1 Introduction
This Privacy Policy applies to the StarExtension Chrome extension ("the extension"), published by starlabs ("we," "our," or "us"). It describes every category of user data the extension handles, how each one is collected, what it is used for, where it is stored, how long it is kept and every party it is shared with.
The extension helps users monitor ticket availability and complete purchases on supported ticketing sites (PuntoTicket, Ticketmaster, AllAccess, Real Madrid tickets and Queue-it waiting rooms), relay a purchase session from our service into the browser, and export a Nike session for use in our desktop software.
Summary: we do not sell your data, we do not use it for advertising, and we do not use it to determine creditworthiness or for lending. We only use it to provide the features you activate.
2 Data We Collect and How We Collect It
2.1 License and device identifier
- What: the license key you enter, and a device identifier (HWID) generated by the extension from a hash of your browser user agent, language and time zone.
- How collected: you type the license key in the extension popup; the HWID is generated locally on first activation.
- Use: validate your subscription and limit each license to its allowed number of devices.
- Stored: locally in Chrome extension storage, and on our servers (license record and the HWID bound to it).
- Shared with: our servers at
api.staraio.co only.
2.2 Buyer profiles (personal information)
- What: first name, last name, identity document type and number (for example a Chilean RUT) of each ticket holder.
- How collected: you enter them manually on the extension's Profiles page.
- Use: assign ticket holders when a ticketing site requires attendee data for a purchase, and display the holder names on the payment page so you can confirm the purchase.
- Stored: locally in Chrome extension storage. They are sent to our servers only while a purchase that requires holder data is in progress, are processed in memory and are not stored in our databases. Error logs may contain short excerpts of the ticketing site's responses, which can include holder names; these logs are deleted within 30 days.
- Shared with: our servers, and the ticketing site where you are buying (for Ticketmaster Chile, its purchase platform Crowder), which requires this data to issue the tickets.
2.3 Payment card data (financial information)
- What: card number, expiry month and year, and CVV.
- How collected: you type them in the extension's payment form, only when a purchase requires direct card payment.
- Use: pay for the tickets you chose.
- Stored: never. Card data is held in memory for the duration of the payment, is never written to browser storage or to our databases, and we do not log the card number, expiry or CVV.
- Shared with: it is transmitted over HTTPS through our servers to the ticketing site's purchase platform (for Ticketmaster Chile, Crowder at
public.getcrowder.com), which charges it through its payment processor (Getnet), solely to complete the payment.
2.4 Ticketing site data (website content)
- What: the event identifiers in the page you are on (event, date, category), the availability, price and seat information returned by the ticketing site, your monitoring preferences (sections, quantities, maximum price), and the purchase result (section, seats, quantity, total).
- How collected: read from the supported ticketing page you have open, and from the requests the extension makes to that site while monitoring is active.
- Use: detect when tickets become available, reserve them, and show you the result.
- Stored: preferences and the current monitor state are stored locally. Site responses are sent to our servers to be interpreted and are not stored there.
- Shared with: our servers, and the ticketing site itself.
2.5 Entry links
- What: the queue or entry link (URL) that a supported ticketing site generates for an event, for example PuntoTicket queue links.
- How collected: detected on supported ticketing pages and in requests to
puntoticket.com/queue/enqueue/.
- Use: show you the link in the popup so you can copy it.
- Stored: in Chrome session storage for the tab, deleted when the tab or browser closes.
- Shared with: no one. It is only shown to you.
2.6 Ticketmaster session tokens (authentication information)
- What: the access token and refresh token of the Ticketmaster account you are logged in with.
- How collected: read from the Ticketmaster page you have open (page state, local or session storage, or the site's session cookie) when you start monitoring or a purchase on that page.
- Use: make availability checks and the purchase on your behalf, as your logged-in account, and renew the session if it expires during a purchase.
- Stored: not stored by the extension beyond the active monitor; processed in memory on our servers and not stored in our databases.
- Shared with: our servers, which use them only to call Ticketmaster and its purchase platform (Crowder) on your behalf.
2.7 Relayed sessions (authentication information)
- What: cookies and local storage values of a ticketing session prepared by our service.
- How collected: when you open a relay link from
queue.staraio.co, the extension downloads that session from our servers using a one-time token.
- Use: place the session in your browser so you can continue the purchase on the ticketing site.
- Stored: as cookies and local storage of the target site in your browser, with that site's own expiration. Our servers delete or invalidate the session once it has been used or has expired.
- Shared with: no one. Relayed sessions are only written into your browser, never sent elsewhere.
2.8 Nike session export (authentication information)
- What: the Nike session cookies
sid and did and the session token (id_token) of your own Nike account, plus the account email shown on the page.
- How collected: on nike.com pages the extension observes the site's own requests to
api.nike.com to keep the current session token in the page's memory; the cookies are read, and anything leaves the page, only when you open the Nike export in the popup.
