Privacy policy — Stardust Staking

OVERVIEW

This Privacy Policy describes how your personal information is collected, used, and shared when you visit starduststaking.com (the “SITE”). It informs you of our policies regarding the collection, use, and disclosure of personal data when you use our SITE.

For information about what Stardust Staking does and does not do as a business — including the fact that we are a non-custodial validator infrastructure provider and do not hold client crypto-assets — please see our Legal & Disclaimer page.

DEFINITIONS

SERVICE

The starduststaking.com website and related server infrastructure operated by Stardust Staking.

PERSONAL DATA

Data relating to a living individual who can be identified from those data (or from those and other information either in our possession or likely to come into our possession).

USAGE DATA

Data collected automatically either generated by the use of the SERVICE or from the SERVICE infrastructure itself (for example, the duration of a page visit).

COOKIES

Small pieces of data stored on your device (computer or mobile device). This SITE does not set any — see TRACKING & COOKIES DATA below.

DATA CONTROLLER

The natural or legal person who (either alone or jointly with others) determines the purposes for which and the manner in which personal information is processed. For the purpose of this Privacy Policy, Stardust Staking and Solutions OÜ (trading as Stardust Staking) is the Data Controller of your Personal Data. You can contact us at [email protected] or by post at Narva mnt 7a, Tallinn, 15172, Estonia.

DATA PROCESSORS (OR SERVICE PROVIDERS)

Any natural or legal person who processes the data on behalf of the DATA CONTROLLER. We may use the services of Service Providers in order to process your data more effectively (for example, hosting and email delivery).

DATA SUBJECT (OR USER)

Any living individual who is using our SERVICE and is the subject of Personal Data.

PERSONAL INFORMATION WE COLLECT

This section is scoped: what we collect when you browse this website is described first, and it is different from — and does not apply to — what happens when you use our RPC endpoints, which is described separately below.

When you browse this website

When you visit the SITE, our web server automatically processes limited technical information about each request: your IP address, your browser type and version (the user-agent string), the pages you request, the referring page your browser reports, and date and time stamps. This website is served through Cloudflare, which processes your requests and connection data, including your IP address, to deliver and protect it. On our own server, this information appears only in short-lived logs used for security and debugging. That is the whole list of technical request data. The SITE sets no cookies and loads no third-party scripts. Its only browser storage is the light/dark theme preference described below, which is not sent to our servers. We do not track how you interact with pages, build profiles of visitors, or share anything about your visit with analytics or advertising services.

If you contact us by email or via a linked messaging channel, we may also process the contents of your message and any contact details you choose to share with us (such as your email address and your name).

When you use our RPC endpoints

The website statements above do not describe our RPC endpoints. When you use our public Zcash RPC endpoints, we process the connection information and request contents needed to answer you. These can include a connecting IP address, transparent addresses queried and already-signed transactions submitted for relay. You do not need to register an account or provide your name.

We keep as little of this as we can. Routine request logging is switched off on our Zcash RPC servers, so we do not keep a routine record of the IP addresses that connect or of their individual requests. The exceptions are security and diagnostic records: error logs of failed connections and firewall records of blocked packets may contain IP addresses, timestamps and technical event details, and are kept for at most 14 days. We use necessary technical information to operate and secure the service, relying on our legitimate interests under Article 6(1)(f) GDPR. Our retention periods are explained in the Data retention section.

Some of our Zcash endpoints are served through Cloudflare, which processes requests and connection information, including the address connecting to it. On those endpoints the address that connects to our servers is Cloudflare’s, not yours; Cloudflare passes your address along in a request header, which our servers neither log nor pass on. The others are served directly by our servers, which receive your IP address themselves, so the security and diagnostic records described above may contain it. Assume that either may apply to the endpoint you use. Where a wallet connects through an intermediary, the connecting address may be that intermediary’s address.

Our service providers and applicable international-transfer arrangements are described below.

We retain only aggregate operational metrics, such as per-host request counts by method and response-status class, which are not linked to any IP address, wallet address or on-chain identity, and which we do not sell. For any other RPC endpoint, we process only the minimum technical data needed to operate and secure the service and never link it to wallet addresses or on-chain identities.

We do not collect or process payment information through this SITE. We do not operate user accounts on this SITE.

TRACKING & COOKIES DATA

The SITE sets no cookies at all — first-party or third-party — and uses no tracking pixels or fingerprinting techniques. It loads no third-party analytics, advertising, or tracking scripts, and no external scripts, fonts, or embedded content of any kind, so no third-party service can observe your visit through our pages.

When you use the theme switch, we save only your light/dark choice in local storage on your device. This preference is not sent to our servers or third parties and contains no identifier. It stays until you change it or clear this SITE’s browser storage. Before you choose, the SITE follows your device’s color-scheme setting without saving a preference.

