Effective date: 14 September 2026
NASST uses one cookie. It keeps you signed in. There is no analytics, no advertising, no tracking, and nothing that follows you to other websites.
Because that cookie is strictly necessary to deliver a service you asked for, we do not need your consent for it under Regulation 6(4) of the Privacy and Electronic Communications Regulations 2003 — and so NASST does not show you a cookie banner.
| Name | nass_session |
|---|---|
| Purpose | Keeps you signed in between pages |
| Contains | A random token. No personal data, and nothing readable |
| Set when | You sign in |
| Expires | 7 days, or 12 hours after you stop using it |
| Type | First-party, strictly necessary |
| Flags | HttpOnly, SameSite=Lax, Secure over HTTPS |
HttpOnly means the cookie cannot be read by JavaScript, so a script injected into the page cannot steal your session. SameSite=Lax means it is not sent when another website makes a request to us, which blocks cross-site request forgery.
Blocking it will stop you signing in. There is no way to run an authenticated service without it.
Signing out deletes it immediately.
To be explicit, because most services this size do use these:
None. Loading NASST contacts no company other than us.
This was not always true, and the change is recent enough to be worth stating plainly. Until 2 September 2026, opening any page caused your browser to fetch styling, JavaScript libraries, spreadsheet export code and typefaces from four other companies:
| Service | What it provided | What it could see |
|---|---|---|
cdn.tailwindcss.com | Page styling | Your IP address, browser, and the fact you loaded NASST |
unpkg.com | JavaScript libraries | The same |
cdn.sheetjs.com | Spreadsheet export | The same |
fonts.googleapis.com / fonts.gstatic.com (Google) | Typefaces | The same |
They set no cookies and did not track you across sites, but each saw your IP address before you had agreed to anything, because that is unavoidable in any web request. All four files are now served from our own servers in Finland.
We told you about these when they existed, rather than only listing cookies. An IP address is personal data, and a notice that mentions only cookies while the page quietly contacts four other companies is not a complete answer. We are keeping the record here now that it is no longer the case, because a notice that silently drops what it used to admit is not a complete answer either.
You can check this rather than take our word for it: open your browser's network tools and load any page. Every request goes to nasst.co.uk or app.nasst.co.uk.
We intend to serve these files from our own servers, which removes the third-party request entirely. See §11 of the pack accompanying these documents.
These are contacted by our server, not your browser, so they never see your IP address:
| Service | Receives |
|---|---|
| Amazon Selling Partner API | Your instructions about your own account |
| Brevo (France) | Your email address, to deliver service emails |
| Keepa (Germany) | A product identifier, a category, deal search filters, and competing sellers' merchant IDs. Nothing that identifies you |
| UPCitemdb | A product name or barcode. Nothing that identifies you |
| SerpApi (US) | Only if you connect your own SerpApi account. A product name or search term, sent on your key and billed to you |
| Stripe (Ireland) | Your email and billing details, on their own hosted pages |
Full details are in the Sub-processor List (document 6).
Your browser can block or delete cookies — usually under Settings, Privacy. As above, blocking ours will prevent sign-in.
If you want to block the third-party requests in §4.4, a content blocker such as uBlock Origin will do it. Parts of the page may not display correctly.
If we add any cookie that is not strictly necessary, we will ask for your consent before setting it, and update this notice.
Questions: info@nasst.co.uk