Legal

Privacy Policy

Effective date: 2025-01-01

Last updated: October 1, 2026

1. Data Controller Information

Data Controller:

Organization Number:

Address:

Contact: contact@fastsocial.co

Phone:

Website: fastsocial.co

FastSocial ("we", "us", "our") operates fastsocial.co and provides social growth subscriptions. This policy explains what we collect, how we use it, and the limited circumstances in which we share it.

2. Data Collection

We collect the following personal information:

Account Details: Social media usernames, handles, and URLs (no passwords required) needed to deliver the service.
Contact Information: Email addresses and phone numbers for receipts, order confirmations, support, and service notifications.
Payment Information: Billing status and transaction data from our payment processor. For each payment we keep the last 4 digits of the card and the card type (for example, whether it was paid through Apple Pay or Google Pay), so we can match a payment when you ask us to find your order. We never store full card numbers, expiry dates or security codes. Payment processing is handled securely by third-party providers.
Order History: Service preferences, subscription details, delivery history, and account management information.
Website Usage Data: IP addresses, device information, browser type, pages viewed, and interaction data collected through cookies and analytics tools for security, performance monitoring, and marketing optimization.
Support Communications: Records of customer support inquiries, emails, and communications.
Public Instagram data from lookups: When our tools, checkout, delivery or Instagram Data API look up a public Instagram account, we log what data was pulled and the result, but we never store who pulled it. We work with data, and data pulled by others helps our operations. See Section 17.
Account checks on the manage page: Information you give us to prove an order is yours, as described in Section 16.
Email link clicks: Which email and which link was clicked, as described in Section 4.

3. Data Usage and Legal Basis

Your personal data is processed for the following purposes and legal bases:

Service Delivery: To provide the social media growth services you ordered, including managing your subscription, processing payments, and delivering followers/engagement. (Legal Basis: Contract Performance)
Communication: To send order confirmations, payment receipts, support responses, service updates, and subscription renewal notices. (Legal Basis: Contract Performance)
Customer Support: To respond to inquiries, resolve issues, and provide account management assistance. (Legal Basis: Contract Performance)
Emails to customers: If you buy from us, we may email you about your order and about similar services. Every such email has an unsubscribe link, and you can opt out at any time. (Legal Basis: Legitimate Interest)
Marketing and Analytics: To measure our site, our emails and our advertising, using the tools listed in Section 4. (Legal Basis: Legitimate Interest)
Legal Compliance: To comply with tax, accounting, and business registration requirements, including maintaining records for accounting purposes. (Legal Basis: Legal Obligation)
Fraud Prevention and Security: To detect and prevent fraudulent transactions, unauthorized access, and security threats. (Legal Basis: Legitimate Interest)

4. Tracking for Ads and Analytics

We use advertising and analytics tools to understand site performance and measure campaigns:

Google Analytics 4: Runs on every page and counts visits, pages viewed and purchases. On checkout and order confirmation pages it runs through Google Tag Manager.
Meta/Facebook Pixel and Conversions API: Only on checkout and order confirmation pages. Records checkouts and purchases for Facebook and Instagram advertising. When you buy, we also send Meta the purchase directly from our server, with your email address in hashed (scrambled) form.
Microsoft Clarity: Only on some checkout pages. Provides analytics and session recordings so we can fix problems with checkout.
Our own visitor ID: A random ID in a first-party cookie (fs_vid) that lasts 90 days. We use it to count how many visitors view a product or use a free tool, and how many of them buy. It is not shared with advertisers.
Where you first came from: The first time you visit, your browser saves the page that sent you (for example a search engine or an AI assistant such as ChatGPT), the page you landed on and any campaign tags in the link. This is sent with your order so we know which channels bring customers. It is never used to set prices.
Email link clicks: Links in our emails go through fastsocial.co/e/ first. We record which email and which link was clicked, and link the click to the visitor ID above, so we can see whether a purchase was made within 7 days of the click.

By using our site, you consent to these trackers. You can manage cookies and tracking in your browser settings or via each platform's privacy tools. These tools may collect information about your browsing behavior, device, and location for advertising and analytics purposes.

