Legal
Privacy policy
How Reedster LLC handles data about you, the person holding a Tastatur account.
Which document you want
This page
Data about account holders: your email address, your team, your billing. We are the controller of it.
Data collected from visitors to measured websites. The site owner is the controller of that; we are their processor. That is the page to link from your own privacy policy, and the page to send a visitor who asks.
1. Who we are
Reedster LLC operates this Tastatur instance and is the controller of the account data described below.
Contact for anything in this policy: [email protected].
2. What we hold about you
Email address
ContractRequired. It is your login and how we send confirmations, password resets and service notices.
Name
ContractOptional. Used to address you in the interface and in email.
Password
ContractStored only as a bcrypt hash. We cannot read it and cannot tell you what it is.
Sign-in metadata
Legitimate interestSign-in counts and timestamps, and a lock after repeated failures. Used only to secure the account.
Sign-in IP address
Legitimate interestThe IP of your two most recent sign-ins to this dashboard, so you can recognise a login that was not you. This is the one place we store an IP address against an identity, it applies to you as an account holder rather than to visitors of any measured site, and it is overwritten as you sign in again.
Team membership
ContractWhich accounts you belong to and your role in each.
Billing records
ContractOn the hosted service only, and held by our payment processor rather than by us. We store a customer reference, never card details.
Server logs
Legitimate interestStandard web logs, which include IP addresses, retained briefly for security and debugging.
That is the complete list. There is no profiling, no advertising, no tracking of you across other websites, and no automated decision-making with legal effect.
3. Cookies on this site
Tastatur's own dashboard sets a first-party session cookie when you sign in, and a second one if you ask to be remembered. If you switch on two-factor authentication and choose not to be asked for a code on a particular browser, that browser also gets a third — a random value, valid for thirty days, which matches a row you can delete from your account page at any time. All three are strictly necessary to keep you signed in and are exempt from consent requirements on that basis.
4. How long we keep it
Account data: for as long as your account exists. Delete the account and it goes, along with the sites and measurement data belonging to it.
Server logs: a short rolling window, measured in days.
Billing records: as long as tax and accounting law requires, which is typically several years and is not something we can shorten on request.
Measurement data: governed by the retention period you set on your account, enforced nightly. Default 12 months, and 25 months is the maximum we offer, which is the stated ceiling for audience-measurement data.
5. Who else sees it
We do not sell your data, we do not share it for anyone else's marketing, and we do not use it to train models.
On the hosted service, these third parties process data on our behalf:
Hosting provider
Runs the servers and the database.
Resend
Delivers transactional email: confirmations, password resets, service notices.
Stripe
Processes payments. Card details go to Stripe and never reach us.
Sentry
Receives error reports, which can incidentally include an IP address. Optional and disabled if unconfigured.
On a self-hosted instance there are none of these unless the operator configures them. The operator is the only party involved.
6. Your rights
Where the GDPR or UK GDPR applies you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interest. Where the CCPA applies you may request access and deletion, and may not be discriminated against for doing so.
Most of these you can exercise yourself, immediately, without asking us: your email and password are editable on the account page, and deleting a site erases its measurement data irreversibly.
For anything else, write to [email protected]. You also have the right to complain to your data protection authority.
7. International transfers
Self-hosted: your data stays wherever you run it, so there is no transfer. Hosted: the region is stated at signup, and any transfer outside it relies on the Standard Contractual Clauses.
8. Changes
If we change this policy in a way that materially affects you, we will email account holders rather than quietly editing the page and relying on you to notice.
Last updated July 30, 2026. See also the terms, the processor terms, and what the product collects from visitors.