A printed spreadsheet folded once on dark slate, a pencil across it, and beside it a phone showing the same rows as an app list with coloured status dots. — Nothing sold. Nothing tracked. One cookie.

possessive yours, held by us

and what we hold that is yours, read straight off the program that keeps it:

This is the privacy notice for this website, its brief form and its client rooms, under the UK GDPR and the Data Protection Act 2018. It was written by going through the program that runs the site, so every kind of item that program stores is named below, with how long it lasts and how it goes.

Version of 13 November 2026

No analytics, no advertising nothing about your visit is collected to study or sell
One cookie only when you sign in, only to keep you signed in
Deleted on request a brief by its reference, a room by one button inside it
A copy whenever you ask one download inside your client room

subject who is responsible

who holds it, and answers for it:

The controller of everything on this page is VISTARA SOFTWARE LTD, a private limited company registered in England and Wales, company number 17431091. Its registered office is Office 1880 60 Tottenham Court Road, Fitzrovia LONDON, W1T 2EW United Kingdom.

Questions about your data, and every request below, go to contact@vistarasoftware.site, ideally with a subject line starting “Your data”. We have not appointed a data protection officer: the law does not require one for a company of our size doing this work, so these questions are answered by the company’s directors.

list every kind of item kept

every kind of item the site keeps, and for how long:

The site’s program stores items in one key-value store at Cloudflare. Each row is one kind of item, named the way the program names it, so that nothing kept is left out of this list.

Items the site stores: what is in each, why, the lawful basis, how long it is kept and how it is removed
Item	What is in it	Why, and the lawful basis	How long, and how it goes
A brief sent while signed out `brief:` + its reference	Your sentence and the answers you chose, any name, business name and email you gave, the tick that asks us to keep it, and the time it was sent. Not your IP address.	To read the brief and reply. Consent, given with the tick box (UK GDPR Article 6(1)(a)).	180 days, then the store deletes it by itself. Sooner if you ask, quoting the reference, or withdraw your consent.
Your client room `vsu:who:` + a random room number	Your name and email; a business name, phone number and good time to call if you add them; your password as a salted PBKDF2-SHA256 hash, never the password; when the room was opened and when you asked us to keep it; the references of your briefs; the list of browsers signed in; any password-reset link waiting.	To give you the room you asked for. Contract: providing the service you asked for (Article 6(1)(b)).	Until you delete the room. Delete my room, inside it, removes it at once; or write from its address and we do it for you.
The sign-in lookup `vsu:mail:` + a one-way hash of your email	The room number your email belongs to. The email itself appears only as a one-way hash in the item’s name.	To find your room when you sign in. Contract (6(1)(b)).	As long as the room. Replaced when you change the room’s email, deleted with the room.
A signed-in browser `vsu:sess:` + room number + a hash of its token	When it signed in, a few words for the kind of browser and system it announced (such as a browser’s name on a phone’s system, never the full header) and a password version number. The token itself is only in your cookie.	To keep you signed in, and to let you see where you are signed in and end it. Contract (6(1)(b)).	30 days, then deleted by itself. Ended sooner by signing out, by signing it out from another browser, or by deleting the room; a password change refuses it at once.
A brief filed in your room `vsu:brief:` + room number + reference	Everything you typed with it and when, what you added to it, your notes on it with their times, and the stage it has reached with when it moved.	It is what the room is for. Contract (6(1)(b)).	Until you delete the room. To remove one brief and keep the room, write to us quoting its reference.
A password-reset link waiting `vsu:reset:` + room number + a hash of its token	When it was asked for. The link itself is only in the email it is sent in.	To let you set a new password. Contract (6(1)(b)).	One hour, or until it is used, whichever comes first.
Mail to and from us	Messages you send to contact@vistarasoftware.site and our replies; a copy of each brief and room note, which the site emails to our mailbox as it is sent.	To answer you, and where it turns into work, to do it. Legitimate interests in answering people who write to us (6(1)(f)), then contract.	Deleted when the conversation ends if it does not turn into work. If it does, kept for six years after the work ends, the time in which a claim about it could be brought (Limitation Act 1980).

adverb briefly, and never kept

and what passes through without being kept:

Some things are used for a moment to make the site work or keep robots out, and are not kept by us at all.