If we introduce cookies or other storage technologies beyond this display preference, we will update this notice first and, for anything that is not strictly necessary, seek your prior consent in accordance with the EU ePrivacy rules and applicable national law.

HOW WE USE YOUR PERSONAL INFORMATION, AND WHY WE MAY

Each purpose, with the legal basis we rely on under the GDPR:

Serving this website and our RPC endpoints: the technical data needed to answer each request. Basis: our legitimate interest in providing the services you request (Article 6(1)(f)).
Security and diagnostics: server error logs and firewall records. Basis: our legitimate interest in keeping our services secure and available (Article 6(1)(f)).
Responding to enquiries: your message and the contact details you give us. Basis: our legitimate interest in answering you (Article 6(1)(f)), or, where you personally ask us to take steps before entering into a contract with you, Article 6(1)(b).
Customers: where you are our customer, the data needed to perform your contract (Article 6(1)(b)). Where you are a contact person at a business customer, our legitimate interest in managing that relationship (Article 6(1)(f)).
Legal claims: records needed to establish, exercise or defend legal claims. Basis: our legitimate interest in protecting our legal position (Article 6(1)(f)).
Legal obligations: data we must keep or disclose by law, including accounting records. Basis: legal obligation (Article 6(1)(c)).

Where we rely on legitimate interests, you can object at any time (see Your rights). Aggregate metrics that identify no one are not personal data.

We share your Personal Information only where necessary for the purposes described above. The providers who process personal data on our behalf are:

Cloudflare: content delivery network for this website and some of our RPC endpoints, operating worldwide.
Hosting providers: for this website, in Germany; for our RPC servers, in France, Canada, the United States and South Korea. Their staff may have physical or administrative access to our servers for maintenance and support.
Email: our mailbox provider, in Ireland.

We give the name of each provider on request. We do not sell your Personal Information.

We may share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request for information, or to otherwise protect our rights. We may disclose your Personal Data in good faith where such action is necessary to:

Comply with a legal obligation.
Protect and defend the rights or property of Stardust Staking.
Prevent or investigate possible wrongdoing in connection with the SERVICE.
Protect the personal safety of users of the SERVICE or the public.
Protect against legal liability.

YOUR RIGHTS

Under the GDPR, and subject to its conditions and exceptions, you have the right to:

access the personal data we hold about you, including who has received it;
have inaccurate or incomplete data corrected;
have your data deleted;
restrict our processing of it;
object to processing based on our legitimate interests;
receive your data in a portable format, where processing is based on consent or a contract and is automated;
withdraw consent at any time, where we rely on it;
complain to a data protection authority. In Estonia, that is the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate).

These rights apply whatever your country of residence. To use them, write to [email protected]. If we have reasonable doubts about your identity, we may ask for the information needed to confirm it.

We do not carry out automated decision-making or profiling within the meaning of Article 22 GDPR.

DATA RETENTION

Security and diagnostic records: at most 14 days. Faults and abuse are normally investigated within that time, so we keep the records no longer.
Enquiries: for as long as needed to handle your enquiry and any follow-up.
Contract records not subject to a longer statutory retention requirement: for the contract term and afterwards as long as needed to establish, exercise or defend legal claims, taking account of applicable limitation rules.
Accounting records, including contracts required for accounting purposes: seven years from the end of the relevant financial year. Documents concerning long-term rights or liabilities: seven years after their validity expires.

SECURITY

We safeguard the security of your personal information with industry-standard physical, electronic, and managerial procedures. The transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to or through our SERVICE. Any transmission of personal information is at your own risk.

MINORS

The SITE is not intended for individuals under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we take steps to remove that information from our servers.

INTERNATIONAL TRANSFER OF DATA

Some processing takes place outside the European Economic Area:

Cloudflare, the content delivery network for this website and some of our RPC endpoints, processes requests and connection data in data centres worldwide. Transfers to Cloudflare, Inc. in the United States rely on its certification under the EU-US Data Privacy Framework. Other transfers and onward processing are governed by Cloudflare’s Data Processing Addendum, including applicable Standard Contractual Clauses and onward-transfer safeguards (cloudflare.com/cloudflare-customer-dpa).
Canada: part of our Zcash RPC fleet is hosted in Canada. The European Commission recognises Canada as providing adequate protection for data subject to Canada’s commercial privacy law.
United States: part of our Zcash RPC fleet is hosted in the United States.
South Korea: part of our Zcash RPC fleet is hosted in South Korea.

Which country handles a request depends on the endpoint you use and on load balancing.

We give the name of each hosting provider on request from [email protected].

CHANGES

We may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons.

CONTACT US

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e-mail at [email protected].