Starase — Website Privacy Policy

Who we are

Starase Ltd. is registered in England and Wales.

Registered address: Flat 22 Winchat House, 2C Mary Neuner Road, London, N8 0FW, United Kingdom.

Contact: privacy@starase.com

What data this website collects

When you submit our contact form, we collect:

• Your name
• Your email address
• The topic you select (for example WordPress, Next.js, Starase Cloud, AI Tools, or a general inquiry)
• The message you write

Why we collect it, and our legal basis

We use this information solely to respond to your enquiry.

Our legal basis under UK GDPR is legitimate interests (Article 6(1)(f)) — specifically, our interest in responding to business enquiries submitted to us directly. We do not use contact form data for marketing without your separate, explicit consent.

Who we share it with

For this website's contact form specifically, we use Resend, Inc. to deliver your message to our inbox by email. Resend acts as our data processor for this purpose and only processes your data to deliver the message to us. Resend is based in the United States; where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or the UK Addendum, in accordance with UK GDPR.

More broadly, across Starase's hosting and platform services, our infrastructure subprocessors are:

• Contabo — infrastructure hosting — Germany
• Tiktalik — infrastructure hosting — Poland
• Cloudflare — DNS and DDoS protection only; no personal data stored — USA/EU

How long we keep it

This website does not store contact form submissions in a database. Once sent, your message exists as an email in our support inbox, and transiently within Resend's systems for delivery. We retain contact form emails for as long as reasonably necessary to handle your enquiry and any follow-up — typically no longer than 24 months.

Across Starase's wider services, our general retention schedule is:

• Account data: held for the lifetime of the account, and shortly after closure for administrative purposes
• Billing and tax records: retained for the period required by law, typically up to 6 years
• Logs and security data: retained for a short period, normally up to 6 months, unless needed longer for security or legal purposes
• Hosted content: retained while an account is active, and deleted once the account is terminated
• Marketing data: retained until consent is withdrawn

Cookies

This website does not use cookies or tracking scripts, and we do not run analytics or advertising trackers. No personal data is stored or tracked via cookies when you browse this site.

If this changes in the future — for example, if we introduce analytics — we will update this policy and, where required by law, ask for your consent first. See our Cookie Policy for details.

Security

This site is served over HTTPS, so your submission is encrypted in transit.

Across Starase's wider services: passwords are stored as salted, strong cryptographic hashes; all transmissions use TLS encryption; multi-factor authentication (MFA) is supported and encouraged; and staff access to systems is role-based, logged, and follows the principle of least privilege.

If a security incident is likely to affect your rights or freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay.

Your rights under UK GDPR

Under UK GDPR, you have the following rights. To exercise any of them, email privacy@starase.com. We do not use automated decision-making or profiling on this website.

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to data portability
• Right to object
• Rights related to automated decision-making and profiling

Data Processing Agreement (for hosting and platform customers)

If you are a customer of our hosting, email, or platform services, our Data Processing Agreement (DPA) governs how we process personal data on your behalf as a processor — you remain the controller of your hosted data. Under the DPA, we:

• Process customer data only on documented instructions from the controller
• Keep personnel who access data under confidentiality obligations
• Implement technical and organisational measures to protect data
• Assist with data subject rights requests, such as access, erasure, and portability
• Assist with security incident management and breach notification, within 48 hours where feasible
• Return or delete customer data on termination, unless retention is legally required
• Allow audits, subject to reasonable notice

International transfers

Where personal data is transferred outside the UK — for example to Resend in the United States, or under the DPA to other subprocessors — we ensure adequate safeguards are in place, such as adequacy decisions or Standard Contractual Clauses, in accordance with UK GDPR.

Children's privacy

This website is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact privacy@starase.com and we will delete it.

Complaints

If you have concerns about how we handle your data, contact us first at privacy@starase.com. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at www.ico.org.uk.

Changes to this policy

We may update this policy from time to time. The "Last updated" date above always reflects the most recent version.