5. Data Sharing and Third Parties

We may share your data with the following categories of recipients:

Payment Processors: We share transaction data with our payment processors, Finby (TrustPay) and Cardinity, to process payments securely. These providers are bound by strict confidentiality and security obligations.
Service Providers: We share data with the service providers we need to run the business, all under confidentiality obligations:
- Supabase (our database, hosted in the EU) and DigitalOcean (our servers).
- Cloudflare (website delivery and security, including the Turnstile check that stops automated abuse of our forms).
- Zoho, including ZeptoMail (sending and receiving email).
- OpenAI (our free text tools, such as the caption and username generators, and automated assistance with support messages).
- Telegram, which our team uses for internal alerts and to approve some account checks by hand (see Section 16).
- Services that read public Instagram data for us. They receive the Instagram username or post link being looked up, never your email or payment details.
- Our delivery partners, who receive only the account username or post link and the amount to deliver, never your email or payment details.
Advertising/Analytics Platforms: We share limited data with Google, Meta/Facebook and Microsoft (Clarity) for site analytics and advertising measurement, as listed in Section 4.
Legal Authorities: We may share data with law enforcement, regulators, or other legal authorities when required by applicable law, court order, or to protect our rights and the rights of others.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to the same privacy protections.

We do not sell your personal information to third parties. We do not share your data with third parties for their own marketing purposes without your explicit consent.

6. Data Retention

We retain your personal data for the following periods:

Order and Subscription Data: 7 years from the date of your last transaction (for accounting, tax, and legal compliance purposes).
Active Subscription Data: For as long as your subscription remains active and for a reasonable period afterward (typically 12–24 months) for support, fraud prevention, and accounting compliance.
Marketing Data: Until you opt out or 2 years of inactivity, whichever comes first.
Website Analytics: 26 months maximum (as per platform policies).
Support Communications: 3 years from the date of last contact for customer service and dispute resolution purposes.

After the retention period, we will securely delete or anonymize your personal data, except where we are required to retain it for legal, accounting, or regulatory purposes.

7. Your Rights (GDPR and Data Protection)

If you are located in the European Economic Area (EEA) or other jurisdictions with similar data protection laws, you have the following rights:

Right of Access: You can request a copy of the personal data we hold about you.
Right to Rectification: You can request correction of inaccurate or incomplete personal data.
Right to Erasure: You can request deletion of your personal data, subject to legal and contractual obligations (e.g., we must retain transaction records for accounting purposes).
Right to Restrict Processing: You can request that we limit how we use your personal data in certain circumstances.
Right to Data Portability: You can request a copy of your data in a structured, machine-readable format.
Right to Object: You can object to processing based on legitimate interests, including direct marketing.
Right to Withdraw Consent: Where processing is based on consent, you can withdraw consent at any time.
Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority if you believe we have violated your data protection rights.

To exercise any of these rights, please contact us at contact@fastsocial.co. We will respond to your request within 30 days (or as required by applicable law).

Delete my data: You can also use our Delete my data page. We email a confirmation link to the address you enter. Once you confirm, we anonymise the personal data tied to that email (your email address, Instagram username and any stored card holder details), cancel any active subscription, remove you from our mailing lists, and delete the public Instagram data we hold for that username (Section 17) and stop storing it. We keep the anonymised sales records for accounting. Anonymisation can't be undone, so afterwards we can't look up your past orders or refill them.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies for the following purposes:

Essential Cookies: Required for website functionality, security, and user experience (e.g., session management, authentication, and the sign-in cookies for the manage page described in Section 16).
Analytics Cookies: Help us understand how visitors interact with our website (e.g., Google Analytics, Microsoft Clarity on some checkout pages, and our own visitor ID).
Marketing Cookies: Used for advertising attribution and optimization (e.g., the Meta/Facebook Pixel on checkout pages).

We also save some things in your browser's local storage, which stay on your device: where you first came from (Section 4), the email addresses used at checkout on that device (Section 18), and a device token for the manage page (Section 16).

