Privacy Policy

Last updated: 31 October 2026

The short version

• We collect what is needed to run FastGen, keep it secure and bill for it, and nothing more.
• We never sell your data, show you advertising, or use your photographs, headlines or fonts to train any AI model.
• Your organization’s templates, photographs and fonts are visible only to your organization.
• Photographs leave our servers only when someone chooses to use an AI feature.
• FastGen’s own cookies are only those needed to sign you in securely. Analytics runs only if you accept it in the cookie banner, and FastGen’s newsletter, which you can leave at any time, records whether it is opened.

1. Who we are

This service is provided by FastGen, Kaptanpaşa Mah., Halit Ziya Türkkan Sk. No:5, 34384 Şişli/İstanbul/Türkiye (“FastGen”, “we”, “us”). We are responsible, as data controller, for the personal data described in this policy, except as explained in section 2. You can contact us about anything in it at hi@fastgenplus.com.

2. Our two roles

Your account and our website. For information about the people who use FastGen, such as account details, sign-in, billing, support and our newsletter, we decide how it is used, and this policy applies in full.

What your organization creates. The photographs, headlines and other content your organization puts into FastGen may include information about other people, such as someone shown in a news photograph. For that content, your organization decides what is used and why, and we process it on its behalf, only to provide the service, under our Terms & Conditions. Questions about that content are best sent to the organization that published it, and we will help it respond.

3. What we collect

Information you or your admin give us

• Account details: your name, email address and role; your password, which we store only in a scrambled form that cannot be turned back into it; and a profile photo if you add one. If an admin invites or adds you, they give us your name, email address and role.
• Sign-in security, if you use it: your two-step sign-in settings (the key shared with your authenticator app, and your backup codes, stored scrambled); your passkeys (only the public half of each key, the device’s name, and when it was added and last used, while the private half never leaves your device); and the browsers you chose to trust (stored scrambled).
• Organization and billing details: your organization’s name, plan, and trial or plan dates; and, if your owner provides them, the name, address, country, tax number and email address to put on invoices.
• Your content: templates, photographs, logos, headlines, uploaded fonts, brand colours, folders and editor permissions.
• Messages to us: if you write to us through the Contact us page, your name, email address, organization, role, plan and message, which reach us by email.

Information created as you use FastGen

• Activity and usage: when you last signed in and were last active; a daily count, per organization, of posters exported and AI images made (the number, not which posters); and which announcements you have seen inside FastGen.
• Administration log: a record of significant actions, such as a member being added, a password being reset, a passkey being added or a plan being activated, including the email address of the person involved.
• Fault records: when something breaks, the error, where in our code it happened, the page, and which organization and account were affected. We deliberately do not record what was being sent at the time, because that could capture passwords or unpublished work.
• Internet address (IP) and security counters: to slow down password guessing and abuse, we count attempts per internet address and, for sign-in, per email address. These counters are deleted within two hours. Our hosting provider’s web server also keeps standard access logs (internet address, time, page requested and browser type) for a limited period, for security and to keep the server running.
• Newsletter reports: for each FastGen newsletter we send you, whether your mail server accepted it, whether and when you opened it, and which of its links you followed. Each copy contains a tiny image and routes its links through FastGen to record this. If your mail app blocks images, opens are not counted.

Information from others

• Google: if you choose “Continue with Google”, it tells us your name, your email address, whether it has confirmed it, and an account identifier. We receive nothing else from it, such as your contacts or files.

4. Why we use it, and our legal grounds

• To provide FastGen: to create and run your account, keep your organization’s library, draw your posters, send the emails the service needs (confirmations, invitations, password resets and security notices) and give support. Grounds: performing our contract with your organization, and our legitimate interest in providing the service to its users.
• To keep accounts and the service secure: attempt limits, two-step sign-in, passkeys, the administration log and fault records. Grounds: our legitimate interest in protecting FastGen and the people who use it.
• To bill fairly: plan allowances, usage counts and invoices. Grounds: our contract, and our legal obligations for accounting and tax.
• To improve FastGen: understanding which features are used, and fixing faults. Grounds: our legitimate interest in improving the service.
• To send FastGen’s newsletter: news about features, tips and updates, and whether it is read, so the next one is more useful. People with a FastGen account receive it unless they unsubscribe. Grounds: our legitimate interest in keeping customers informed about the service they use. You can object at any time by unsubscribing.
• To meet legal obligations: responding to lawful requests from authorities, and keeping the records the law requires. Grounds: legal obligation.

We do not make decisions about you based solely on automated processing, and we do not build advertising profiles.

5. Cookies and similar technologies

FastGen itself uses only cookies that are strictly necessary to sign you in and keep your account secure:

• fastgen_session keeps you signed in. It holds a random value, not your details, and lasts 30 days or until you sign out.
• fastgen_trusted is set only if you tick “Trust this browser” when entering a two-step code, so that browser is not asked for a code for 30 days. It is sent only to the sign-in part of FastGen.
• fastgen_oauth is set for up to 10 minutes while you sign in with Google, to make sure the sign-in you finish is the one you started.
• fastgen_consent remembers, for 180 days, whether you accepted or declined analytics in the cookie banner.

Because these cookies are needed for the service to work securely, they do not require consent.

