Privacy policy

Last updated: October 17, 2026

This policy explains what personal data Fastah Inc. ("Fastah", "we", "us") collects when you use www.getfastah.com, including the documentation, API reference, IP explorer and API playground published on it (together, "this Website"), why we collect it, who we share it with, and the rights you have.

Different protection standards may apply to you depending on where you live. This policy has dedicated sections for users in the European Union, Switzerland, Brazil and the United States. If anything here is unclear, contact us at privacy@getfastah.com.

This policy covers this Website only. The Fastah developer console (console.fastah.net) and the Fastah API are covered by the agreements you accept when you subscribe.

Controller

Fastah Inc.
3500 S Dupont Hwy, Dover, Delaware 19901, United States of America
Email: privacy@getfastah.com

Personal data we collect

We collect personal data in two ways: data you give us, and data collected automatically when you use this Website.

Data you give us

When you use one of our forms, we collect what you type into it:

Fields are required unless the form marks them optional; we can't act on a request without them. If you submit someone else's personal data through a form, you are responsible for having the right to share it.

Data collected automatically

• Usage data. Like any website, our hosting infrastructure receives standard request data each time your browser loads a page: your IP address, the requested URL, date and time, request method, response status and size, referring page, and your browser and operating system (user agent). Our hosting provider records this in server logs.
• IP addresses you look up. When you use the IP explorer or the API playground, the IP address you enter is sent from our server to the Fastah API to return a result. If you ask the explorer to look up your own IP address, we use your public IP address for that lookup.
• Analytics data, only with your consent. If you choose "Allow analytics" in our consent banner, we collect pseudonymous product events and page views (described under "Analytics" below).
• Device storage. We and the services below store a small number of entries in your browser. See "Cookies and local storage" below.

How and why we use personal data

Hosting and security

This Website is hosted on Amazon Web Services (AWS Amplify Hosting and Amazon CloudFront). Every page request passes through this infrastructure, which processes usage data, including your IP address, to deliver the page, protect the site from abuse (including rate limiting), and diagnose faults. Server logs are kept only as long as needed for security and troubleshooting, then deleted.

Answering your forms

When you submit a form, its contents are sent as an email through Amazon Simple Email Service (Amazon SES) to support@getfastah.com, with your email address as the reply-to address. This Website does not store submissions itself. We use the contents only to answer your message, review and act on your correction, or evaluate your geofeed partnership. Emails are kept in our support mailbox, hosted by Google Workspace (Google LLC, United States), for as long as needed to handle your request and keep a record of our correspondence.

IP explorer and API playground

The IP explorer and API playground send the IP address or request you enter from our server to the Fastah API, which returns approximate geolocation and network information. Results are approximate. They are not proof of anyone's identity or exact physical location.

To pre-fill the explorer with your own address, your browser may also call a Fastah-operated endpoint, internal.cors.fastah.net, which returns your public IP address to your browser.

Explorer map

On IP explorer pages, your browser loads map tiles and styles from Mapbox (Mapbox, Inc., United States) to draw the approximate location on a map. Mapbox receives your IP address and standard request data when your browser fetches the map, and Mapbox's map library sends Mapbox usage events (map loads) for its own billing and service measurement. See Mapbox's privacy policy.

Analytics

We use PostHog (PostHog Inc.) to understand how this Website is used, for example which pages are visited and whether the explorer, documentation and sign-up links work as intended. PostHog runs only after you opt in through the consent banner. If you choose "No thanks", or your browser sends a Global Privacy Control or Do Not Track signal, no analytics data is collected.

With your consent, PostHog receives pseudonymous page views and product events (for example, that a lookup succeeded or a form was submitted), together with standard request data such as your IP address and browser details. Events never include IP addresses you look up. PostHog processes this data in the United States and keeps it only as long as needed to understand how this Website is used.

You can change your choice at any time with the "Analytics choices" link in the site footer.

Purchases through AWS Marketplace

You buy Fastah API subscriptions on AWS Marketplace, not on this Website. Payment details are collected and processed by Amazon Web Services under AWS's own terms and privacy notice; Fastah does not receive your payment card or bank details. As the seller, Fastah receives the subscription information AWS shares with sellers so that we can provision and support your account in the Fastah developer console (console.fastah.net).

Every page of this Website loads the "Buy with AWS" script (partner.js) from Amazon Web Services (bwa.marketplace.awsstatic.com) so that our purchase buttons can start an AWS Marketplace checkout. When your browser loads the script, AWS receives your IP address and standard request data. The script does not set cookies or store anything in your browser when a page loads.

