Contact and responsibility
The Star Karaokebar is operated by RB Bardrift AS, organisation number 932 397 625, which is the data controller for the processing described here. Venue address: Arbeidergata 2, 0159 Oslo. For privacy requests, call +47 406 27 525 or use the email contact on our information page. Please contact staff directly for access or deletion requests; do not send these through the AI assistant.
Booking and enquiries
We use your name, email, telephone number, party size, date, arrival time, table allocation and any notes to arrange your visit, verify your email and send confirmations or cancellation messages. Name, email and telephone are required; without them, an online reservation cannot be completed. This processing is necessary to handle your reservation or request (GDPR Article 6(1)(b)). Avoid sensitive information in notes.
Authorised staff can access bookings. A copy of booking messages goes to our booking mailbox. Email delivery uses ACK's relay and our mailbox service at Domeneshop. Booking information is not automatically used for advertising.
AI assistant
When you send a message, its text and recent conversation history are sent to OpenAI to generate a response. This is an optional service based on our legitimate interest in answering questions about the bar (Article 6(1)(f)); you can contact staff instead. Do not enter passwords, payment information, health information or other sensitive details. The assistant does not make decisions about your rights.
The application requests that responses are not stored by OpenAI. This does not remove the provider's separate security and abuse monitoring. Processing may occur outside the EEA; provider terms and safeguards apply. Our conversation display resets after 30 minutes of inactivity or when you select “Start new conversation”. This reset is not a guarantee of immediate removal from server sessions or backups.
Optional statistics
Where optional statistics are offered, Google Analytics only loads after you choose “Accept statistics”. “Decline statistics” is equally available, and the website works either way. The legal basis is your consent (Article 6(1)(a)). Where statistics are offered, you can withdraw consent through “Change statistics settings” at the bottom of the page. Withdrawal stops future collection; it does not erase information already collected.
Google receives technical visit information, including public page addresses, browser and device information and an online identifier. The connection also exposes your IP address to Google. We exclude query strings, booking details and chat messages from the page views we send. Advertising signals are disabled. User-level and event-level retention is set to two months, without extending it when you return. Standard aggregated reports are retained separately. Google may process data outside the EEA; see Google's privacy information.
Cookies and local storage
Necessary cookies support sessions and protect forms: sessionid has a one-hour browser lifetime and is set to expire when the browser closes; csrftoken protects against forged requests. The star_language cookie remembers a selected language for up to one year. The local statistics preference star_statistics_consent_v2 stores only your choice, version and expiry for 180 days. Analytics cookies beginning with _ga are only used after consent, with a configured lifetime of 180 days. Rejecting statistics removes these first-party Analytics cookies. Social-media links do not embed social-media tracking; the external site's rules apply when you follow a link.
Storage and your rights
Booking records, verification requests, email copies, technical logs and server sessions have separate storage locations. We retain booking information while needed to handle the visit, follow-up or a concrete dispute. A daily job removes names, email addresses, telephone numbers and notes from bookings and early-arrival requests 30 days after the visit. Associated message records in the booking system are cleared at the same time. Verification requests are deleted one day after expiry. Expired server sessions are deleted daily. Expired verification codes cannot be used, but expiry alone does not delete their associated data. New recovery database backups exclude guest bookings, contact details, message records, verification requests and server sessions; account identities and credentials are removed from the backup copy. Public website images and published event information are backed up separately. These recovery copies are retained without automatic expiry. Older restricted backups made before this change may still contain personal data; after recovery from an older copy, cleanup rules must be reapplied before use. Email copies in the separate mailbox and providers’ own logs are not deleted by the website’s cleanup job.
You can ask for access, correction, deletion, restriction or data portability where applicable, and object to processing based on legitimate interests. We normally respond within one month and may need to confirm your identity. You can complain to Datatilsynet. Access is limited by staff roles and protected by login and two-factor authentication. Hosting is provided by ACK.