FastHook Privacy Policy

This policy explains how FastHook processes data to run app automations and webhook delivery, manage connected accounts, show execution history, provide MCP tools and the stats extension, and operate its website and support.

1. Scope

This Privacy Policy applies to www.fasthook.io, dashboard.fasthook.io,mcp.fasthook.io, FastHook APIs, Workflows and connected-app integrations, the FastHook ChatGPT plugin and MCP integration, and thefasthook.io stats Chrome extension.

2. Data We Collect

• Account and authentication data: email address, profile details, and identity tokens required to sign in (including Google Sign-In credentials).
• Workspace and team data: team identifiers and access control context needed to return your team resources, connected accounts, workflow configuration, execution history, and statistics.
• Operational usage data: API activity, execution status, timing, errors, selected time ranges, and response metadata needed to operate the service and show workflow, request, and event activity.
• Workflow configuration and test data: workflow graphs, immutable versions, selected app operations and resources, schedules, conditions, field mappings, transformations, and sample inputs supplied for configuration or testing. Inline values and samples may contain personal or confidential information.
• Workflow execution data: Trigger inputs, resolved Action inputs, Step outputs and provider responses, run and Step identifiers, status, timing, attempts, errors, and routing outcomes. Data from an earlier Step may become input to later Steps according to your configured mappings and conditions.
• Connected-account data: provider account and installation identifiers, authorized scopes, resource selections, OAuth tokens or API credentials, and connection status. FastHook uses these to subscribe to events, load resource choices, test supported operations, and execute configured Actions.
• Webhook and routing data: request methods, paths, query values, headers, payload bodies, delivery status, destination responses, saved fixtures, and replay instructions supplied by you or by services you connect to FastHook. This data may contain personal data chosen by the sender of the webhook.
• MCP and ChatGPT integration data: the FastHook workspace you authorize, requested OAuth scopes, tool inputs, and the minimum FastHook records needed to answer the tool request. Authentication secrets and sensitive header values are not returned in MCP tool results.
• Google Workspace integration data: when you connect a Google account and configure a workflow, FastHook receives OAuth credentials and the Google data needed to run that workflow. Depending on the feature you select, this may include Gmail message metadata, labels, message bodies, sent-message data, and attachment metadata or contents; Google Drive file and folder metadata or file contents; and Google Sheets spreadsheet metadata, sheet values, and row data; Calendar event details, attendees, and calendar identifiers; Forms structure, question and response data; and Workspace group, membership, alias, and settings data for authorized administrative operations. The data processed depends on the selected feature and granted permissions. FastHook does not access this data unless you connect the account and configure the corresponding Trigger or Action.
• Slack integration data: when you connect a Slack workspace and configure a Trigger or Action, FastHook receives workspace and installation identifiers, OAuth credentials, and the Slack data needed for that Trigger or Action. Depending on the operation, data can include messages, channel and member identifiers, mentions, reactions, file metadata, pins, custom emoji, user groups, and workspace changes. FastHook does not download Slack file contents unless a user-facing feature explicitly requests and discloses that access.
• HubSpot integration data: when you connect a HubSpot account and configure a Trigger or Action, FastHook receives the HubSpot account and installation identifiers, granted scopes, encrypted OAuth credentials, and the data needed for the selected operation. Depending on the selected event or Action, data may include CRM object identifiers, timestamps, changed property names and values, associations, and conversation messages or metadata for contacts, companies, deals, tickets, products, line items, and conversations.
• Technical data: server logs, IP address, browser/extension version, and diagnostic error information for security and reliability.
• Analytics and advertising data: Google Analytics and Google Ads may process page views, interactions, registrations, campaign parameters, referring website hostname, landing page path, and a FastHook account identifier that does not contain your email address. We use this data to measure website acquisition and advertising effectiveness.

