GDPR Compliance
Last updated: April 2, 2026
PasteBase is committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Danish Data Protection Act (Databeskyttelsesloven, Act No. 502 of 23 May 2018). This page explains how we comply with GDPR and outlines your rights as a data subject.
1. Data controller
The data controller responsible for processing your personal data is:
Nullbase ApS
Rougsøvej 1, 8940 Randers SV, Denmark
CVR/VAT: DK37283681
Phone: +45 70 60 60 02
Email: info@nullbase.eu
Website: nullbase.eu
Privacy inquiries: support@pastebase.eu
2. Data we process and legal bases
Under Article 6 of the GDPR, we process personal data only when we have a lawful basis. The table below summarises each processing activity, the data involved, and its legal basis.
| Processing activity | Personal data | Legal basis |
|---|---|---|
| Account registration and authentication | Email address, name, hashed password | Performance of contract — Art. 6(1)(b) |
| Email verification | Email address, verification token | Performance of contract — Art. 6(1)(b) |
| Storing paste content | Paste title, content, category, timestamps | Performance of contract — Art. 6(1)(b) |
| Team management and invitations | Email address of invitee, role, team membership | Performance of contract — Art. 6(1)(b) |
| Copy activity logging | User ID, paste ID, timestamp | Legitimate interest — Art. 6(1)(f) |
| Transactional emails (via Resend) | Email address, email content | Performance of contract — Art. 6(1)(b) |
| Session and CSRF cookies | Session identifier, CSRF token | Performance of contract — Art. 6(1)(b) |
| Preference cookies (theme, sorting, filters) | UI preferences | Consent — Art. 6(1)(a) |
For processing based on legitimate interest (Art. 6(1)(f)), we have assessed that these activities are low-impact, directly related to the service you use, and do not override your fundamental rights. Copy logs provide you with usage statistics within your own dashboard and are not shared with third parties.
3. Your rights as a data subject
Under GDPR Articles 15–22, you have the following rights. We will respond to any request within one calendar month (Article 12(3)), extendable by two months for complex requests with prior notification.
Right of access (Article 15)
You have the right to obtain confirmation of whether we process your personal data and to receive a copy of that data. You can view your data within the app at any time, or request a full copy by contacting us.
Right to rectification (Article 16)
You can correct your personal data (name, email, display name) at any time from your Profile Settings within the app.
Right to erasure (Article 17)
You have the right to request deletion of your personal data. You can delete your account from your Profile Settings, which permanently removes your personal data, paste content, team memberships, and activity logs. Pastes contributed to shared teams will be anonymised (author attribution removed).
Right to restriction of processing (Article 18)
You may request restriction of processing in certain circumstances, such as while we verify the accuracy of your data or assess an objection you have raised. Contact us to make this request.
Right to data portability (Article 20)
You have the right to receive your personal data in a structured, commonly used, machine-readable format. You can export your paste content from the app, or contact us to receive a complete data export.
Right to object (Article 21)
You may object to processing based on legitimate interest (such as copy activity logging). We will cease processing unless we demonstrate compelling legitimate grounds. Contact us to exercise this right.
Right to withdraw consent (Article 7(3))
Where processing relies on your consent (e.g., preference cookies), you may withdraw consent at any time from your Profile Settings under Cookie Preferences. Withdrawal does not affect the lawfulness of processing performed before withdrawal.
Automated decision-making (Article 22)
We do not engage in automated decision-making or profiling that produces legal effects or similarly significant effects concerning you.
How to exercise your rights
For any request, email us at support@pastebase.eu. We may verify your identity before processing your request. All requests are handled free of charge unless manifestly unfounded or excessive (Article 12(5)).
4. Data retention
We retain personal data only for as long as necessary for the purposes described above.
| Data category | Retention period |
|---|---|
| Account data (email, profile) | Until account deletion + 30 days |
| Paste content | Until deleted by you or account closed |
| Copy activity logs | Lifetime of account |
| Email verification tokens | Until verified |
| Invitation records | 3 days (auto-expire) |
| Password reset tokens | Until used or expired |
5. Data hosting and transfers
PasteBase is 100% hosted within the European Union. Our servers and database are located in the EU. Your paste content and account data never leave the EU.
Third-party processors
We use a limited number of third-party services to operate PasteBase. Each processor has been assessed for GDPR compliance.
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| Resend | Transactional email delivery | Email address, email content | EU-US Data Privacy Framework |
| Google Fonts | Web font delivery | IP address, user agent | EU-US Data Privacy Framework |
| jsDelivr | CSS framework delivery | IP address, user agent | EU-based (Prospect One, Poland) |
| Hetzner | Server and database hosting | All data stored in the service | Germany (EU) |
For transfers to the United States, we rely on the EU-US Data Privacy Framework adequacy decision (European Commission, July 2023). We have verified that our US-based processors are certified under the framework.
We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.
6. Cookies
We use a minimal set of first-party cookies. No advertising or tracking cookies are used. Under the ePrivacy Directive as implemented in Denmark, strictly necessary and functional cookies do not require prior consent.
For a full list of cookies and how to manage them, see our Privacy Policy.
7. Data security (Article 32)
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption — all connections secured with TLS/HTTPS, enforced via HSTS
- Password security — passwords hashed using PBKDF2 with SHA-256 (never stored in plain text)
- Session security — HttpOnly, Secure, and SameSite flags on all cookies
- CSRF protection — on all state-changing requests
- Access controls — role-based team permissions (Owner, Editor, Member)
- Email verification — required before account access
- Secure tokens — cryptographically generated tokens for verification, invitations, and access links
- EU-only hosting — database and application servers within the EU
8. Data breach notification (Articles 33–34)
In the event of a personal data breach:
- We will notify Datatilsynet (the Danish Data Protection Authority) within 72 hours of becoming aware of the breach, as required by Article 33, unless the breach is unlikely to result in a risk to your rights and freedoms.
- If the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay, as required by Article 34.
- We maintain an internal breach register in accordance with Article 33(5).
9. Children's data (Article 8)
Under GDPR Article 8 and Danish law (Databeskyttelsesloven § 6), the age of digital consent in Denmark is 16 years. PasteBase is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16 without verifiable parental consent.
If you believe a child under 16 has registered without parental consent, contact us at support@pastebase.eu and we will promptly delete their account and associated data.
10. Data processing for teams
If you use PasteBase as part of your business operations and store personal data of third parties within paste content (e.g., email templates containing names or contact details), you act as the data controller for that content and PasteBase acts as a data processor under Article 28.
Our Terms of Service include data processing provisions. You can download our full Data Processing Agreement (DPA) for your records, or contact us at support@pastebase.eu for a standalone signed copy.
11. Supervisory authority
You have the right to lodge a complaint with the Danish Data Protection Authority at any time if you believe your personal data is being processed in violation of GDPR:
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby, Denmark
Telephone: +45 33 19 32 00
Email: dt@datatilsynet.dk
Website: datatilsynet.dk
We would appreciate the opportunity to address your concerns first — please contact us at support@pastebase.eu before filing a complaint. However, your right to lodge a complaint directly with Datatilsynet is unconditional.
12. Changes to this page
We may update this GDPR compliance information from time to time. Material changes will be communicated via email or a notice within the app. The "last updated" date at the top reflects the most recent revision.
13. Contact
For any GDPR-related questions or to exercise your data subject rights:
Email: support@pastebase.eu