Privacy policy

Who we are

Mega Star Ecom LLC (trading as Mega Star Distribution) operates https://megastardistribution.com. We are the data controller for the information described on this page.

Registered address: 282 Revere Ave, Bronx, NY 10465, USA
EIN: 42-3616105
Contact: sales@megastardistribution.com

What we collect

Information you give us

• Name, email address and phone number.
• Shipping and billing addresses.
• Order contents, notes and any purchase-order references you supply.
• Account credentials — a password is stored only as a salted PBKDF2 hash, never as text.
• Messages you send us through the contact form, by email or by phone.

Information collected automatically

• IP address and browser user-agent, recorded with an order for fraud prevention.
• Basic request logs kept by our hosting provider for security and reliability.

If you sign in with Google, we receive your name, email address, profile picture and Google account identifier. We do not receive your Google password and we cannot access anything else in your Google account.

Why we use it

Purpose	Basis
Taking, fulfilling and delivering your order	Performance of a contract
Order updates, tracking and delivery notifications	Performance of a contract
Warranty and returns handling	Contract and legal obligation
Answering your questions	Legitimate interests
Fraud prevention and site security	Legitimate interests
Tax, accounting and record keeping	Legal obligation

We do not send marketing email unless you ask us to, and there is an unsubscribe link in anything we do send.

Payment information

Card details entered at checkout are transmitted over TLS and encrypted with AES-256-GCM before storage. The card security code (CVC/CVV2) is never stored in any form. Staff and administrators can see only the card brand and the last four digits; the full number is not displayed anywhere in our systems and is not returned by any interface.

You can ask us to delete stored payment details from a completed order at any time by emailing sales@megastardistribution.com.

Cookies and storage

We use the minimum required to make the site work. There are no advertising cookies.

Name	Purpose	Lifetime
ms_session	Keeps you signed in. HTTP-only and signed.	30 days
megastar.cart.v1	Your cart, stored in your browser only.	Until cleared
megastar.user.v1	Your display name, so the header renders instantly.	Until sign-out
megastar.saved.v1	Your saved-items shortlist.	Until cleared

Cart, user and saved-items values are stored in your browser's local storage, not sent as cookies. Clearing your browser data removes them.

Who we share with

We share personal information only where it is needed to run the business:

• Carriers — UPS, FedEx, USPS receive the delivery address and phone number to make the delivery.
• Manufacturers — where you make a warranty claim, we pass the details needed to process it.
• Hosting — Cloudflare hosts the site and database, with data stored in the United States.
• Google — only if you choose to sign in with Google.
• Authorities — where we are legally required to.

We do not sell, rent or trade personal information. We do not share it with advertisers.

How long we keep it

• Order records — 7 years, to meet tax and accounting requirements.
• Stored card ciphertext — removed once an order is complete and the return window has closed, or sooner on request.
• Account details — until you ask us to close the account.
• Contact messages — 2 years.
• Sessions — 30 days, or until you sign out.

Your rights

Depending on where you live, you may have the right to:

• ask what personal information we hold about you, and get a copy;
• have inaccurate information corrected;
• have information deleted, where we are not required to keep it;
• object to or restrict certain processing;
• ask us not to sell or share your information — note that we do neither.

California residents have these rights under the CCPA/CPRA. We do not sell personal information as those laws define it, and we do not discriminate against anyone who exercises a right. To make a request, email sales@megastardistribution.com. We respond within 30 days and may need to verify your identity first.

Security

• The whole site is served over HTTPS with HSTS.
• Passwords are stored as salted PBKDF2-SHA256 hashes, never in plain text.
• Sessions use opaque, signed, HTTP-only cookies.
• Payment details are encrypted with AES-256-GCM at rest; security codes are never stored.
• A strict Content Security Policy limits what can run on the page.

No system is perfectly secure. If you believe your account has been accessed without your permission, contact us immediately.

Contact us

Questions, requests or complaints: sales@megastardistribution.com, or write to 282 Revere Ave, Bronx, NY 10465, USA.

We may update this policy. Material changes will be noted by the "last updated" date at the top of this page.