Legal compliance and protecting our rights

We may use personal data to comply with legal obligations, respond to lawful requests from public authorities, enforce our Terms of use, and protect the rights, property and safety of Fastah, our users and others, including in court or in the steps leading to possible legal action arising from improper use of this Website.

Who we share personal data with

We don't sell personal data, and we don't share it for cross-context behavioral advertising. We share it only with the providers that run this Website's features, and only as described above:

Fastah's own staff and systems (including the Fastah API and the internal.cors.fastah.net endpoint) also process this data. Within Fastah, access is limited to people who need it for administration, support, sales, legal or system administration. You can ask us for the current list of service providers at any time.

Cookies and local storage

This Website does not set advertising cookies. It stores the following entries in your browser:

Strictly necessary entries don't need your consent. Analytics entries are only created after you opt in. If you withdraw consent, PostHog stops collecting new data and its cookie and local storage entry are deleted.

You can also see, block and delete cookies and local storage in your browser settings. Blocking strictly necessary entries means your theme and consent choices won't be remembered.

Retention

We keep personal data only as long as we need it for the purpose we collected it for, as described above. In particular:

• data processed to perform a contract with you is kept until the contract has been fully performed;
• data processed for our legitimate interests is kept as long as needed for those interests;
• data processed on the basis of your consent is kept until you withdraw consent.

We may keep data longer where the law requires it or a public authority orders it. When the retention period ends, we delete the data, after which the rights of access, erasure, rectification and data portability can no longer be exercised for it.

Security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, modification and destruction. Fastah holds a SOC 2 attestation; see our Trust Center for our security and compliance documentation.

International transfers

Fastah is based in the United States, and our service providers process data in the United States. If you are outside the United States, your data is transferred to a country that may have different data protection laws from yours.

For transfers of personal data from the European Union, we rely on the European Commission's standard contractual clauses, under which recipients commit to process the data in line with EU data protection standards, or, where no other safeguard applies, on your explicit consent after being informed of the risks. Contact us for more information about these safeguards.

Users in the European Union

This section applies to users in the European Union and European Economic Area under the General Data Protection Regulation (GDPR). For those users, it takes precedence over anything in this policy that conflicts with it.

Legal bases

We're happy to clarify the legal basis for any processing, including whether providing data is a statutory or contractual requirement.

Your rights under the GDPR

To the extent permitted by law, you have the right to:

• withdraw consent at any time, where processing is based on consent, without affecting processing that took place before;
• object to processing based on a legal basis other than consent, on grounds relating to your situation. You can object to direct marketing at any time, free of charge and without giving a reason;
• access your data and receive a copy of it;
• rectify inaccurate data;
• restrict processing, in which case we will only store your data;
• erase your data;
• receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller, where technically feasible;
• lodge a complaint with your competent data protection authority.

You can also ask about the legal basis for transfers of your data outside the EU and the safeguards we use.

How to exercise your rights

Email privacy@getfastah.com. Requests are free of charge, and we answer them as early as possible and always within one month. We tell every recipient we've disclosed your data to about any rectification, erasure or restriction, unless that proves impossible or involves disproportionate effort, and we'll tell you who those recipients are if you ask.

Users in Switzerland

This section applies to users in Switzerland under the Federal Act on Data Protection. For those users, it takes precedence over anything in this policy that conflicts with it.

Within the limits of the law, you have the right to:

• access your personal data;
• object to processing, including demanding that processing be restricted, that your data be deleted or destroyed, or that specific disclosures to third parties be prohibited;
• receive your data and have it transferred to another controller (data portability);
• have incorrect data corrected.

Send requests to privacy@getfastah.com. They are free of charge, and we answer them as early as possible.

Users in Brazil

This section applies to users in Brazil under the Lei Geral de Proteção de Dados (LGPD). For those users, it takes precedence over anything in this policy that conflicts with it.

Legal bases

We process your personal information only where we have a legal basis under the LGPD. The bases we rely on are your consent (analytics), the performance of a contract or preliminary procedures at your request (answering forms), compliance with a legal or regulatory obligation, the exercise of our rights in judicial, administrative or arbitration proceedings, and our legitimate interests, provided your fundamental rights and freedoms do not prevail over them. The categories of data and the purposes we process them for are described above.

Your rights under the LGPD

You have the right to:

• confirm whether we process your personal information;
• access it;
• have incomplete, inaccurate or outdated information corrected;
• have unnecessary or excessive information, or information not processed in line with the LGPD, anonymized, blocked or deleted;
• be told whether you can give or refuse consent, and the consequences of refusing;
• be told which third parties we share your information with;
• on express request, port your information (except anonymized information) to another provider, subject to our commercial and industrial secrets;
• have information processed on the basis of consent deleted, unless an exception in article 16 of the LGPD applies;
• revoke consent at any time;
• lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) or with consumer protection bodies;
• oppose processing that does not comply with the law;
• request clear information about the criteria and procedures used for any automated decision, and request review of decisions made solely by automated processing that affect your interests.

