Privacy Policy

This policy covers the marketing websites of every FAST Suite module, signup/login flows, the shared dashboard on app.fastsuite.io, embedded players, review links and client portals, publishing, podcast hosting and feeds, billing flows, the partner program, and operational security/audit records generated while we provide the service.

Depending on how you use FastEmbeds, we process the following categories of data:

• Account data: email address, display name, encrypted password hash, account role, status, and last login timestamp.
• Session and security data: session token hashes, created/updated/expiry timestamps, IP address used to create a session, and user-agent metadata.
• Billing data: plan, billing status, billing email, company name, VAT ID, Stripe customer/subscription identifiers, invoice metadata, invoice URLs, and payment status.
• Creator content and delivery data: uploaded filenames, MIME type, file size, player settings, delivery asset URLs, and related processing job state.
• First-party video analytics: a session-scoped analytics identifier stored in browser session storage, event type, viewport metadata, and referrer for impressions/views you consent to.
• Affiliate/referral data: referral code, visitor ID, landing URL, referrer, attribution window, conversion status, commission records, payout details, and bank account last four digits where applicable.
• Trust and safety data: abuse reports, reporter name/email where submitted, moderation notes, and admin impersonation audit records.
• Leads captured in videos: email address, optional name, video and watched seconds when a viewer submits an email form in a customer's video. We process these on behalf of that customer, who decides how they are used and can delete them at any time.
• Review and portal guests: name and email address of people a customer invites to review links or a client portal, their comments, markers, approvals with name and time, and the sign-in link records (stored only as hashes). We process these on behalf of the inviting customer.
• YouTube connection (FastPublish): the YouTube channel you connect, its name and ID, and the OAuth tokens Google issues for uploading on your behalf (stored encrypted), plus titles, descriptions and schedules of your posts.
• Podcast statistics (FastPod): for each episode download a hash of the IP address combined with the user agent, the podcast app, device type and country. We do not store full IP addresses for statistics.
• Transcripts (FastEdit, FastPod): text and timings created from recordings you upload, and suggestions derived from them.
• Provider webhook/event data: Stripe webhook payloads and Bunny delivery/webhook metadata that help us prove billing and delivery events.

We use personal data to:

• Perform our contract with you: create accounts, authenticate users, host videos, deliver embeds, manage plans, and provide the dashboard.
• Meet legal obligations: keep invoice and accounting records, respond to lawful requests, and maintain fraud/audit records where required.
• Pursue legitimate interests: secure the service, investigate abuse, troubleshoot incidents, and defend legal claims.
• Rely on consent for optional analytics and affiliate attribution storage/measurement on the website. You can refuse this and still use the core service.

FastEmbeds uses a small set of essential and optional storage mechanisms:

• Essential authentication cookies to keep you signed in and protect account actions.
• A consent preference cookie/local storage record so we can remember whether you allowed optional analytics.
• Session storage for first-party video analytics when you allow optional analytics, so repeated impressions/views can be measured consistently during the current browser session.
• Local storage for affiliate attribution when you allow optional analytics and open a referral link using a ?via= parameter.

Optional analytics consent enables Vercel Analytics, first-party video analytics, and affiliate attribution on the website. Essential-only mode keeps sign-in and security storage active but disables those optional flows.

We do not sell personal data. We share data only with the service providers needed to run FastEmbeds:

• Vercel Inc. (USA): hosting of the website, dashboard and API; server functions run in Frankfurt, Germany. Vercel Analytics for optional website analytics.
• Neon Inc. (USA): database, hosted in Frankfurt, Germany.
• BunnyWay d.o.o. / bunny.net (Slovenia): storage, processing and delivery of videos and storage of backups; primary storage in Frankfurt with replicas in London, Stockholm, Los Angeles, New York and Singapore, delivered through a worldwide CDN.
• Cloudflare, Inc. (USA): DNS and network protection for our websites.
• Hetzner Online GmbH (Germany): sending of account emails.
• Stripe (USA/Ireland): payment processing and invoices.
• Google LLC (USA): YouTube API Services, when you connect a YouTube channel in FastPublish. Google's privacy policy applies: https://policies.google.com/privacy
• Hostinger International Ltd. (Cyprus): a dedicated server in the United Kingdom that transcribes and renders edits in FastEdit.
• OpenAI, L.L.C. (USA): speech-to-text transcription of recordings you upload to FastEdit or FastPod. Audio is sent only when you start a transcription and is not used to train models.
• Anthropic, PBC (USA): suggestions for chapters, shorts and summaries based on transcripts in FastEdit and FastPod. Transcripts are not used to train models.

