Your data, in plain words.

1. Who is responsible

FastFound is operated by Fast Social LLC, a limited liability company registered in New Mexico, USA. For data protection purposes, the controller of data collected through this website is the entity serving your region (see section 10). Contact for anything in this policy: privacy@fastfound.co.

Two roles, one policy. For this website, our leads and our billing, we decide how data is used — we are the controller. For data our clients give us to deliver services (their customer lists, call recordings, campaign data), we act on the client's instructions — we are their processor / service provider, and the client's own privacy notice governs. Section 9 covers that work.

2. What we collect, and why

Audit requests

When you request a free visibility audit we collect your name, work email, business name, website, what you sell, location and (optionally) phone number. We use it to produce and send the audit you asked for — that's contract/legitimate-interest territory, not marketing. Ongoing marketing emails happen only if you tick the separate opt-in box, and every one has a one-click unsubscribe.

Contact messages

Name, email and your message — used to reply. Nothing else.

Businesses we approach (B2B outreach)

Sometimes we contact a business we think we can genuinely help, before that business has contacted us. Where that happens, we did not collect the contact details from you — so here is the notice UK/EU law (GDPR Article 14) says you should get about where they came from:

• What we collect: the business's name, category and location, its public Google Business Profile information (including review count and rating), its website address, and a contact email address the business itself publishes on its own website. We never buy contact lists, and we never guess or construct email addresses — if a business doesn't publish one, we don't email it.
• Where it comes from: two sources only — Google's public business listings (the Places API) and the business's own public website.
• What we do with it: we run the same free visibility audit we offer on this site and send one email, business-to-business, sharing the results — with a working unsubscribe link and our postal address in every message.
• How stopping works, precisely. The link in the message opens a page with three choices: stop permanently, or pause for one month or three months. The page itself does nothing until you press one of them — so a link scanner or a security gateway following the link on your behalf cannot opt you out without you.
  • Stop permanently has no end date, no reminder and nothing to click later.
  • A pause stops us now and we start again on the date shown on the button before you press it. We do not email you at the end of a pause to ask whether you have changed your mind — asking that question is itself marketing, and we will not send it.
  • If your mail client offers its own one-click unsubscribe (the header your provider shows next to the sender's name), that is always permanent. You were not shown the choices there, so we treat it as a full stop rather than a pause.
  • Replying STOP to a text message is always permanent, for the same reason.
  Whichever you choose covers the address and the whole domain, not just one mailbox. A bounce or a spam complaint is always permanent.
• Starting again. Email us from any address at your own domain and we will lift it. It has to come from your domain — we will not take a third party's word that you want to hear from us — and we record what proved it.
• Lawful basis: legitimate interests (UK/EU GDPR Article 6(1)(f)) — offering relevant business services to businesses, using only information those businesses have published. We have carried out and hold a written Legitimate Interests Assessment for this activity; you can request a summary at privacy@fastfound.co. We do not approach businesses in countries whose law requires prior consent for this kind of email, and you can object at any time — the one-click link or an email both work, no questions asked.

Website

We keep this site deliberately light: no advertising trackers, no third-party ad cookies. We use Cloudflare to serve and secure the site (it processes IP addresses to do that, and gives us the country-level location that powers the region switcher), Cloudflare Turnstile for bot protection on forms, and privacy-respecting product analytics to understand aggregate usage. The region switcher stores one first-party preference cookie (ff_region) so the site remembers your choice — a functional cookie, not a tracking one.

Clients

If you become a client we additionally process account, billing and service-delivery data — covered by your Order, our Terms, and data-processing terms where applicable.

3. How the audit uses AI

The audit engine checks public information: it fetches your public website, checks public review presence, and asks AI models (via the OpenAI and Anthropic APIs) what they recommend for searches like "best [what you sell] in [your city]" to test whether you appear. Your form details (business name, website, category, location) are sent to those APIs as part of the queries. Under the API terms we use, these providers do not train their models on this data. See the AI disclosure for the full picture.