You will never be discriminated against for exercising your rights.

How to make a request, and how we respond

Send your request, free of charge, to privacy@getfastah.com, yourself or through your legal representative. We will respond promptly. If we can't comply, we'll explain the factual or legal reasons; if we don't process your information, we'll tell you who does, if we can.

For an access or confirmation request, tell us whether you want the answer electronically or in print, and whether you want an immediate simplified answer or a complete disclosure. We provide a complete disclosure within 15 days of your request, covering the origin of the information, whether records exist, the criteria used and the purposes of processing, while protecting our commercial and industrial secrets.

When you ask us to correct, delete, anonymize or block information, we pass the request on to the parties we shared it with, unless that proves impossible or involves disproportionate effort.

Transfers outside Brazil

We transfer your personal information outside Brazil only where the LGPD allows it, including where the transfer is necessary to perform a contract or preliminary procedures related to a contract, to comply with a legal or regulatory obligation, to exercise rights in judicial, administrative or arbitration proceedings, to protect your life or physical safety or that of a third party, or where the ANPD has authorized it.

Users in the United States

This section applies to residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and Montana. For those residents, it takes precedence over anything in this policy that conflicts with it. It uses the term "personal information".

Notice at collection

In the past 12 months we have collected the following categories of personal information:

We keep each category for as long as necessary to fulfil the purposes above (see "Retention" above). We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We do not collect sensitive personal information. We won't use personal information for purposes that are not reasonably necessary for, and compatible with, the purposes disclosed here without your consent.

Sources of personal information

We collect personal information directly from you, when you submit a form, and automatically, when you browse this Website. We may also receive it from service providers that work with us to run this Website, and from AWS when you subscribe through AWS Marketplace.

Your rights under US state laws

To the extent permitted by applicable law, you have the right to:

• know and access the personal information we process about you;
• correct inaccurate personal information;
• delete your personal information;
• obtain a copy of your personal information in a portable, usable format, where technically feasible;
• opt out of the sale of your personal information, its sharing for cross-context behavioral advertising, and its processing for targeted advertising or for profiling in furtherance of decisions that produce legal or similarly significant effects (we do none of these);
• limit the use of sensitive personal information, or give, refuse or withdraw consent to its processing, depending on your state (we do not collect it);
• in Minnesota and Maryland, obtain a list of the specific third parties we have disclosed personal data to;
• in Minnesota, where profiling applies, question its results, learn the reasons for a decision and what you could do to change it, review the data used, and have inaccurate data corrected and the decision reevaluated;
• non-discrimination: we will not discriminate against you for exercising your rights.

How to exercise your rights

Email privacy@getfastah.com. You don't need an account. We need to verify your identity before we respond, and we use the information you give us for verification only for that purpose, and keep it no longer than necessary. You may make a request on behalf of a child under your parental authority, or through an authorized agent.

We honor Global Privacy Control signals: when your browser sends one, analytics stay off, without you having to do anything else.

We respond without undue delay and within the time the law requires. If we need more time, we'll tell you why and how much. If we deny a request, we'll explain why, and, where the law provides, how to appeal or complain to the relevant authority. We don't charge a fee unless a request is manifestly unfounded or excessive; in that case we may charge a reasonable fee or decline, and we'll explain our reasons.

Changes to this policy

We may change this policy. We'll post changes on this page and update the "Last updated" date above, and, where technically and legally feasible, notify you through this Website or by email if we have your address. Where a change affects processing based on your consent, we'll ask for your consent again where required.

Contact

For any question about this policy or your personal data, email privacy@getfastah.com.

Definitions

• Personal data (or personal information): any information that directly or indirectly, alone or combined with other information, identifies or can identify a natural person.
• Usage data: information collected automatically when you use this Website, such as your IP address, requested URLs, request times and methods, response status and size, and your browser and operating system.
• Controller: the person or organization that decides the purposes and means of processing personal data. For this Website, that is Fastah Inc.
• Processor (or service provider): a person or organization that processes personal data on the controller's behalf.
• Sale, sharing and targeted advertising: as defined in the applicable US state privacy law. Disclosing personal information to a service provider under a written contract that meets the law's requirements is not a sale or sharing.
• European Union (EU): unless stated otherwise, includes all EU member states and the European Economic Area.
• Cookie: a small piece of data stored by your browser. Local storage is a similar browser feature that stores data on your device without sending it with every request.