Privacy Policy

Last updated: 14 July 2026 · Effective for: Yll★, operated by Arber Bylykbashi (Monexa), Lushnjë, Fier, Albania ("we", "us").

1. Who this applies to

This policy covers three groups of people: (a) visitors and leads who submit the free-audit form on our landing page, (b) business owners/staff who create a Yll★ account to use the dashboard, and (c) guests of our business customers who receive a "rate your stay" link and choose to leave feedback.

2. What we collect

• From landing page visitors: business name, city, business type, and WhatsApp number, submitted voluntarily via the audit request form.
• From account holders: email address (for login), business name and city, and review content pulled in automatically from platforms you connect (Google, TripAdvisor).
• From hotel/restaurant guests: if a business using Yll★ sends you a "rate your stay" link, we collect the star rating and any written feedback you choose to submit, matched to the name and phone number the business already has on file for your stay. This feedback is private — we only show it to that business, and never post it publicly ourselves.
• Automatically: basic ad-conversion events (via Meta Pixel, if enabled) when you arrive from an ad campaign.

3. How we use it

• To prepare and deliver the free reputation audit you requested, via WhatsApp.
• To operate your account: authentication, showing your dashboard, billing, and sending service emails (e.g. weekly reports).
• To let a business see and privately respond to feedback left by their own guests.
• To measure which ads lead to signups, so we can spend our (limited) ad budget sensibly.

We do not sell your data. We do not share it with third parties except the service providers below, who process it on our behalf.

4. Who we share it with

• Supabase — database and authentication hosting.
• Lemon Squeezy — billing and subscription management (they act as merchant of record for payments).
• Meta (Facebook/Instagram) — ad delivery and conversion tracking, if the Pixel is active.
• Anthropic — powers the AI-drafted review reply feature; review text you choose to draft a reply for is sent to their API.

Guest feedback (see §2) is shown only to the specific business a guest stayed with. It is never sold, shared with other businesses, or posted publicly by us — a guest decides separately, and entirely on their own, whether to also leave a public review on Google or TripAdvisor.

5. Data retention

Lead form submissions are kept for 12 months or until you ask us to delete them. Account data — including reviews and guest feedback tied to your account — is kept for as long as your account is active, plus 30 days after cancellation, then deleted or anonymized.

6. Your rights

You can ask us to access, correct, or delete your data at any time by emailing privacy@yllstar.com. If you're in the EU/EEA, you also have rights under GDPR (access, rectification, erasure, portability, objection) — the same email works for those requests. This applies to guests too — if you submitted feedback through a "rate your stay" link and want it removed, the same email works.

7. Cookies & tracking

The landing page may use the Meta Pixel to measure ad performance, which sets cookies in your browser. You can opt out via your browser's tracking settings or an ad-blocker.

8. Contact

Questions about this policy: privacy@yllstar.com.