FastGen also saves a few preferences in your own browser: your language, your export format, the template you had open, how your library is sorted, your recently used colours and your preferred AI provider. They stay on your device and are not sent to us.

Analytics. We may use an analytics service, such as Google Analytics, to understand how visitors use our pages, for example which pages are visited, whether a new account was created and how it was created (by email or through a sign-in provider such as Google), the type of device, and the approximate country based on the internet address. When we do, that service may set its own cookies. Where the law requires consent, it runs only after you accept it in the cookie banner that appears when you visit our pages. You can change your choice at any time with the “Cookies” link at the foot of the page, and declining removes the cookies analytics services leave in your browser. Analytics never receives the content of your templates or photographs.

Fonts from other services. The editor loads some typefaces directly from Google Fonts and Fontshare, so your browser contacts those services, which can see your internet address and browser type. They receive nothing about your account or your work. Fonts your organization uploads are served by FastGen itself.

6. Who else receives personal data

We do not sell personal data, or share it with anyone for their own marketing. We share it only with the service providers that help us run FastGen, each for a specific purpose and each required to protect it:

• Hosting: our hosting provider, Matic Hosting, runs the servers where FastGen and its data are stored, in the European Union.
• Email delivery: the provider we use to send FastGen’s emails receives each recipient’s address and the message.
• AI providers (currently fal.ai, and Stability AI where enabled) receive, only when a user chooses an AI feature, what that feature needs: a photograph with the size it should become or the part to change, or, for a new image, the description the user wrote and its size. No name, email address or account detail is sent with it. If no one in your organization uses AI features, nothing of yours ever reaches them.
• Google, only as described in section 3, if you sign in with it.
• Analytics, if we use it, as described in section 5.

Within FastGen, your organization’s admins can see your name, email address, role and when you were last active, and your organization’s templates are shared with its members. FastGen support can view the service as a particular user, for example to solve a problem they report. Each such visit is time-limited and recorded in the administration log.

We may also disclose information where the law requires it; where needed to protect the rights, safety or property of our users, FastGen or others; or to a buyer or successor if our business or the service is transferred, who will be bound by this policy.

7. International transfers

FastGen’s data is stored on servers in the European Union. FastGen is run from Türkiye, so the people who run and support it may access that data from there. Some of the providers above, such as AI providers and Google, may process data in other countries, including the United States. Where the law requires it, we rely on appropriate safeguards for those transfers, such as the European Commission’s Standard Contractual Clauses included in those providers’ terms.

8. How long we keep it

• Accounts: for as long as the account exists. An account whose email address is never confirmed is deleted automatically after 7 days.
• Your organization’s content: until it is deleted. A deleted template stays in “Recently deleted” for 30 days, where it can be restored, and is then removed permanently.
• Organizations whose trial or plan has ended: kept so the organization can come back, until its owner asks us to delete it or our agreement ends, as set out in our Terms & Conditions.
• Sign-in sessions and trusted browsers: 30 days, or until you sign out or forget them. Passkeys are kept until you remove them.
• Links in emails: a confirmation link works for 48 hours, a password reset for 2 hours, an invitation for 7 days, and a link confirming a new email address for 24 hours.
• Security counters with internet addresses: deleted within two hours.
• Administration log: the most recent 20,000 entries. Fault records: the most recent 300 kinds of fault.
• Usage counts, billing details and invoices: for as long as the organization exists, and afterwards for as long as tax and accounting law requires.
• Newsletter reports: kept with each newsletter until it is deleted.
• Messages to us: in our email inbox for as long as needed to answer and follow up.
• Backups: a full copy is made every day and the most recent 7 are kept, so deleted information can remain in a backup for up to 7 more days.

9. How we protect it

• All connections to FastGen are encrypted (HTTPS).
• Passwords are stored with scrypt, a deliberately slow one-way scrambling method. Nobody at FastGen can see yours, and we will never ask you for it.
• The keys FastGen uses to connect to other services are encrypted where they are stored.
• Two-step sign-in and passkeys are available on every account, and two-step sign-in is required for FastGen’s own administrator account.
• Each organization’s data is kept separate, and every request is checked against the organization it belongs to.
• Support access to customer accounts is time-limited and recorded.

No online service can guarantee perfect security. If a personal data breach is likely to put your rights at risk, we will inform you, and the relevant authority, as the law requires.

10. Your rights

Depending on where you live, you may have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected (much of it you can change yourself in your profile);
• have your data deleted;
• receive your data in a portable, machine-readable form;
• restrict or object to how we use it, including objecting at any time to our newsletter; and
• withdraw any consent you have given, without affecting what was done before.

To use any of these rights, write to hi@fastgenplus.com. We may need to confirm your identity first, and we will reply within one month, which the law allows us to extend in complex cases. If your account belongs to an organization, some requests, such as removing you from it, can also be handled by its admin. If you are not satisfied with our answer, you have the right to complain to the data protection authority in your country.

You can leave the newsletter at any time with the link at the foot of any newsletter, or in your profile. Emails your account needs, such as password resets, are still sent.

11. Children

FastGen is a professional tool for organizations. It is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We will update this policy when what we do changes. If a change is significant, we will tell you by email or in FastGen before it takes effect. The date at the top of this page shows when it last changed.

13. Contact

Questions or requests about privacy: hi@fastgenplus.com.

About FastGen · Terms & Conditions · Open FastGen