basis: legitimate interests (GDPR art. 6(1)(f); LGPD art. 7, IX).
• To send occasional business updates. You can opt out at any time.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

4. Who we share it with

• Suppliers (in Asia and other countries) and logistics partners (inspection companies, freight forwarders, customs brokers), only as needed for your RFQ or order.
• Service providers that host or support our systems (such as our website hosting and email providers), under confidentiality obligations.
• Authorities, where the law requires it, or to protect our rights.

5. International transfers

We are based in the United States, and our suppliers are mainly outside the United States. Your data may be processed outside your country. Where GDPR or LGPD requires it, we use appropriate safeguards, such as standard contractual clauses (GDPR arts. 44–49; LGPD art. 33).

6. Retention

We keep RFQ data for 24 months after our last contact, and order and invoice records for as long as tax and commercial law requires. After that, we delete or anonymize them.

7. Your rights

Depending on where you are, you may have the right to access, correct, delete or port your data, to object to or restrict processing, and to withdraw consent.

• EU/EEA/UK (GDPR), where applicable: you can also complain to your local supervisory authority.
• Brazil (LGPD, art. 18): you have the rights of confirmation, access, correction, anonymization or deletion, portability, information about sharing, and revocation of consent. You can complain to the ANPD. Our contact for data matters (encarregado) can be reached at contact@starflowxl.online.
• California (CCPA/CPRA), where it applies to us: you have the right to know, delete and correct, and to opt out of sale or sharing (we do not sell or share). We will not discriminate against you for using these rights.
• Other Latin American countries (e.g., Mexico, Colombia, Argentina, Chile): you can use the rights your local law provides.

To make a request, email contact@starflowxl.online. We may need to verify your identity, and we will answer within the time the applicable law requires.

8. Security

We use reasonable technical and organizational measures. No system is fully secure. If you receive an unexpected request to change payment or bank details, verify it with us through a known contact before acting on it.

9. Changes

We may update this policy. We will post the new version here with a new date.

10. Contact

Star Flow XL LLC, 30 N Gould St Ste N, Sheridan, WY 82801, contact@starflowxl.online.