Privacy policy
Last updated
This policy explains what personal data Nastar handles, why, how long we keep it, and what you can ask us to do about it. It describes what the product actually does today — not what it may do in a later release.
Who we are
Nastar is a consent management service operated by DXY Global B.V. Where this policy says "we", "us" or "Nastar", it means DXY Global B.V. as the operator of the Nastar service at nastar.dev, and as the controller described below.
- Registered name: DXY Global B.V.
- Registered address:
Kruisbaak 49
2165 AZ Lisserbroek
The Netherlands - Chamber of Commerce (KvK) number: 88375560
- Privacy contact:[email protected]
We have not appointed a Data Protection Officer. We are not required to under Article 37 GDPR, and we would rather say so plainly than name a role that does not exist. Privacy questions go to the address above and are handled by us directly.
Two different roles
Nastar handles two kinds of data that are kept strictly apart, and our legal role is different for each. Reading this distinction first makes the rest of the policy much shorter.
- Your Nastar account. If you sign up for Nastar, we decide what we collect and why. For that data we are the controller.
- Consent records from your visitors. When you install the Nastar SDK on your own website, we store the consent decisions your visitors make, on your behalf and on your instructions. For that data you are the controller and we are the processor.
These two never meet. A consent record carries an anonymous identifier generated in the visitor's browser and is never linked to a Nastar account, an email address, or any other record we hold.
When Nastar is the controller: your account
This is the data we hold because you have a Nastar account. Several fields are stored only as a keyed hash (HMAC), which lets us match a value we are given without keeping the value itself.
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Email address, plus a hash of it | Identify your account and send sign-in codes | Performance of a contract | Until you delete your account |
| Sign-in code, stored only as a hash | Let you sign in without a password | Performance of a contract | 10 minutes, then deleted |
| A hash of the IP address that requested a code, and a count of failed attempts | Rate limiting and abuse prevention | Legitimate interest (security of the service) | Deleted with the expired code |
| Session token, stored only as a hash, plus your browser's user-agent string | Keep you signed in and let you review and revoke active sessions | Performance of a contract | 30 days, or until you sign out |
| Organisation name, website names and consent configuration | Run the service you signed up for | Performance of a contract | Until you delete them |
| Team invitations, including the invited email address | Let you add colleagues to your organisation | Performance of a contract | 7 days, then the invitation expires |
| Automation tokens, stored only as a hash | Let your tooling configure Nastar without a human session | Performance of a contract | 30 days by default, or until you revoke them |
| Activity log: which account performed which configuration change, and when | Let admins see what changed in their organisation | Legitimate interest (accountability and security) | Until the organisation is deleted |
We do not profile you, we do not sell or share account data, and we do not use it for advertising. Nastar has no third-party advertising or marketing trackers in the dashboard.
When Nastar is the processor: consent records
When a visitor makes a choice in a Nastar banner on your website, we store a record of that choice so you can demonstrate what was shown and what was decided. A consent record contains:
- an anonymous identifier generated in the visitor's own browser and kept in that browser's local storage;
- the choice made for each consent category;
- the version of your published configuration the decision was made against, so you can see exactly what the visitor was shown;
- whether the event was consent given, updated or withdrawn;
- the date and time.
What a consent record does not contain: no IP address, no email address, no name, no device fingerprint, no cross-site identifier, and no link to any Nastar account. We do not attempt to identify individual visitors, and the anonymous identifier is not shared between websites.
We keep consent records for 365 days from the moment they are written. Every record carries its own deletion deadline, stamped when it is created, and an automatic job deletes records once that deadline passes. Changing the policy later never shortens the retention a record was written under.
We briefly store a hash of the requesting IP address as an abuse counter when consent is submitted, so that a single client cannot flood a site with records. Those counters are kept for two hours and are not part of the consent record itself.
As processor we act on your instructions, we do not use your visitors' consent records for our own purposes, and we do not sell or share them. If you need a written data processing agreement, contact us at [email protected].
Our own website
We run Nastar's own consent banner on nastar.dev — the same product we sell. Analytics only run on this site if you accept the analytics category; if you reject it, or make no choice at all, no analytics are loaded and nothing is measured.
The cookie policy lists every cookie and storage entry this website uses, what each one does, and how long it lasts.
Who else processes data
We use a small number of service providers. Each one processes data on our instructions, under a contract, and only for the purpose listed here.
| Provider | What it does for us | Where |
|---|---|---|
| DigitalOcean | Hosting for the application and the database | European Union |
| Cloudflare | Delivers the consent SDK and published configuration files | Global edge network |
| MailerSend | Sends sign-in codes and invitation emails | European Union |
| Google (Analytics) | Measures use of nastar.dev only, and only after you accept analytics on this site. Not used for customer consent records. | Global |
Where data is stored
Nastar's application and database run in a single European Union region. Account data and consent records are stored there.
Two exceptions involve transfer outside the EU. Our content delivery network serves the consent SDK and your published configuration from edge locations worldwide — those files are public configuration, not personal data. And if you accept analytics on nastar.dev, Google Analytics may transfer data outside the EU under the European Commission's standard contractual clauses. Rejecting analytics avoids that transfer entirely.
How we protect data
- Everything travels over HTTPS.
- Sign-in codes, session tokens, automation tokens and IP addresses are stored only as keyed hashes — we cannot read the original values back.
- Sign-in codes are single-use, time-limited and attempt-limited.
- Access to an organisation's data is enforced on the server for every request, not in the browser.
- Automation tokens are scoped, shown once at creation, and stored hashed afterwards.
No service can promise perfect security, and this policy is not a certification or a statement of legal compliance. It describes the measures we actually implement.
How long we keep things
- Sign-in codes: 10 minutes, then deleted automatically.
- Sessions: 30 days, or until you sign out or revoke them.
- Invitations: 7 days.
- Automation tokens: 30 days by default, or until revoked.
- Consent records: 365 days from the moment each one is written.
- Abuse counters: 2 hours.
- Account, organisation and website configuration: until you delete them. Deleting an organisation also deletes its websites and their consent records.
Your rights
Under the GDPR you can ask us to give you a copy of your personal data, correct it, delete it, restrict how we use it, or object to our use of it where we rely on legitimate interest. You can also ask for your data in a portable format.
Write to [email protected] and we will respond within one month, as Article 12 requires. Much of this you can also do yourself: your account page lets you review and revoke active sessions, and deleting an organisation removes its data.
If your request concerns consent records collected on someone else's website, that website's owner is the controller and we will refer you to them — we cannot identify which records are yours, by design, because those records contain no identifying data.
If you are unhappy with how we have handled your data you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority where you live.
Children
Nastar is a tool for people who build and operate websites. It is not directed at children and we do not knowingly collect personal data from them.
Changes to this policy
When this policy changes we update the date at the top of the page. If a change materially affects how we handle your personal data, we will tell account holders by email before it takes effect.
Contact
Privacy questions and data requests: [email protected].
By post:
DXY Global B.V.
Kruisbaak 49
2165 AZ Lisserbroek
The Netherlands
This policy is governed by Dutch law. Nastar makes no claim of certification, and using Nastar does not by itself make your website legally compliant — your own cookie configuration, third-party services and privacy information still need review.