Privacy Policy
Last updated: October 18, 2026
This policy explains what we do with personal data. FastAF is the controller. For anything in this policy, including requests about your rights, write to privacy@fastaf.co.
What we collect
- Account data. The email address you sign up with and the hashed form of your API keys. We never store a key in a form that lets us read it back.
- Payment data. Handled by Norpo as a separate controller for payment purposes. We receive a payment reference and confirmation when a purchase completes. We do not receive or store card numbers.
- Pay-per-call payments (x402). When you pay for a request over x402 without an account, the payer wallet address is part of the signed payment and is passed to the payment facilitator that settles it on the Base network, where the settlement is a public transaction. We do not store the wallet address: these requests are logged without any payer identifier.
- Usage data. For each API request we record the account (none for pay-per-call requests), the endpoint, the response status, the credits spent and the duration. We use it to bill correctly, to show you your usage and to find faults.
- Abuse prevention. At signup we process your IP address to rate limit and to block automated account farming, together with a Cloudflare Turnstile check. IP addresses are not attached to your ordinary API request records.
What we do not do
We do not store the content returned by your scraping requests. It is streamed back to you as it arrives and is not retained on our side. We do not sell personal data, we do not build advertising profiles, and the website carries no analytics or tracking cookies.
Why we are allowed to process it
Account and usage data are processed to perform our contract with you. Abuse prevention and service security rest on our legitimate interest in keeping the service available and not being defrauded. Where we ask for consent, for example for a newsletter, you can withdraw it at any time.
Who else touches the data
Cloudflare hosts the site, the API and the databases, and provides the bot protection. Norpo processes payments. Specialized retrieval infrastructure providers execute the fetches you request. These providers operate under data processing agreements and may process data outside your country, in which case transfers rely on the European Commission's standard contractual clauses or an adequacy decision. For commercial confidentiality we do not publish the identity of retrieval providers here; if you need the current sub-processor list for your own compliance assessment, request it at privacy@fastaf.co as described in the Data Processing Addendum. Pay-per-call payments over x402 are settled by a payment facilitator on the Base network, which receives the signed payment, including the payer wallet address.
How long we keep it
Account data is kept while your account exists and for the period we must keep records for tax and accounting purposes after it closes. Detailed per-request records are kept for 30 days; aggregated daily totals, which are not personal data on their own, are kept for billing history. Records relevant to an open complaint or legal claim may be preserved for its duration.
Your rights
If the GDPR or a similar law applies to you, you can request access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to privacy@fastaf.co and we will answer within one month. You also have the right to complain to your local data protection authority.
Data you collect through us
When you use FastAF to fetch data that includes personal data, you act as controller and we process it on your instructions as described in the Data Processing Addendum. You remain responsible for lawfully obtaining and processing that data, including compliance with consent, legal basis, purpose limitations and the rights of data subjects. We do not control, store or onward-share the content of your requests; our role is limited to technical retrieval and immediate delivery.
Children
The service is not directed at children under 16 and we do not knowingly collect data from them. If you become aware that a child has created an account, notify us and we will delete it.
Changes
We may update this policy to reflect changes to law or practice. Material changes will be announced on the website or by email. Continued use after a change means acceptance.