You can control cookie settings through your browser preferences. Note that disabling certain cookies may affect website functionality. You can also opt out of specific tracking platforms through their privacy tools:

Facebook: Facebook Ad Preferences
Google Analytics: Google Analytics Opt-out Browser Add-on

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit (SSL/TLS) and at rest where appropriate.
Secure payment processing through PCI-compliant third-party providers.
Access controls and authentication measures.
Regular security assessments and updates.
Employee training on data protection and security best practices.
To protect your orders and help you recover one, we keep hashed signals from the device used at checkout (such as network, time zone and browser type), never the raw values, for 180 days.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

10. International Data Transfers

Some of our service providers (including payment processors, hosting providers, and advertising platforms) may be located outside the European Economic Area (EEA). When we transfer your personal data outside the EEA, we ensure adequate protection through:

Standard contractual clauses approved by the European Commission.
Adequacy decisions recognizing that certain countries provide adequate data protection.
Other appropriate safeguards as required by applicable data protection laws.

By using our services, you consent to the transfer of your data to these service providers for the purposes described in this policy.

11. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately, and we will take steps to delete such information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated via email to the address associated with your account or by posting a prominent notice on our website.

The "Last updated" date at the top of this policy indicates when it was last revised. Your continued use of our services after such changes constitutes acceptance of the updated policy.

13. Your Choices

You have the following choices regarding your personal data:

Opt Out of Marketing: You can opt out of marketing emails by clicking the unsubscribe link in any marketing email or by contacting us.
Opt Out of Ad Tracking: You can opt out of ad tracking via your browser settings and each platform's privacy tools (see Section 8).
Manage Cookies: You can control cookies through your browser settings.
Request Access or Deletion: Contact us at contact@fastsocial.co to request access to or deletion of your personal data (subject to legal and contractual obligations), or use the Delete my data page (see Section 7).

14. Contact Information

For privacy-related questions, to exercise your data protection rights, or to report a data breach, contact us at:

Email: contact@fastsocial.co
Phone:
Address:

We will respond to your inquiry within 30 days (or as required by applicable law).

15. Instagram Data API and MCP server

This section covers the Instagram Data API at data.fastsocial.co, its MCP server (the remote server at data.fastsocial.co/mcp and the instagram-data-mcp package), and the API account pages on fastsocial.co. The rest of this policy applies too. The instagram-data-mcp package runs on your own computer and sends each request to the API with your key, so everything below applies to it in the same way.

When you sign up or sign in

Email address: used to send your sign-in codes, your API key, and emails about your plan and billing.
Sign-in codes: we store a keyed hash of each code, never the code itself. A code works once, expires after 10 minutes, and locks after 5 wrong tries.
Sessions: signing in sets a cookie. We store a hash of the cookie value, never the value itself, together with your IP address and your browser's user agent. A session ends when you log out, or after 30 days.
API keys: we store a SHA-256 hash of each key and its first few characters so you can tell your keys apart. We never store the full key. It is shown to you once, and the first key for each new plan is also emailed to you. We can't recover a lost key, but you can make a new one.
Paid plans: your plan, its billing status, the payment records our payment processor sends back, and the IP address used at checkout. Card details are handled by the payment processor, as described in Section 2.
Usage: for each key, the number of calls and credits used in each calendar month.

Free keys

When you create a free key we also store your IP address (on IPv6, the network it belongs to), a random device ID that the page saves in your browser's local storage, and a one-way hash of your browser's settings. We use these only to prevent abuse of free keys, so that one person can't create many of them.

When you connect an app

App registrations: when an app such as an AI assistant registers to connect, we store the name it gives, the redirect addresses it gives, and the IP address it registered from.
Sign-in requests and authorization codes: a sign-in request expires after 10 minutes. An authorization code is stored only as a hash, works once, and expires after 5 minutes.
Access and refresh tokens: stored only as hashes. An access token lasts 1 hour. A refresh token lasts 30 days and is replaced with a new one every time it is used. If an old refresh token is used again, every token from that sign-in is cancelled.
Tokens follow your key: every token is tied to one of your API keys and is checked against it on each request. Pressing "New key" on your account page switches the old key off, and every app connected through it stops working straight away. Connect the app again and it will use your new key. When a plan ends, its key and the apps connected through it stop working in the same way.

