Legal
Last updated 12 October 2026.
This policy explains which personal data Masthead collects, why, who receives it and what you can do about it. It covers masthead.site, the Masthead dashboard and the sites Masthead hosts.
Masthead is provided by Dijkstra Software, a sole proprietorship registered in the Netherlands with the Chamber of Commerce (KvK) under number 97259993. We are the controller for the personal data described here. For any privacy question or request, email hello@masthead.site.
| Data | Purpose | Legal basis |
|---|---|---|
| Account: email address, a hashed password (never the password itself), or your Google or GitHub account identifier when you sign in with one | Creating your account and signing you in | Contract |
| Your sites: content, uploads, settings, themes and collaborators | Hosting and publishing your sites | Contract |
| Billing: plan, status, period end, and Stripe customer and subscription identifiers. Card details go to Stripe and never reach us. | Selling and managing site licenses | Contract, and legal obligations for tax records |
| Account email: confirmation, password reset and security messages | Running your account | Contract |
| Product email: tips and updates to people who created a site. Every message has an unsubscribe link, and you can switch it off in your account settings. | Helping you get started and telling you about Masthead | Legitimate interest |
| Signup source: the campaign tags in the link you arrived through, whether it came from an ad click, the first page you visited, the referring website's domain and the time of that first visit. Never your IP address or the ad click identifier itself. | Learning which channels bring people who use Masthead | Legitimate interest |
| Usage: the days on which you did something in the dashboard (such as writing, publishing or changing settings), and when you first published | Understanding activation and retention, in aggregate | Legitimate interest |
| Support chat: the messages you send and any email address you give | Answering your questions | Contract or legitimate interest |
| Google Analytics and Google Ads measurement | Measuring visits and which ads lead to signups | Consent (see Cookies) |
Sites on Masthead count page views and daily unique visitors without cookies. To count a visitor once per day, we combine a secret key, the date, the site, the visitor's IP address and browser identifier into a one-way hash. The IP address and browser identifier are never stored, the hash changes every day so visits on different days can't be linked, and the hashes are deleted after a day. Only daily totals are kept, for one year. Known bots are not counted.
The owner of a site decides what it publishes and is responsible for any personal data in its content and forms. For that data, Masthead processes it on the site owner's behalf.
We use these service providers, each only for the purpose listed:
Some of these providers are based in, or process data in, the United States. Where data leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. We don't sell personal data.
Masthead uses a few cookies of its own that the service needs, and Google's cookies only if you accept them in the cookie banner.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
_masthead_key |
Masthead | Keeps you signed in and protects forms. Essential. | Session |
_mh_attr |
Masthead | Remembers how you first arrived, for the signup source above. First-party, never shared, no IP address. | 30 days, removed at signup |
masthead_no_track |
Masthead | Keeps a site's own members out of its visitor statistics | 7 days |
cw_conversation and similar |
Chatwoot | Keeps your support conversation open between pages | Set by Chatwoot |
_ga, _ga_* |
Google Analytics | Counts visits and how people use the site. Only with your consent. | Up to 2 years |
_gcl_* |
Google Ads | Links signups to ad clicks. Only with your consent. | Up to 90 days |
Your cookie choice is stored in your browser's local storage. If you decline, Google may still receive cookieless signals, such as that a page was viewed or that a signup happened, without any cookie or identifier on your device; Google uses these only for aggregate measurement.
You can ask for a copy of your personal data, have it corrected or deleted, restrict or object to its use, receive it in a portable format, and withdraw consent at any time. Email hello@masthead.site; we answer within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the authority where you live.
You must be at least 16 to create a Masthead account.
When this policy changes, the date at the top changes too. We email account holders about significant changes before they take effect.