- Use: let you save your own Nike session to a file (
token.json) that you load into our desktop software.
- Stored: only in the file you choose to download. The extension does not keep it in storage, and the in-page copy disappears when you close the tab.
- Shared with: no one. The extension does not transmit this data to our servers or to any third party.
2.9 Settings and technical data
- What: language, install date, extension version, and remote configuration downloaded from our servers. When the extension contacts our servers, they receive your IP address and the extension version as part of the request.
- Use: operate the extension, enable or disable features remotely, rate limiting, security and debugging.
- Stored: settings locally; server request logs are kept for up to 30 days.
- Shared with: our infrastructure provider (Google Cloud Platform).
3 Data We Do Not Collect
The extension does not collect your browsing history, does not read pages outside the sites listed in section 7, does not collect location, health or biometric data, does not record keystrokes, and does not read or export cookies from any site other than the Ticketmaster tokens (2.6) and the Nike export (2.8) described above.
4 How We Use Data
We use the data above only to provide the extension's features: license validation, ticket monitoring, purchasing on your behalf, session relay, Nike session export, notifications and support. We do not use it for advertising, profiling, selling, or any purpose unrelated to these features. No human at starlabs reads your buyer profiles or card data.
5 Storage and Security
- On your device: license key, HWID, buyer profiles, preferences and monitor state live in Chrome extension storage and are removed when you uninstall the extension.
- On our servers: license records, the HWID bound to each license, and request logs, hosted on Google Cloud Platform (United States region).
- In transit: all communication with our servers and the ticketing sites uses HTTPS/TLS.
- Card data, buyer profiles and Ticketmaster tokens are processed in memory and are not stored in our databases.
- The extension does not execute remote code. All JavaScript is bundled in the package.
6 Parties We Share Data With
We do not sell, rent or trade user data. Data is shared only with the following parties, and only for the stated purpose:
| Party | Data | Purpose |
|---|
starlabs servers (api.staraio.co, queue.staraio.co) | License key, HWID, ticketing site data, Ticketmaster session tokens, buyer profiles and card data during a purchase, relay tokens, IP address | Provide the service |
| Google Cloud Platform | All server-side data above | Hosting and infrastructure |
| Ticketing sites: PuntoTicket, Ticketmaster, AllAccess, Real Madrid tickets, Queue-it | Monitoring requests, your Ticketmaster session tokens, buyer profiles, purchase details | Check availability and complete the purchase you requested |
Crowder (Ticketmaster Chile purchase platform, public.getcrowder.com, cdn.boletius.com) | Ticketmaster session tokens, buyer profiles, card data, purchase details | Check availability and complete the Ticketmaster Chile purchase |
| Payment processors of the ticketing site (Getnet, Transbank Webpay) | Card data (via the ticketing platform) | Complete the ticket payment |
| Stripe or Whop (depending on where you subscribed) | Name and email of the subscription buyer. For licenses purchased through Whop, our servers also send Whop the license key and HWID to validate them. | Subscription billing and license validation |
We may disclose data if required by law or a valid order from a competent authority.
7 Permissions
| Permission | Why it is needed |
|---|
storage | Save license, buyer profiles, preferences and monitor state locally |
scripting | Read event identifiers and run availability requests on the supported ticketing page you have open |
notifications | Alert you when tickets become available or a purchase finishes |
cookies | Place relayed sessions (2.7) and read your Nike session for export (2.8) |
declarativeNetRequest | Match the browser user agent of a relayed session |
webRequest | Detect PuntoTicket queue entry links (2.5) |
tabs (optional) | Find the correct ticketing tab to monitor; requested only when needed |
| Host permissions | Access the supported ticketing sites, Crowder (public.getcrowder.com, cdn.boletius.com), Webpay, Nike (for the export in 2.8) and our servers. Access to all sites is needed only so a relayed session (2.7) can be placed on the ticketing domain it belongs to; the extension does not read the content of other sites. |
8 Retention and Deletion
- Local data: kept until you delete it in the extension (buyer profiles can be deleted at any time), clear the extension's data, or uninstall it.
- Card data, buyer profiles and Ticketmaster tokens on our servers: not retained after the request completes, except excerpts in error logs as described in 2.2.
- License and HWID: kept while your license is active and up to 12 months after it ends, then deleted or anonymized. Logging out of the extension releases the device slot.
- Server logs: up to 30 days.
- Relay sessions: invalidated on our servers after use or expiration.
9 Your Rights
You can request access to, correction of, a copy of, or deletion of the data we hold about you by writing to the contact address below. We answer within 30 days. These rights apply under Chilean Law 19.628, the GDPR and the CCPA where applicable.
10 Children
The extension is not directed to children under 13, and we do not knowingly collect data from them.
11 Changes
We will update this page and its effective date whenever our data practices change.
12 Contact
