Privacy and data
SpaceX Privacy Notice
Before paid launch, the operator must add its legal identity, retention periods, data-rights channel, and market-specific notices. The campaign is designed to keep only the minimum data needed to operate the promotion.
- Data collected
- Campaign identity code, birth month/day (never birth year), consent records, server-side referral attribution, device/network risk signals, UTM and creative parameters, and reward status. Necessary shipping data is collected only after a physical reward is claimed.
- Purposes
- Eligibility, duplicate and self-referral prevention, secure draw and inventory settlement, fulfillment, support, audit, funnel analysis, and consented advertising measurement.
- Sharing and Meta data
- A share click is never treated as a qualified referral. Meta Pixel or CAPI events are sent only when configured with required consent, and browser/server events must use the same event_id for deduplication.
- Business-initiated contact requires the user to provide a number and opt in to the relevant message category, with a simple opt-out. Only approved templates may be used outside the 24-hour service window.
- Security and retention
- Production must encrypt shipping details, restrict admin roles, audit operator actions, back up safely, and enforce deletion schedules. Test and expired-campaign data must not be retained indefinitely.
- Your rights
- The production notice must provide channels for access, correction, deletion, consent withdrawal, marketing objection, and complaints, with legally required exceptions.