Operator
- Company
- FAST SaaS Limited
- Address
- 8/F., China Hong Kong Tower, 8-12 HENNESSY ROAD, Wan Chai, Hong Kong
- Represented by
- —
- support@track.site
- Phone
- —
- Register
- —
- VAT ID
- —
- Data protection officer
- —
These details are published by the operator before launch (LEGAL_* environment variables).
Controller
The controller for this website and the customer account data is the operator named in the imprint. For event data processed on behalf of customers, the customer is the controller and the operator acts as processor under the data processing agreement.
Data we process as controller
Account data (name, e-mail, organization, role), billing data (handled by Stripe; we store customer and subscription ids), support requests, security logs (truncated IP, user agent family) and cookies strictly required for authentication and language preference.
Data we process as processor
Events sent by customers' websites and systems: event name and parameters, consent state, pseudonymous identifiers, hashed matching data, truncated IP and page context, plus the delivery records to the destinations the customer configured. Processing follows the customer's consent policy; without the required purpose no data is stored or transmitted.
Purposes and legal basis
Contract performance (Art. 6(1)(b) GDPR) for accounts, billing and support; legitimate interest (Art. 6(1)(f)) for security and abuse prevention; consent (Art. 6(1)(a)) where a customer's visitor agreed to analytics or marketing purposes; legal obligations (Art. 6(1)(c)) for accounting records.
Recipients and transfers
Subprocessors are listed on the subprocessors page. Transfers outside the EU rely on standard contractual clauses or the EU-US Data Privacy Framework. Advertising vendors receive data only for destinations the customer configured, and the wizard shows the recipient and transfer basis for each.
Retention
Events 13 months, click ids 90 days, consent snapshots 3 years, delivery attempts 90 days, audit log 2 years, chat transcripts 30 days, DSAR records 3 years — configurable per organization within these maxima. Account data is deleted 30 days after account closure.
Your rights
Access, rectification, erasure, restriction, portability and objection. Customers process visitor requests through the privacy center; visitors can contact the operator directly. You may lodge a complaint with a supervisory authority.
AI assistant
The setup assistant uses the OpenAI Responses API with zero data retention. Secrets and personal data are redacted before a message reaches the model; the model can only act through typed tools that are validated and audited server-side.