4. What we never do

• Sell your personal information, or share it for cross-context behavioural advertising. (In US state-law terms: we do not "sell" or "share" personal information, and we have not in the preceding 12 months.)
• Send you marketing without a lawful basis — the opt-in box on the audit form is genuinely optional and unticked by default.
• Use hidden trackers, buy third-party data about you, or run dark-pattern consent banners.

5. Where your data goes

We share personal data only with service providers who help us run the business, under contracts that restrict what they can do with it:

• Cloudflare — hosting, security, bot protection, region detection.
• OpenAI and Anthropic — AI processing for audits and service delivery (API terms; not used to train their models).
• Google — public business-profile and review data lookups (Places API), page-speed testing.
• Stripe — payments, if you become a client.
• Email delivery provider — sending you the audit and transactional email.
• Professional advisers, and authorities where the law genuinely requires it.

Some providers process data in the United States and other countries. Where data leaves the UK/EEA we rely on recognised safeguards (adequacy decisions, Standard Contractual Clauses / the UK IDTA or Addendum).

6. How long we keep it

• Audit requests and reports: deleted or anonymised within 12 months if you don't become a client (the working data in the audit engine is cleaned on a ~90-day cycle).
• Contact messages: up to 24 months, then deleted.
• If you are in Switzerland: the revised Federal Act on Data Protection (revFADP) applies to you rather than the GDPR. Your rights under it — access, correction, deletion, objection — are broadly the same as the GDPR rights described here, so read this policy as giving you those. Two differences worth knowing rather than discovering: Swiss law places its penalties on individuals rather than on companies, and Switzerland maintains its own list of countries it considers adequate, which is not identical to the EU's. Our processing locations are listed above and are unchanged by which of the two regimes covers you.
• Marketing list: until you unsubscribe (suppression records kept so we don't email you again).
• Outreach records (section 2): audit data on the same ~90-day cycle as requested audits; the do-not-contact list is kept permanently — deleting it would mean we could contact you again, which is the opposite of what opting out asks for. We keep with it what you were offered, which option you chose, when, and from which message, because that record is how we prove we honoured your choice. If you later ask us to start again, we keep the original opt-out on file and record the lift alongside it rather than erasing the history.
• Client and billing records: the engagement plus the period tax and company law makes us keep them (typically 6–7 years).

7. Your rights

Wherever you are, you can ask us to: access the personal data we hold about you, correct it, delete it, give you a copy in a portable format, stop using it for marketing (or object to other processing), or restrict processing while we sort out a dispute. Email privacy@fastfound.co — we verify the request, answer within one month, and don't charge for it. If we refuse (rarely, e.g. records we must legally keep), we'll say why, and you can complain to your regulator (section 10 lists them).

8. Security

Services run behind Cloudflare with zero open inbound ports on our origin infrastructure, admin access is gated by MFA-enforced access controls, credentials live in access-controlled stores, and backups are encrypted. No system is unbreakable; if a breach ever creates a risk to you, we will notify you and the relevant regulator as the law requires (72 hours under UK/EU GDPR).

9. When we process data for our clients

Client campaign data (their customer lists, call logs and recordings, message histories) is processed only on the client's documented instructions, only for their engagement, with consent verification built into sending flows (TCPA/CASL/PECR/Spam Act, depending on recipient country). AI agents that interact with people identify themselves as automated. If you believe a FastFound-operated system contacted you improperly on a client's behalf, email privacy@fastfound.co — we investigate every report and maintain global suppression lists.

10. Your region

11. The small print about the small print

• This site is not directed at children and we do not knowingly collect data from anyone under 18.
• We'll update this policy as the business grows (an EU storefront, new subprocessors). Material changes get a dated note here, and — for anything that changes how we use data you've already given us — an email.
• Postal contact: Fast Social LLC, c/o Registered Agents Inc, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, USA.