Privacy Policy for DataFast

Effective Date: September 17, 2024

DataFast (https://datafa.st) values your privacy. This policy explains how we collect, use, and protect your information.

1. Information We Collect

• Personal Data: We collect email addresses when you sign up for a free trial or subscription. This data is used to manage your account, communicate with you, and provide access to our services.
• Non-Personal Data: We collect cookies and IP addresses through our script to track website usage and provide analytics services.

2. Use of Information

• Personal Data: Your email address is used for account management, service-related communications, and providing access to our platform.
• Non-Personal Data: Cookies and IP addresses are used to analyze website traffic, track visitor behavior, and provide business insights. This data is used solely for analytics purposes and to improve the user experience.

3. Public Reddit Data

DataFast may use Reddit's API to identify public Reddit posts or comments that mention a customer's own brand, product name, or verified website domain. This feature uses customer-provided brand and domain keywords to help customers understand traffic spikes, referral patterns, and online presence in their private analytics dashboard.

We only process public Reddit content for this purpose. Where Reddit content is shown, we may display limited context such as the post or comment title or excerpt, subreddit, timestamp, matched keyword, and permalink, and we link back to Reddit.

DataFast does not post, comment, vote, message Reddit users, or modify Reddit content. We do not sell raw Reddit data, provide bulk exports of Reddit data, train AI models on Reddit data, target ads with Reddit data, infer sensitive traits from Reddit data, or attempt to identify Reddit users off-platform.

We respect applicable deletion and removal requirements and will remove or stop displaying Reddit content where required. Customers can contact us to request deletion of their DataFast data.

4. Sharing of Data

We do not sell or trade your email address or other personal data. We share data as necessary to provide services (for example, with payment processors), when you explicitly authorize an integration, or to comply with legal obligations.

Connected apps and MCP

If you connect an app using OAuth, you choose which DataFast websites and permissions to share. The app can receive analytics and other records covered by those permissions. Custom event parameters, page paths, manual notes, alert templates, and team records may contain personal data recorded by you or your website.

The DataFast ChatGPT app limits responses to fields needed for the requested task. It omits internal account IDs, profile images, tracking IDs, note authors, and alert visitor IDs. Account name/email and team identity fields are available only when explicitly selected for a relevant request and authorized by the corresponding permission. Visitor-specific tools require additional permission and return anonymous activity without direct identifiers or arbitrary profile metadata; selecting individual visitors requires an explicit request and the visitor-details permission. The realtime map shares grouped approximate locations. ChatGPT excludes personal-identifier and credential custom-parameter value queries, removes URL query strings and fragments from results, and redacts recognized email addresses and credential patterns. User-authored text can still contain personal information that automated checks do not recognize.

The ChatGPT app cannot create or regenerate API keys, account access tokens, or bot-traffic credentials and does not return authentication secrets. Regular MCP integrations can generate a credential only through a separately authorized, explicitly confirmed credential-management action; the new secret is returned once. Stored credential values, hashes and integration secrets are not disclosed. We store authorization grants, hashed credentials, expiry and revocation records to operate these connections. Connections expire after at most 90 days unless you reconnect. Temporary write-retry results are retained for 24 hours. You can revoke a connection in Settings → API / MCP → Connected apps, which blocks subsequent requests and refreshes. Revocation does not remove data already received by the connected app; its own privacy policy and retention settings apply to that data.

For more details, please refer to our Data Processing Agreement.

5. Cookies

We use cookies to track website usage and improve your experience. These cookies collect non-personal data, such as visitor activity, for analytics. You are responsible for obtaining consent from your website visitors before collecting cookies, as required by GDPR. You can disable cookies in your browser settings, but doing so may limit your access to certain features.

6. Security

We take reasonable steps to protect your personal data, including email addresses, and non-personal data from unauthorized access, disclosure, or misuse. However, no method of transmission over the internet is 100% secure.

7. User Rights

You may request to access, modify, or delete your email address or other personal data at any time by contacting us at marc@datafa.st. Additionally, you can remove our tracking script or stop using our services to prevent further non-personal data collection.

8. Data Retention

If you do not subscribe after the free trial, all user analytics and collected non-personal data will be deleted a few days after the trial period ends. Your email address may be retained for future communication unless you request its deletion.

9. Updates to Privacy Policy

We may update this policy from time to time. You will be notified of any changes via email.

10. Governing Law

This Privacy Policy is governed by the laws of Singapore.