Form stamps: When a form is served, a hidden field carries the time it was opened, signed so that it cannot be altered. When the form comes back the stamp is checked, so that a form sent in under three seconds or after two hours is asked for again, and thrown away. It says nothing about you.
Rate limits: Signing in, opening a room, asking for a reset and sending a form are limited for a minute at a time against a one-way hash of your IP address, and for sign-in and resets of the email typed. The count lives in Cloudflare’s rate limiting for that minute and nothing about it is stored. Legitimate interests in keeping the forms working for people (6(1)(f)).
Delivering each page: Like every website, this one cannot reach you without your IP address and the details your browser sends with each request. Cloudflare, which runs the site, handles them to deliver pages and protect the site from abuse. For requests that reach the site’s program, rather than a plain page, Cloudflare keeps diagnostics, including those details, for three days, and we can read them only to find faults. Legitimate interests in a site that works and stays safe (6(1)(f)).

agent who processes it for us

Who else touches it

Cloudflare, Inc. hosts this website, runs its program, stores the items above and carries its mail. It acts as our processor under its data processing terms, which every Cloudflare customer’s agreement includes.

Our mailbox provider holds the mail described above, as our processor.

Nobody else. Nothing is sold, shared for marketing, added to a mailing list or used for advertising. The site has no analytics, no tracking pixels and no embedded content from other companies; its font is served from this site.

place outside the UK

Where in the world

Cloudflare runs one network across many countries, so items may be stored or handled outside the United Kingdom, including in the United States. Its data processing terms cover those transfers with the safeguards UK law asks for: the International Data Transfer Addendum to the standard contractual clauses, and where it applies, the UK extension to the EU–US Data Privacy Framework.

singular the one cookie

Cookies: there is exactly one.

Cookies this site sets
Name	What it does	How long it lasts	Consent
`__Host-vsu_clause`	Set when you open a client room or sign in, it keeps you signed in. It holds your room number and a random token, of which we keep only a hash. It is sent only to this site, over an encrypted connection, and scripts on the page cannot read it.	30 days, or until you sign out. Signing out, or deleting the room, clears it.	Not asked for: it is strictly necessary for the client room you asked for, which the Privacy and Electronic Communications Regulations allow without consent.

There are no other cookies, nothing in your browser’s local storage, and no analytics or advertising tags, so there is no cookie banner: it would ask you to agree to something that does not happen. If you never sign in, the site sets nothing at all.

imperative what you can tell us to do

your rights, and the quickest way to use each:

See what we holdInside your client room, Download my data gives you everything held about the room at once. For a brief sent while signed out, or our mail, write to us.
Have it correctedChange your details yourself in the room, or tell us what is wrong.
Have it deletedDelete my room removes the room and everything in it. A signed-out brief is deleted when you ask, quoting its reference.
Take a copy elsewhereThe download is a JSON file another service can read.
Object, or limit what we doWhere we rely on legitimate interests, you can object, and we stop unless we must keep it to deal with a legal claim.
Withdraw consentFor a brief sent while signed out, at any time, by email. It is then deleted.

Write to contact@vistarasoftware.site, from the address the brief or the room uses if you can, so that we know it is you; otherwise we may ask you to show it is. We answer within one month, and tell you within that month if a complicated request needs up to two more.

No decision about you is made by a machine alone, and no profile of you is built. This site is meant for businesses and adults; we do not knowingly hold data about children.

If you are not happy with how we handle it

Tell us first, if you are willing to, through our complaints policy: we would rather put it right. You also have the right to complain to the Information Commissioner’s Office, the UK’s regulator for data protection, at any time, at ico.org.uk/make-a-complaint.

When this notice changes, the version date at the top changes with it, and anything that changes what happens to data you have already given us is told to you by email first.