Data Processing Policy

1. Data we process

• The email address of one or more recipients when the sender chooses to deliver the link by email.
• The sender’s email address when the sender wants to receive recipient replies or view history using the management code.
• Uploaded files and folders, file names, size, retention period, link, QR code, ZIP archive and technical transfer data.
• IP address, user agent, and technical logs of errors and security events.
• Download counters for individual files and archives, recipient identifiers, limits, manual service adjustments to counters and related audit records.
• Payment data received from YooKassa: payment identifier, status, plan and purchaser email.
• Support messages, attachments to support requests, recipient replies, service feedback and service notifications.
• Partner-portal data: company, contact, website, use case, projects, hashed API keys, staff, tasks, task attachments, webhook addresses and API events.
• Paid-plan profile settings: display name, avatar hosted on a trusted FastSend domain, interface theme, 2FA and auto-renewal.
• Technical cookies and browser local storage. Optional Yandex Metrica is enabled only after separate consent and only on approved public pages.

2. Why we use the data

Data is used to create download links and QR codes, assemble ZIP archives, send email notifications to multiple recipients, show history, limit abuse, enforce plan limits, process payments and provide user support.

Security events, downloads, upload errors, email-queue status, manual counter adjustments and storage operations are used to investigate incidents, delete files, calculate limits, respond to support requests and improve service stability.

FastSend does not sell email addresses and does not use file contents for advertising profiling.

For partners, data is also used to review applications, grant API access, enforce staff roles, account for actual storage and outbound traffic, create direct download links and deliver webhook notifications.

3. Retention periods

Files are retained according to the selected plan: Free for up to 14 days, Premium for up to 31 days and Business for up to 60 days. A user can delete a transfer earlier through history using the management code.

If the sender enables deletion after the download limit, access closes as soon as the limit is reached, while physical deletion is performed automatically by the storage cleanup process.

Prepared ZIP archives may be retained as a service copy of a transfer to speed up downloads of large folders and file sets. They are deleted together with the transfer or during storage cleanup.

Technical records about payments, errors, downloads, service adjustments and security events may be kept longer when needed for accounting, support and service protection.

Partner files are retained until the date configured for the project, but not indefinitely: the default production value is 365 days and the server-side maximum is 3,650 days. The partner or FastSend may delete a transfer earlier. Service records about tasks, API events, billing and acceptance of terms may be kept longer to confirm operations and resolve disputes.

Deleting an item in the user interface places it in a physical-deletion queue. If storage is temporarily unavailable, the operation is retried until the object’s absence is confirmed; a closed link does not mean that a failed deletion operation has already been confirmed. Isolated backups, if created, are not used for ordinary access and are removed under a separate limited rotation policy.

4. Who receives data

Email is delivered through the service’s mail infrastructure. Files may be stored in S3-compatible object storage, where the service administrator can see service metadata about objects, retention and deletion. Payments are processed through YooKassa. After separate consent, analytics on approved public pages may be collected through Yandex Metrica. These providers receive only the data needed to perform their respective functions.

5. Cookies and access keys

The service may use technical cookies for sessions, CSRF protection, confirmation that a ZIP download has started, and storage of an activated premium key on the device. These cookies are required for service operation and are not intended for sale to advertising networks.

Optional analytics

Until “Allow analytics” is selected, Yandex Metrica code is not loaded, the no-JavaScript pixel is not used, and no Metrica-specific requests are made. The choice is stored for one year in the first-party cookie fastsend_analytics_consent. Refusing analytics does not limit FastSend functionality. Yandex Advertising Network/RTB, if separately enabled on the anonymous home page, is an independent advertising mechanism.

In aggregate-statistics mode, only an anonymized view of the clean anonymous home page is counted. In Webvisor mode, interactions may be recorded on that same anonymous home page and on the terms, this policy, partner terms, use cases, public API documentation, anonymous pricing and the informational investment-readiness page. On the home page, Webvisor does not start when there is an active plan key, one-time balance, private support correspondence, pending gift, Share Target state or any query parameters. The contents of all fields and form submissions are excluded from recording; areas containing email addresses, names and file paths, messages, API responses, download links, management codes, QR codes, history, support, profile and payment information are hidden completely and remain masked during dynamic page updates.

FastSend starts Metrica only on addresses without query parameters or fragments and explicitly sends a service address such as /analytics/page-name, an empty referrer and a neutral title. It does not add ecommerce data; sensitive elements are marked for exclusion before the counter loads. Analytics is strictly disabled in the admin area, partner portal, authentication pages, payment pages and payment results, file receive and download pages, and any page containing capability secrets.

With consent, third-party Yandex code may receive ordinary technical network-request data, including IP address and browser/device parameters, and may set its own cookies under its terms. According to Yandex documentation, Webvisor recordings are retained for 15 days including the current day. Consent can be withdrawn at any time; after withdrawal FastSend destroys the active counter instance, records the refusal in its own choice cookie and does not load Metrica again until new consent is given. FastSend cannot delete cookies set on Yandex domains; those must be removed in browser settings or blocked through the official Yandex Metrica opt-out.

The browser may temporarily store recently used email addresses in sessionStorage to suggest recipients in the current tab. They are removed when the tab session ends and are not sent to analytics.

To resume a large upload, the browser stores a draft in IndexedDB for no more than 24 hours: names, paths, sizes and technical fingerprints of selected files, completed form fields and a purpose-limited upload-resume key. File contents are not copied into IndexedDB. The draft can be deleted with the “Delete draft” button and is cleared automatically after a successful send. The management code, download password and file-request management link are not written to the long-lived draft.

Premium keys must not be transmitted in URLs. FastSend accepts a key through a cookie, activation form or service header to reduce the risk of the key appearing in logs and browser history.

6. User rights

A user can delete a transfer through history using the management code, request clarification about data processing, or contact i@mamaev-magomed.ru with privacy questions.

If a link has been shared with third parties, FastSend does not control further distribution of downloaded files outside the service.

8. Providers and processing location

FastSend uses providers for object storage, email, payments and — only on public marketing pages — web analytics. The provider list and infrastructure may change; before transferring data, the operator reviews the purpose, necessary scope, contractual confidentiality measures and data-location requirements.

Download, payment and file-request pages, as well as the interactive upload application, do not use third-party CDNs or analytics scripts by default. If a future configuration requires cross-border data transfer, the operator must complete any applicable notification and other legal requirements before the transfer begins and update this policy.