We may also disclose data if required by law or as part of a merger, acquisition, financing, or asset sale. Business customers can request a Data Processing Agreement at privacy@fastembeds.com.

FastPublish uses YouTube API Services. By connecting a channel you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). You can disconnect the channel in FastPublish at any time, which deletes the stored tokens, and revoke access in your Google account under https://myaccount.google.com/permissions.

When you connect a YouTube channel in FastPublish, we request exactly two Google permissions: “youtube.upload” to upload the videos you schedule or publish to your channel, and “youtube.readonly” to read your channel's name, ID and thumbnail so you can see which channel is connected. We do not request access to your Gmail, contacts, Drive or any other Google data.

We use this Google user data only to provide the publishing features you see in FastPublish. We do not sell it, do not use it for advertising, do not use it to train or improve artificial-intelligence or machine-learning models, and do not transfer it to third parties except as necessary to provide the service, to comply with law, or as part of a merger or acquisition with your notice. Our staff do not read it unless you ask us for support, it is needed for security reasons, or the law requires it.

FastSuite's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

OAuth tokens are stored encrypted. When you disconnect a channel, we revoke the token at Google and delete the channel record and tokens immediately; if you revoke access in your Google account, we delete them as soon as we notice the revoked access. Videos already uploaded stay on YouTube under your control. Channel data we keep is refreshed at least every 30 days or deleted.

When you connect your LinkedIn profile in FastPublish, we ask LinkedIn for three permissions: “openid” and “profile” to read your member ID, name and profile picture so you can see which profile is connected, and “w_member_social” to publish the videos and post texts you schedule in FastPublish to your profile. We do not read your connections, messages, feed or any other LinkedIn data.

We use this data only to publish what you plan in FastPublish. We do not sell it, use it for advertising or use it to train AI models. Access tokens are stored encrypted. When you disconnect the profile, we revoke the token at LinkedIn and delete the stored profile data and tokens immediately; posts already published stay on LinkedIn under your control. You can also remove FastSuite's access in your LinkedIn settings under Data privacy › Permitted services. LinkedIn's privacy policy applies to your use of LinkedIn: https://www.linkedin.com/legal/privacy-policy

FastEmbeds is operated by TAVALARIA LLC in the United States. Our application servers and database run in Frankfurt, Germany, but data can be accessed from the United States for operation and support, and some providers listed above process data in the United States or other countries. Where required, we rely on the EU Standard Contractual Clauses or the providers' certification under the EU-U.S. Data Privacy Framework.

We keep personal data for as long as needed for the purpose it was collected for, subject to contractual, legal, accounting, anti-fraud, and audit requirements. Our current retention approach is:

• Account and session data: kept while your account remains active; removed when your account is deleted, subject to limited operational backups.
• Videos and upload/processing data: removed when you delete the video or when your account deletion request is completed.
• Video analytics: kept as first-party product analytics for your account and removed with the account or affected video; session-specific cleanup is also available.
• Affiliate click/attribution data: kept for referral attribution and removed or de-linked when no longer needed for attribution or when a related account deletion requires it.
• Billing profile data: removed from the active billing profile on account deletion.
• Invoices and certain billing/audit records: may be retained in pseudonymized form where we need them for accounting, tax, fraud, contractual, or audit reasons.
• Webhook and trust/audit records: may be retained in redacted or pseudonymized form where evidence of operational events must be preserved.

Depending on your location, you may have rights of access, portability, correction, deletion, restriction, and objection. FastEmbeds currently provides or supports:

• Account export: authenticated users can request a machine-readable export via GET /api/account/export.
• Account deletion: authenticated users can request deletion via POST /api/account/delete. Some invoice, webhook, and audit evidence may be retained in redacted or pseudonymized form where legally or operationally required.
• Session controls: authenticated users can review and revoke active sessions.
• Password updates: authenticated users can rotate their password and revoke other sessions.

If you need help exercising a right or your request involves data that must be handled manually, contact us at the address below.

We use technical and organizational safeguards designed to protect personal data, including authenticated session controls, rate limiting, access restrictions, and audit logging. No system is perfectly secure, so we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a new effective date.

If you have any questions about this Privacy Policy, please contact us at: