Privacy policy

The controller for data processing on fastry is:

For questions about data protection just send us an email – to the address above or to our support: [email protected]

We only process personal data if one of these legal bases of the GDPR applies:

• Contract (Art. 6(1)(b) GDPR): everything needed so that you can use fastry – account, monitors, alerts, reports, billing.
• Legitimate interest (Art. 6(1)(f) GDPR): secure and stable operation, protection against abuse and audience measurement without cookies.
• Consent (Art. 6(1)(a) GDPR): only for ad measurement with Google Ads, and only if you agree in the cookie banner. You can withdraw it at any time.

We don't sell data and don't build advertising profiles.

All requests to fastry.com go through Cloudflare (see section 9) to our server. In doing so Cloudflare necessarily processes your IP address and the data of the request (requested address, time, browser identifier).

For monitors, website checks and the free tools our crawler fetches the checked pages. It runs on the same server at Hetzner in Helsinki and only processes the checked addresses and what these pages return. An additional crawler runs on a server at IONOS in Berlin and processes the same data. If more servers for the crawler are added, we name them here on this page with provider and location beforehand.

Our application writes a technical log (time, requested address, result, a random request ID), but no IP addresses. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

Against abuse we count sign-in attempts and requests to the free tools per IP address or email address. We only store these counters as a checksum (SHA-256), never in plain text. We delete sign-in counters after two hours at the latest, daily counters of the free tools after two days at the latest.

For your account we store your email address, your password (only as an Argon2 hash), the time of confirmation and – if you switch it on – the data of two-factor sign-in. For every sign-in we store the IP address, browser identifier and the time of last use, so that you can see and sign out your signed-in devices. A sign-in is valid for at most 30 days.

On top of that comes what you create yourself: monitors and their addresses, measurement results, alert channels (email addresses, phone numbers, webhook addresses, Slack channel), status pages, reports, keywords and team invitations. We also store the language you chose for the app and for emails.

The legal basis is the contract with you (Art. 6(1)(b) GDPR).

You can delete your account yourself at any time (Settings → Account → “Delete account”). We then end all sessions, immediately cancel running subscriptions of workspaces that belong only to you and delete these workspaces with all their content. You are removed from other people's workspaces; what you created there stays with the workspace, without a reference to you – only your API keys are deleted. If you own a workspace with other members, hand it over to a member first or delete it. The owner can also delete a single workspace on its own. Finally you get a confirmation by email. What Creem has to keep for invoices stays stored there.

With the free tools we process the address you want checked and fetch this page from our server. We keep the result for a short time (5 minutes) so that identical requests are faster. Against abuse there are limits per IP address (stored as a checksum, see section 3) and per checked domain. If switched on, Cloudflare Turnstile checks before the request whether a human is asking (see section 9).

We only set cookies that fastry needs:

• _fastry_key – session cookie, keeps you signed in and protects forms. Deleted when you close the browser.
• _fastry_web_user_remember_me – only if you choose “Stay signed in”, valid for 30 days.
• fastry_locale – remembers the language you chose with the language switch (English or German), valid for 12 months.

The legal basis is § 25(2) no. 2 TDDDG (strictly necessary) and Art. 6(1)(b) and (f) GDPR. Cookies for advertising are only set by Google Ads, and only after your consent (section 8).

To see which pages and features are used, we use Umami. Umami runs on our own server at Hetzner in Helsinki (the same server as the app, see section 3; address soul.dev-creations.de), sets no cookies, stores no IP addresses and creates no profiles. It counts visited pages, referring page, browser, device type and country as well as clicks on certain buttons – without names, email addresses or other personal details.

The legal basis is our legitimate interest in improving fastry (Art. 6(1)(f) GDPR). Because no cookies are set and no data is stored on your device, no consent is needed for this. Umami does not run on our customers' status pages.

We currently don't use Google Ads; that's why no cookie banner appears either. As soon as we use it, we will add to this section and ask for your consent beforehand.

For the following tasks we work with other providers. Where they process data on our behalf, this is based on a data processing agreement (Art. 28 GDPR).

• Account and workspace data: until you delete the workspace or ask us to delete it.
• Single checks of the monitors: 30 days, 7 days for monitors that check more often than every minute.
• Hourly summarized history (availability, response times) and closed incidents depending on the plan: Free 3 months, Starter and Agency 12 months, Pro 24 months. After a change to a smaller plan the shorter period applies, older data is deleted during the next daily cleanup.
• Website checks (headers, HTML): 90 days, the latest one is kept.
• Filmstrips of the browser measurements: 30 days, the latest measurement per monitor is kept.
• Deployments: 13 months.
• Reports: 12 or 24 months depending on the plan, in the Pro plan until deletion; share links 90 days.
• Unconfirmed subscriptions to status updates: 7 days after the confirmation link.
• Sign-ins (sessions): at most 30 days.
• Counters against abuse (only as a checksum): at most two hours, for the free tools at most two days.

Statutory retention obligations (e.g. for invoices) remain unaffected.

You have the right to

• access to your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interest (Art. 21 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

An email to us is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example with the Berlin Commissioner for Data Protection and Freedom of Information, which is responsible for us, Alt-Moabit 59-61, 10555 Berlin, Germany, www.datenschutz-berlin.de.