Legal
Privacy Policy
What FastMonitor collects, why, who receives it, how long we keep it and the rights you have.
Version 0.1 (draft) · Draft dated
Draft, pending legal review. This policy describes what the service does today; it is being reviewed by a lawyer before it takes effect.
1. Who we are
FastMonitor is an uptime and cron job monitoring service. It is run by the company below, which is the controller for account, billing, website and support data.
- Registered name
- MP AI Solutions Ltd
- Trading name
- FastMonitor
- Company number
- [to be confirmed]
- Registered in
- [to be confirmed]
- Registered office
- [to be confirmed]
- ICO registration number
- [to be confirmed]
When you put personal data into the service (for example alert recipients, team invitations or job metadata), you are the controller and we process it for you as your processor, under our Data Processing Agreement.
2. What we collect, why, and the lawful basis
Your account
Your name, email address, a hash of your password (never the password itself), time zone and avatar. If you sign in with Google or GitHub, the name, email and avatar that provider returns. If you turn on two-factor sign-in, the TOTP secret (stored encrypted) and your backup codes. Whether your email address is verified. Session records with the IP address and browser user agent they were created from.
Lawful basis: contract (to provide the account you asked for).
Organisations and teams
The members of each organisation, the email addresses of people invited, and each person's role (owner, admin, billing, member or viewer).
Lawful basis: contract, and our legitimate interest in letting account owners manage who has access.
Monitoring configuration
The URLs, hosts, headers and request bodies you give a check; its assertions, cron schedules, environments and tags; notification lists with recipient email addresses and integration destinations; status-page branding and custom domain; and routing and automation rules.
Lawful basis: contract. Personal data in it is processed for the customer under the DPA.
Monitoring results
Check results (the stored response metadata of each result is capped at 8 KB), the job run events your jobs send to POST /e/execution-events, monitor logs, issues and their timelines, and alert events with each delivery attempt, including the address it was sent to.
Lawful basis: contract. Personal data in it is processed for the customer under the DPA.
Keys, tokens and integration secrets
Integration secrets (such as webhook signing secrets) are encrypted with AES-256-GCM. API keys and MCP tokens are stored only as SHA-256 hashes, so we cannot show them to you again. Calls to the MCP endpoint are logged for audit.
Lawful basis: contract, and our legitimate interest in keeping accounts secure.
AI diagnosis
On the Enterprise plan, when you ask for an AI diagnosis of an issue, we first cut the context down: the monitor's host name instead of its full URL, recent result codes and timings, and the issue timeline. API keys, headers, request bodies and alert recipients are never included. The redacted context goes to OpenAI or Anthropic, whichever the service is configured to use.
Lawful basis: contract (you ask for the diagnosis).
Billing
Payments go through Stripe Checkout and the Stripe billing portal. Your card details go to Stripe and never reach FastMonitor. We keep your Stripe customer and subscription IDs, plan, subscription status, billing period dates, billing email and invoice records.
Lawful basis: contract, and legal obligation for accounting records.
Contact and early-access forms
Your name, email address, company, category, message, the plan you are interested in and the page you sent it from. We keep a salted hash of your IP address to limit abuse; the IP address itself is never stored.
Lawful basis: legitimate interests (answering your message); consent, for early-access launch emails you ask for.
Support tickets
The tickets you open, the messages in them and any attachments you add.
Lawful basis: contract.
System email
We send email through Amazon Simple Email Service and keep a delivery log of the recipient, the kind of message and whether it was delivered.
Lawful basis: contract (verification, password reset, invitations, alerts and reports you set up).
Website analytics
If you accept analytics in the banner, PostHog records a pseudonymous ID, the pages you view and your clicks. You can withdraw at any time with Cookie settings in the footer; PostHog then stops and its cookie is removed.
Lawful basis: consent. Nothing is collected until you click Accept analytics.
Product events
Our servers send PostHog a fixed list of product events (such as sign-up completed, monitor created or checkout started), keyed to your account ID. They carry only categories and counts, never URLs, email addresses or keys. They are sent whatever you choose in the website banner, which covers browser analytics only.
Lawful basis: legitimate interests (understanding which features are used so we can improve them). You can object: see Your rights.
Error reports
When error reporting is switched on, errors are sent to Sentry with query strings, cookies, authorisation headers and request bodies removed. There is no session replay.
Lawful basis: legitimate interests (finding and fixing faults).
Bot protection
The sign-in, sign-up and password reset pages use Google reCAPTCHA v3, which sends Google signals about your device and how you use the page. It is not loaded on any other page.
Lawful basis: legitimate interests (protecting accounts from automated abuse).
Hosting
The website runs on Vercel in London (region lhr1), which receives standard request data such as your IP address and browser. The host for the database and API is confirmed before launch; it will be named on the sub-processor list.
Lawful basis: legitimate interests (running the website).
4. Who we share it with
We use the service providers on our sub-processor list (payments, email, analytics, bot protection, sign-in, error reports, hosting and, on request, AI diagnosis). Each receives only what it needs for its task.
When you connect a destination for alerts or automations (Slack, PagerDuty, Microsoft Teams, Discord, Google Chat, Telegram, Opsgenie, Splunk On-Call, Lark, Webhooks, n8n), we send it the alert or event you configured. That happens on your instruction, and that provider handles it under its own terms.
We do not sell personal data.
5. International transfers
Some providers process data outside the UK, mainly in the United States. Where they do, the transfer relies on UK adequacy regulations (for example for PostHog's EU cloud), on the UK-US data bridge where the provider is certified under it, or on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses in the provider's data processing terms. The sub-processor list shows the location and safeguard for each provider.
6. How long we keep it
Check results, job run events and monitor logs are deleted by a daily job once they are older than your plan's retention period:
| Plan | Monitoring history kept for |
|---|---|
| Free | 7 days |
| Starter | 90 days |
| Enterprise | 365 days |
- Everything else in your account (configuration, issues, alert history, tickets) is kept until you delete it or delete your account.
- Contact and early-access submissions are kept until they are deleted; we will set a fixed period and state it here.
- Billing records are kept for as long as accounting law requires.
7. Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent at any time (for analytics: Cookie settings in the footer).
You can change most account details in your account settings. For anything else, write to us through the contact form or the privacy contact in the Contact section below. We reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.
8. Security
Keys and tokens are stored only as hashes, integration secrets are encrypted, two-factor sign-in is available, sign-in is rate limited and AI diagnosis sees only redacted data. Our security page lists the controls in place.
9. Children
FastMonitor is a service for businesses and is not directed at anyone under 18.
10. Changes to this policy
We post every change on this page with a new version and date, and we email account holders about material changes.
11. Contact
Privacy requests: [to be confirmed], or the contact form.