Privacy policy

Last updated: 6 July 2026

VasteLast helps you understand your monthly fixed expenses. We collect as little personal data as possible: no ads, no selling of data, no profiling. This page explains what we process, why, and which rights you have under the General Data Protection Regulation (GDPR).

Who is responsible?

VasteLast is operated by Valorsis, the controller for the processing described on this page. You can reach us via valorsis.nl.

What data we process

• As a guest: your household type and the income and expense entries you add (description, category, provider, amount, period). This data is linked to a random token in a cookie on your device - we do not know who you are.
• With an account: your email address and a securely hashed password, plus the household data above. We also store session details (IP address and browser type) to secure your login.
• With your consent: anonymous usage statistics via Matomo (pages visited, browser type, approximate location). We never use this for advertising.

Why we process it and on which legal basis

• To run the calculator and show your report - necessary to provide the service you request (performance of a contract, art. 6(1)(b) GDPR).
• To save your results and email you password resets - performance of a contract (art. 6(1)(b) GDPR).
• To secure logins and prevent abuse (rate limiting, session records) - legitimate interest (art. 6(1)(f) GDPR).
• To measure how the site is used - only with your consent (art. 6(1)(a) GDPR), which you can withdraw at any time.

How long we keep your data

• Guest data is deleted automatically after 30 days of inactivity.
• Account data is kept until you delete your account. Deleting your account removes all your data immediately.
• Analytics data is only kept as anonymous, aggregated statistics.

Sharing your data

We do not sell or rent your data to anyone. Your data is only processed on the technical infrastructure needed to run the site (hosting, database, analytics), within the European Economic Area.

Your rights

Under the GDPR you have the right to access, rectify, erase and receive (data portability) your personal data, to restrict or object to processing, and to withdraw consent at any time. You can also lodge a complaint with your data protection authority - in the Netherlands the Autoriteit Persoonsgegevens.

Security

All traffic is encrypted (HTTPS), passwords are stored as secure hashes and cookies are signed against tampering.

Delete your data

There is currently no data stored for you.

Changes to this policy

We may update this policy from time to time. The latest version always applies and is published on this page.

Questions or requests about your data? Get in touch via valorsis.nl.