Privacy Policy
Last updated:
In short
- We keep your account (email, name and how you sign in) on our server in Oracle Cloud’s Riyadh region.
- No analytics, no advertising and no tracking cookies.
- The Sandbox takes sample data only. Do not put real personal data in it.
1. Who we are
Fast Advanced Solutions Technologies Company (Unified National Number 7043724769, Kingdom of Saudi Arabia) runs Fastbase and decides how the personal data described here is used. You can write to us at hsa@fast.sa.
2. What we keep
- Your account: your email address, your name, how you sign in (Google or GitHub) and the identifier that sign-in gives your account. We also record when you joined, how you joined (for example with an access code or by invitation) and when you last signed in.
- Organizations: the organizations you create or join, their members and roles, and invitations (with the email address invited).
- Your projects: their names, status and settings, and what you put in them. That is sample data only (section 5). We look into a project’s content only to run, protect and support the service, and when the law requires it.
- Tokens and AI tool connections: of each API token we keep only a one-way hash (the token itself is shown once, when it is issued), which account owns it and what it may do. When you connect an AI tool, we keep a record of the connection: which tool, which organization and what it may do.
- Records of use: a log of calls to the API and of account actions: the time, which token or account made the call, the method and path called, the result and the project. It holds no request body, no SQL and no query string. A separate log of the web requests to the sign-in service holds, for each request, the time, the IP address, the method, the path without its query string, the host, the status, the size and the duration. It holds no headers and no query string. It is rolled at 10 MiB, keeping 5 files, and nothing in it is older than 28 days.
- Emails we send: a record that an email was sent (the address, the kind, the time and whether it was delivered), but not the code inside it.
- Messages to us: if you write to hsa@fast.sa, we keep your message and your address to answer you.
4. Why we use it
To sign you in, to make and run your projects, to send you invitations and notices, to keep the service working and fair (limits, abuse, the audit log), to answer you, and to meet legal duties. We do not sell personal data, use it for advertising, or use it to train AI models.
5. Sample data only
The Sandbox takes sample data only. Do not put real personal data in a project, whether it is yours or anyone else’s. Fastbase does not host real people’s personal data in the Sandbox, and we may delete a project that holds it.
6. Where your data is, and who else receives it
- Our server: your account data (email, name and sign-in identity), your organizations, your projects and what is in them are kept on our server in Oracle Cloud’s Riyadh region.
- Email: our emails are sent from Oracle’s email service in Riyadh. After an email leaves it, it travels to your mail provider, whose own rules apply.
- Backups: in Riyadh too (section 8).
- Google and GitHub: if you choose to sign in with Google or GitHub, you are sent to that company to sign in. It tells us your email address, your name and an identifier for your account there, and sometimes the address of your profile picture. That company handles your sign-in under its own terms and privacy policy, and we do not control where.
- AI tools: if you connect an AI tool (such as Claude, ChatGPT or Cursor), it receives what that tool asks for from your projects and account, for example project names, table structure, query results and logs. The tool’s vendor handles that under its own terms and privacy policy, and its servers may be outside the Kingdom. Connecting a tool is your choice.
- Authorities: we share data when a Saudi authority or court requires it by law.
- No one else. We have no analytics provider, no advertiser and no data broker.
7. Network records
Our hosting provider, Oracle Cloud, keeps flow logs of the network around our servers. A flow log records connection metadata, including IP addresses, ports and the time of a connection; it holds none of what was sent. We use these records for security and as evidence of where the service runs and what it connects to. They are kept for 30 days, in Saudi Arabia.
8. Backups, and how long we keep things
- Backups: every night we back up each project and the accounts’ database. Backups are in Riyadh: kept 14 days on our server, and 90 days in a private storage bucket in the same cloud region. A backup that holds your data goes when it expires, so your data can stay in backups for up to 14 days on the server and up to 90 days in the bucket after you or we delete it.
- Your account: while it is open. To delete it, write to hsa@fast.sa from the email address on your account. We then delete it from our live systems; copies in backups go as described above.
- Your projects: until you delete them or we remove them. When a project is deleted, its data on the server is deleted and its backups on the server go with it. Its folder (its configuration and keys, no data) is kept 14 days, then purged.
- Records of use (the audit log): 28 days.
- The sign-in log (with IP addresses): 28 days at most.
- The record of emails we send (the mail log): 90 days.
- Everything else: only as long as we need it to run and protect the service.
9. Your rights
Under the Personal Data Protection Law you can ask what we hold about you, ask for a copy, ask us to correct it or delete it, and withdraw your consent. Write to hsa@fast.sa from the email address on your account; we answer within 30 days. You can also complain to the Saudi Data and AI Authority (SDAIA).
10. Changes
We update this page when what we do changes, change the date at the top, and tell account holders about important changes by email. The Terms of Service say how you may use Fastbase.
11. Contact
Fast Advanced Solutions Technologies Company · hsa@fast.sa