Privacy Policy

FastBuyr (“we”, “us”) provides a sales-automation platform at app.fastbuyr.com. This policy covers that application and this website.

FastBuyr is operated by Digital Brain Media.

You are the controller of the contact data you upload or discover through the platform. We process it on your instructions in order to provide the service.

If you connect a Gmail or Google Workspace mailbox, you approve access on Google’s own consent screen. We request two scopes and no others:

We do not request https://mail.google.com/, which is what SMTP and IMAP access would require. It grants read, write and delete over an entire mailbox in order to send one message, and nothing this product does needs the power to destroy your mail. Sending goes through the Gmail API instead, specifically so that scope is never asked for.

gmail.readonly is technically able to read an entire mailbox. Our code does not. Reply detection runs in a fixed order, and the order is the limit:

1. We read the headers only of messages that arrived after our last checkpoint: Message-ID, In-Reply-To, References, From, Subject, Auto-Submitted, X-Autoreply, X-Autorespond, Precedence, Return-Path, Content-Type and X-Failed-Recipients. These are what distinguish a genuine reply from an out-of-office or a bounce.
2. A message is matched against a message this product actually sent, using those threading headers.
3. Only for a message that already matched do we download the message text, so it can be shown back to you on the campaign it belongs to. Stored text is truncated to 20,000 characters.

A message that answered nothing you sent is never downloaded. Your newsletters, your bank, your family, and every other ordinary message in that mailbox are counted so we can tell you reply detection is running, and are never fetched, stored or shown.

This is a limit in our code rather than one Google enforces for us, and we state it that way deliberately rather than presenting our own choice as a platform restriction.

FastBuyr’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely, and without exception, data obtained through those scopes is:

• never used for advertising of any kind;
• never sold, rented or licensed to anyone;
• never used to train, fine-tune or evaluate any artificial-intelligence or machine- learning model, ours or anyone else’s;
• never sent to an AI or large-language-model provider. Our AI features are built from your CRM records and the profile you write about your own business. No path in the software passes a Gmail message, its text, its subject or its sender to a model;
• never read by our staff, except where you explicitly ask us to investigate a specific problem, or where we are required to by law;
• never transferred to a third party except as needed to provide the service you asked for, or to comply with law.

Google mailboxes. Connection is by OAuth on Google’s own page. We never see, receive or store your Google password. What we store is the refresh token Google issues, encrypted with AES-256-GCM under a key held outside the database. It is decrypted only at the moment a message is being sent or replies are being checked.

SMTP and IMAP mailboxes. If instead you connect a mailbox by server settings, we do hold the password you supply, because the protocol requires it on every connection. It is stored in the same encrypted envelope under the same key, is never returned by any API response, never written to a log, and is decrypted only at the point of connecting. We say this plainly rather than claiming we never store passwords, because for this connection method that would not be true.

Disconnecting a Google mailbox revokes the token with Google at the same time as removing it here.

Every record belonging to a workspace is marked with that workspace’s id. PostgreSQL’s security rules enforce that boundary, and FastBuyr cannot bypass them. Your workspace is identified by your signed-in session — never from a URL or a request body you could edit. One workspace cannot read another’s contacts, replies, campaigns or usage, and that is enforced by the database rather than by application code remembering to filter.

We use a small number of processors, by category. Where a category is marked your key, nothing is sent unless you have connected your own account, and that provider bills you directly.

We do not sell personal data, and we do not share it for advertising or profiling by anyone.

We keep your data for as long as your workspace is open. There is no automatic expiry: data you have not deleted is data we still hold.

You can delete individual contacts, companies, deals and campaigns from within the application at any time, and you can disconnect a mailbox or a LinkedIn account, which removes its stored credential and — for Google — revokes the token with Google.

Deleting an entire workspace is not yet a self-service action. Email us at the address below and we will delete the workspace and everything under it, including mailbox credentials, replies, discovered leads and generated content, within 30 days, and confirm when it is done. We state this rather than describing a button that does not exist.

A small number of records are append-only and are retained for the life of the workspace because they exist to be evidence: tracking events, the audit log, records of what our crawler fetched, and the outcomes of automated rules. They are deleted with the workspace.

You may ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Write to the address below and we will respond within 30 days. Where you are a recipient of email sent by one of our customers rather than a customer yourself, we are processing your data on their behalf — write to us anyway and we will route your request to them and act on it ourselves where we can.

Every campaign email can carry a one-click unsubscribe link. Unsubscribing writes the address to a do-not-send list checked just before each send is reserved, so it takes effect on the next message rather than eventually.

Mailbox credentials and LinkedIn connection details are encrypted at rest with AES-256-GCM under a key held outside the database. Passwords are hashed with Argon2id. Sessions are held in Redis and only a hash of the session token is stored. Access to production data is limited to the people who operate the service.

No system is perfectly secure. If we become aware of a breach affecting your data, we will tell you.

Privacy questions, data requests and deletion requests: vyomananta.official@gmail.com.

See also our Terms of Service.

If we change what we access or why, we will update this page and change the date at the top. Where a change materially affects how we handle data you have already given us, we will tell account holders by email before it takes effect.