What we collect
When you create an account we ask for your name, email address and a password. If you subscribe to a paid plan, our payment processor collects your billing details and shares a summary with us, such as the last four digits of the card and the country it was issued in. We never see or store the full card number.
While you use the dashboard we record ordinary technical information: IP address, browser and operating system, pages visited, and timestamps. We also log the actions you take on your servers, so that both of us can see who changed what.
Your servers and their data
The agent installed on your server sends us the information needed to manage it: hostname, operating system version, resource usage, the names of the sites, databases and users you create, and certificate details. It reports the state of your machine so the dashboard can show you the truth about it.
We do not copy your website files, your database contents or your visitors' data onto our systems. Credentials the agent needs, such as database passwords you set, are stored encrypted and used only to carry out the actions you request. If a support engineer needs deeper access to help you, we ask first.
How we use it
- To run the service: setting up servers, issuing certificates, creating users, and showing you what is happening.
- To bill you correctly, and to keep the records our accountants and tax authorities require.
- To answer support requests and investigate problems you report.
- To protect the service against abuse, fraud and unauthorised access.
- To send you service notices, and product email you can unsubscribe from at any time.
We do not sell your personal information, and we do not hand it to advertisers.
Who else sees it
We rely on a small number of companies to operate: a cloud provider for our own infrastructure, a payment processor, an email delivery service, a support inbox, an error tracking tool, and a certificate authority for the SSL certificates issued to your domains. Each of them receives only what it needs, and each is bound by a contract to handle it properly.
We will disclose information if the law genuinely requires it. If we receive such a request and we are permitted to tell you, we will.
How long we keep it
Account and server records live for as long as your account is open. When you close it, we delete the account and its server records within 30 days, apart from invoices and payment records, which we keep for the period our tax rules demand. Backups roll off within 90 days. Anonymised usage statistics may be kept indefinitely, because they can no longer be traced back to you.
Security
Traffic between your browser, our systems and the agent on your server is encrypted in transit, and secrets are encrypted at rest. Instructions sent to your server are cryptographically signed and expire quickly, so the agent will not act on anything that did not come from us. Access to production is limited to the people who need it, protected by strong authentication, and logged.
If a breach affects your data, we will tell you what happened, what we know, and what we are doing about it, without waiting for the story to become flattering.
Your choices
You can view and edit most of your information in the dashboard. Write to us and we will give you a copy of what we hold, correct anything wrong, or delete your account and its data. If you are in the European Economic Area, the United Kingdom, or a place with comparable law, you also have the right to object to certain processing and to complain to your data protection authority.
Cookies
This website sets no cookies and runs no third-party analytics or advertising scripts; the fonts it uses are served from our own domain. The dashboard at app.fastcp.io sets a single cookie to keep you signed in. It is strictly necessary for the service to work, and it is not used to track you elsewhere.
Children
FastCP is a tool for people running servers. It is not intended for anyone under 16, and we do not knowingly collect their information.
Changes
If we change this policy in a way that matters, we will email account holders and update the date at the top. Small clarifications may appear without an announcement.
Contact
Questions about any of this go to privacy@fastcp.io, and a person will answer.
Before publishing: add your registered company name, trading address, and — if you are outside the EEA or UK and serve customers inside it — your data protection representative, in place of this note.