Dashboard
EN
Start free

Data Processing Addendum

Last updated: October 20, 2026

This addendum ("DPA") is part of the Terms of Service and applies automatically, without further signature, whenever the pages or results you fetch through FastAF may contain personal data protected by the GDPR or a similar law. It implements article 28 GDPR between you (the "Customer") and FastAF.

1. Roles

For personal data contained in content retrieved on your instructions, you are the controller and FastAF is your processor. You alone decide which targets to fetch, which queries to run and what the data is used for. FastAF executes those documented instructions, which consist of your API requests, and does nothing else with the data. For your account data (email, keys, usage records) FastAF is an independent controller, as described in the Privacy Policy.

2. Subject matter, duration, nature

Processing consists of retrieving the web content you designate, optionally rendering and parsing it, and transmitting it to you in real time. It lasts as long as your account exists. Categories of data subjects and of personal data are determined by the targets you choose and are under your control.

3. No storage

FastAF does not store, log, analyse or reuse the content returned by your requests. Responses are streamed to you and discarded. Because nothing is retained, "deletion at the end of the processing" is satisfied by design, and our ability to assist with data subject requests is limited to confirming that we hold no content. We keep only request metadata (endpoint, status, credits, duration) for 30 days, without URLs, queries or response bodies.

4. Your obligations

As controller, you warrant that:

  • you have a valid legal basis under article 6 GDPR (and, where relevant, article 9) for every instruction that involves personal data, and you have carried out any required assessment;
  • you provide data subjects with the information required by articles 13 and 14 GDPR, or you have documented an applicable exemption;
  • you honour data subject rights for the data you collect;
  • you will not instruct us to process special-category data, children's data or credentials, as prohibited by the Acceptable Use Policy;
  • your instructions comply with data protection law; if we believe an instruction infringes the law, we may refuse it.

You will indemnify us, as set out in section 10 of the terms, for claims, fines and costs arising from your failure to meet these obligations.

5. Our obligations

  • We process the data only on your documented instructions (your API requests) and for no other purpose.
  • Persons authorised to operate the service are bound by confidentiality.
  • We apply appropriate technical and organisational measures: TLS in transit, hashed API keys, access controls, minimal metadata logging with 30-day retention, and no storage of content.
  • We notify you without undue delay, and in any case within 48 hours, of a personal data breach affecting your data, so you can meet your own 72-hour obligation.
  • We assist you, to the extent reasonable for a no-storage service, with data subject requests, security, breach notification and impact assessments.
  • We make available the information reasonably necessary to demonstrate compliance, in the form of written answers to your questions and the certifications of our infrastructure providers. On-site audits are limited to cases required by law.

6. Sub-processors

You give a general authorisation for our sub-processors: Cloudflare (edge infrastructure and databases) and the specialised retrieval infrastructure providers that execute fetches. For commercial confidentiality we do not publish the identity of retrieval providers on the website; controllers who need it for their own compliance assessment can request the current sub-processor list at privacy@fastaf.co and will receive it under confidentiality. We will notify account emails at least 15 days before adding or replacing a sub-processor; if you object on reasonable data protection grounds, you may terminate. We remain responsible to you for our sub-processors' performance of this DPA.

7. International transfers

Where processing involves a country outside the EEA without an adequacy decision, transfers rely on the European Commission's Standard Contractual Clauses entered into with the relevant provider, supplemented where needed. Details are available with the sub-processor list.

8. Precedence

If this DPA conflicts with the terms, this DPA prevails for data protection matters. Liability under this DPA is subject to section 11 of the terms, except where the GDPR does not permit such a limitation.