Privacy Policy

This policy explains how Stargazing For Beginners ("we", "us", "our") collects and uses personal information when you visit stargazingforbeginners.co.uk, contact us or pay for a session. We are the data controller for this information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are and how to contact us

What information we collect

Information you give us

• When you use our contact form: your name, email address and the content of your message.
• When you pay for a session: your name and email address. Payments are handled by Stripe. We receive confirmation of your payment, the amount and your name and email address. We never see or store your full card details.
• When you ask to hear when the next class goes on sale: your email address, when you signed up and confirmed, and which class we last emailed you about.

Information collected automatically

• Security and spam protection: when you send the booking, contact or "next class" sign-up form, we check it on our own server for signs of spam - for example how quickly it was sent and whether it repeats a message we've already received. For rate limiting we keep a scrambled code made from your IP address, not the address itself, normally for about an hour; for repeats we keep a scrambled code made from the message text for a week. Neither is shared with anyone.
• Payment security: Stripe sets cookies to help prevent fraud.
• Visitor statistics (no cookies): we count visits to our website ourselves, without cookies and without storing anything on your device. We record which pages are viewed, which links and buttons are clicked, how long pages are looked at and how far down them you scroll, the website that sent you here (just its name, such as google.com), any campaign tag in the link you followed (such as "bluesky"), whether you're on a phone, tablet or computer, the kind of browser and operating system you use (such as "Safari" and "iOS", without version numbers), your preferred language (such as "en"), and your country. All of these come from information your browser sends with every request anyway. Your country is worked out on our own server from your IP address, using an offline database; nothing is sent to anyone else to do it. We also record which files are downloaded, and when one of our forms is started and when it is sent, so we can see if a form is putting people off. We never record what you type into a form through our statistics. We record how quickly each page loaded and responded, as measured by your browser, so we can keep the site fast. If a page on our site has a technical error, we record the error message so we can fix it. To tell visitors apart within a single day, we combine your IP address and browser details with a random key and scramble them into a code. Your IP address itself is never stored, and the key is deleted at the end of each day, after which the code can no longer be linked back to your IP address or browser, or to your visits on other days. If you book a session, the statistics record that a booking was made and its value, but not your name, email address or payment details. We only ever look at these figures as totals, we do not use them to identify you, and we don't share them with anyone.

We only use cookies that are strictly necessary, so we don't ask for consent. For the full list, see our Cookie Policy.

The night sky map

The Sky Tonight works out the sky in your browser. A few of its features need information from elsewhere; this is exactly what is sent, and to whom.

• Your location: the map only uses your device's location if you tap "Use my location", and your browser asks your permission first. It is used in your browser to draw the sky, and remembered there (rounded to about 1 km) so the map opens on your place next time; we never receive or store it. A place in a link someone shares with you is used the same way but not remembered. Only rounded versions of it ever leave your device, for the two things below.
• A place you type in: if you use "Change place", the town, city or postcode you type is sent to OpenStreetMap's Nominatim service when you press Find, and it replies with matching places, along with your IP address as any website receives. The place you pick, and your last few, are remembered in your browser only.
• The name of your town: the map sends the location, rounded to about 1 km, to OpenStreetMap's Nominatim service, run by the OpenStreetMap Foundation, which replies with the town's name. Like any website, Nominatim also receives your IP address with the request. The name is then remembered in your browser (see our Cookie Policy), so the same place isn't looked up again.
• Cloud forecast and aurora alerts: the map sends the location, rounded to about 25 km, to our own website. Our server then asks OpenWeather for that area's forecast, and the US National Oceanic and Atmospheric Administration (NOAA) for aurora activity. Neither of them receives your IP address or anything else about you. We keep the forecast for that area for up to a day, so other visitors nearby get it too, but we don't record who asked for it.
• Space Station passes: when you open the Events panel, your browser downloads the Space Station's orbit directly from CelesTrak, in the United States. No location or other information is sent, but CelesTrak receives your IP address, as any website you visit does. The orbit is kept in your browser for 12 hours.
• Comets and asteroids: the map downloads their orbits from our own website, which gets them once a day from NASA's Jet Propulsion Laboratory. Nothing about you or your location is sent to either. The orbits are kept in your browser for 12 hours.

How we use your information and our legal basis

The only marketing emails we send are the "next class" emails, and only to people who have asked for them and confirmed. We do not sell your personal information. We do not use it for automated decision-making or profiling.

Who we share your information with

We only share your information with service providers who help us run the website and our sessions:

• Stripe, for payment processing and fraud prevention. Stripe acts as an independent controller for some fraud-prevention and legal-compliance purposes. See Stripe's Privacy Policy.
• Our website hosting and email providers, which store the website and our email on our behalf.
• The OpenStreetMap Foundation (Nominatim), which receives a rounded location and your IP address when the star map looks up a town's name, or the place you type when you use "Change place". See the OpenStreetMap Foundation's Privacy Policy.
• CelesTrak, which receives your IP address when the star map downloads the Space Station's orbit.

We may also disclose information if the law requires us to, for example in response to a court order.

International transfers

Some of our providers, including Stripe, may process data outside the UK, including in the United States. When this happens, the transfer is protected by an approved safeguard, such as the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), UK adequacy regulations, or the UK International Data Transfer Agreement or Addendum.

When you open the star map's Events panel, your browser contacts CelesTrak in the United States directly, to download the Space Station's orbit. CelesTrak receives your IP address, but nothing else about you.

How long we keep your information

• Contact form messages and emails: up to 12 months after our last contact with you, unless they relate to a booking.
• Payment and booking records: 6 years from the end of the tax year they relate to, as required for tax and accounting.
• The "next class" email list: until you unsubscribe, when your address is deleted straight away. A sign-up that isn't confirmed within 7 days is deleted automatically.
• Our website's security log (which can include the email address used on a form, and the start of a message our spam checks stopped): 12 months, then deleted automatically.
• Star map forecasts: up to a day. They are kept by area (rounded to about 25 km), not by visitor, and say nothing about who asked.
• Visitor statistics: about 13 months, then deleted automatically. The key that links one day's visits together is deleted at the end of that day. Each day is also added up into totals - for example, 40 visits came from google.com - which we keep so we can compare one year with the next. The totals contain nothing about any individual visit.

Turning off visitor statistics

If you'd rather your visits weren't counted, use the switch below. It applies to this browser on this device, and it works by saving a single setting (sfb-stats-optout) in your browser's local storage - the only thing our statistics ever store, and only because you asked. Clearing your browser's data removes it.

We also don't count visits from browsers with Global Privacy Control turned on, and our statistics don't run at all with JavaScript switched off.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to restrict how we use your information;
• object to our use of your information where we rely on legitimate interests;
• receive your information in a portable format, where we hold it to provide a session you booked;

To use any of these rights, email class@stargazingforbeginners.co.uk. We will respond within one month. There is normally no charge.

Complaints

If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

Children

Our website is not intended for children to use by themselves. If a child is attending a session, the booking and payment should be made by a parent or guardian.

Security

Our website uses HTTPS encryption. We rely on established providers to process payments and store data, and we limit access to your information to what is needed to run our sessions. No method of transmission over the internet is completely secure, but we take reasonable steps to protect your information.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it was last changed.