Instagram data and requests

We don't keep a log of individual API requests or of which Instagram accounts you look up. Apart from your monthly totals above, we keep daily call counts per endpoint that are not linked to any key or person.
API responses with follower, like or view counts are cached for at most 5 minutes so repeat requests are fast, then dropped. The cache is not linked to who asked. The public numbers themselves also go into our shared Instagram data store, as described in Section 17.
We log what data was pulled and the result, but we never store who pulled it. We work with data, and data pulled by others helps our operations.
Engagement insights lookups add anonymous counts to our benchmark statistics: a follower range, whether the account is a business account, and an engagement range. The data that could link a count to an account is deleted every day.
We never ask for your Instagram password, and the API never posts anything or acts on your account.
If you own an Instagram account and want it excluded from the API, email us. We keep your username on an exclusion list, and the API refuses requests for that account.

How long we keep it

Expired codes, sessions and tokens stop working, but we don't currently delete these records on a schedule. Your account, key, usage and free-key records stay until you ask us to delete them. Payment records are kept as described in Section 6.

Deleting your API account

Email contact@fastsocial.co from the address on your account and ask us to delete it. We will switch off your keys, which also disconnects any connected apps, and delete or anonymise the records in this section, except payment records we have to keep for accounting.

16. Proving an order is yours (the manage page)

The manage page shows nothing about any order or plan until you prove it is yours. Typing an email or username never tells anyone whether orders exist. You can prove it in one of these ways:

Email code: we send a 6-digit code to the email used at checkout. It works once, expires after 10 minutes and locks after 5 wrong tries. We store only a keyed hash of the code.
Bio phrase: we give you a short phrase to add to your Instagram bio, then read the public profile once to check it. We don't store or log your bio. The phrase is stored only as a keyed hash and expires after 20 minutes.
This device: after you pay, the order confirmation page saves a random device token in your browser's local storage. It lets that browser open that order for 180 days.
Payment match: if neither your email nor your username works, you can tell us the amount, currency and date of the payment and the last 4 digits of the card, plus anything else you remember. We compare this with our own payment records. You first confirm the correct Instagram username with a bio phrase and a new email address with a code. If exactly one payment clearly matches, the order is moved to you automatically. Otherwise your request goes to our team, who approve or deny it by hand through Telegram. We never show payment details back to the person asking. A request expires after 3 days.

Once you are verified, you get a sign-in session in a secure cookie that lasts 12 hours and is tied to that browser. We store a hash of the session, never the session value itself.

17. Public Instagram data we keep, and our statistics pages

Our free tools, checkout, delivery checks, auto-likes checks and Instagram Data API all read public Instagram data. Everything they read goes into one shared store, which we use for our statistics, our Instagram Top Charts and Instagram statistics pages, and to avoid looking up the same account twice.

What it holds: public profile numbers (username, Instagram ID, followers, following, post count, display name, category, and whether the account is private or verified) and, for public accounts, public post numbers (post ID, date, format, likes, comments and views).
What it never holds: captions, images, bios, links, emails, phone numbers, or any customer or payment data. For a private account it holds only the profile numbers and the fact that it is private, never posts.
Who asked: we never store who made a lookup: no API key, account, IP address, browser or visitor ID. We record only which part of our service the data came from (for example "checkout"), and times are rounded to 5 minutes so they can't be matched to a request.
How long: every profile snapshot is kept for 30 days. After that we keep one snapshot a day, for up to 400 days, only for accounts with at least 100,000 followers. Post numbers are dropped once a post hasn't been seen for 120 days.
What gets published: nothing in the store is published as it is. Our Top Charts and Instagram statistics pages and their downloads show only the accounts on their published lists, and our benchmark figures are published only as group totals, so a small account someone looked up never appears anywhere.
Removal: to have an account removed from the Top Charts, the statistics pages, the downloads and the API, use the removal form. For anything else, email contact@fastsocial.co. A removed username is kept on a block list so we don't store it again. The Delete my data page also removes the usernames on your orders from the store.

18. Information kept on your device

Some things are saved only in your browser's local storage and stay on your device:

Emails used at checkout: up to 10 email addresses used at checkout in that browser, so you can pick the one you used before or find an order on the manage page if you mistyped it. This list is not sent to us.
Where you first came from: see Section 4.
Manage page device token: see Section 16.

You can remove all of these at any time by clearing this site's data in your browser settings.

Story and highlight viewer: to count free views per day, we store a hash of your browser ID, a hash of your network, and a hash of your network together with your browser settings, never your raw IP address. We delete these after the following day (UTC), so they are kept for at most 48 hours. If you buy viewer credits, a hash of your browser ID is kept with your credit balance so that browser can use it.