Legal
Privacy
RevFast is the controller for your workspace account. You are the controller for visitor events you send us. We do not sell visitor data. Last updated 22 September 2026.
What we collect
Account data: email, hashed password or Google account id, site URL, plan, and billing status. Event data you send through script.js (cookie mode) or script.cookieless.js: pageviews, goals, purchases, referrers, and device/geo derived from the request. Payment for RevFast itself is processed by Stripe or Polar — we store plan status, not full card numbers.
Legal basis
We process account and billing data to perform the contract (run your workspace). We process security logs and abuse prevention as legitimate interests. You are responsible for a lawful basis for visitor analytics on sites you connect, including cookie consent where that applies.
Where it lives
Production hosts are in the United States (Vultr). Accounts live in PostgreSQL. Events live in ClickHouse. Redis holds rate-limit counters. Backups are written to disk on the same host. Data may transfer from the EU to the US to provide the service.
Subprocessors
Stripe and Polar (billing), Resend (transactional email, when configured), Google (optional sign-in and Search Console), Vultr (hosting). We do not send visitor event streams to advertising networks.
Retention
Events stay in ClickHouse for the retention on your plan (about three years on Starter, five on Growth). Account data stays until you delete the workspace. Delete from Settings → Privacy & data removes the account from PostgreSQL and issues ClickHouse deletes for your site ids.
Your controls
Export or delete from Settings. Email hello@revfast.app for a data processing addendum or to exercise GDPR rights if the in-app tools are not enough.