3. How We Use Data

• Authenticate users and protect account access.
• Execute the Triggers, Actions, mappings, conditions, transformations, delays, and schedules you configure.
• Test supported Steps using selected sample or upstream data; tests may call connected services.
• Store workflow versions and run evidence to display results, troubleshoot errors, and support recovery.
• Provide workflow, webhook request, and event activity in the dashboard and counters in the extension.
• Inspect, trace, save, and replay webhook records when you explicitly invoke an MCP tool.
• Poll or receive notifications for user-configured Gmail, Google Drive, and Google Sheets triggers; retrieve matching data; create the requested FastHook event; and send email through Gmail only when the user configures that Action.
• Receive subscribed Slack events, apply configured filters, execute selected Slack Actions, and retain the execution evidence needed for history and troubleshooting.
• Receive subscribed HubSpot events, verify HubSpot request signatures, apply user-configured event and property selections, execute supported HubSpot Actions, and retain the evidence needed for history and troubleshooting.
• Operate, secure, and improve FastHook services.
• Measure website acquisition and advertising effectiveness.
• Investigate abuse, fraud, and security incidents.
• Comply with legal obligations.

4. Chrome Extension Specifics

The fasthook.io stats extension is limited to one purpose: showing FastHook request and event counters for an authorized team.

• It stores extension settings and session token in Chrome extension storage so the widget can load data.
• It uses Google OAuth only to authenticate the user and obtain access to FastHook services.
• It does not collect browsing history, page content, keystrokes, personal communications, or unrelated website data.

5. Google API Limited Use Disclosure

FastHook's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google user data is used only to provide or improve the user-facing feature the user selected.
• Google user data is not sold, used for advertising, or used to train generalized AI or ML models.
• Humans do not read Google user data except with the user's affirmative permission, when required for security or abuse investigation, to comply with applicable law, or when the data has been aggregated and anonymized for internal operations.
• FastHook requests read-only Gmail and Drive access for triggers, read-only Google Sheets access for sheet triggers, and operation-specific permissions for Actions the user selects. Write or send operations require the relevant provider authorization; an account connection does not grant access to every resource.

6. Sharing and Disclosure

We do not sell personal data.

We may share data only when necessary with:

• Infrastructure and hosting providers that operate FastHook services.
• Authentication providers used for sign-in.
• OpenAI or another MCP client provider when you connect FastHook and invoke its tools. The client receives only the sanitized tool result needed to answer your request and processes it under its own terms and privacy policy.
• Transport Destinations you configure, such as HTTP endpoints or object storage, and provider Actions such as Slack, Telegram, or Google Sheets, when you configure and run an automation, test an Action, or route or replay webhook data. Mapped fields and applicable provider responses can pass between Steps and connected services.
• Google data may be delivered to the FastHook Source, Workflow Action, or transport Destination you explicitly select. Our infrastructure providers may process it only as needed to operate FastHook and under contractual security and confidentiality controls.
• Google Analytics and Google Ads to measure site use, acquisition sources, and registrations.
• Legal authorities when required by law, regulation, or valid legal process.

Garmin Connect data and optional AI processing

Garmin Connect may provide the activity, health, location, training, courses and Women's Health data you authorize. FastHook uses it to run the workflows you configure. Connecting Garmin does not grant permission to process that data with AI. Built-in AI processing of a Garmin workflow requires separate, optional consent in Settings / Connected accounts / AI data permission. It is off by default.

With that consent, the Garmin data selected for an AI step may be sent to Cloudflare Workers AI for one-off inference, such as summarization or translation. Build with AI also checks this permission when editing a Garmin workflow because its document can contain samples. Protected requests disable AI Gateway content logging and caching; other AI model providers are currently blocked for these requests. FastHook does not use Garmin data, derived outputs, or conversations for AI training, evaluation, benchmarking, fine-tuning, model improvement or AI knowledge bases.

Withdraw AI permission in the same place at any time. FastHook checks it again before each future AI call, including queued calls; a request already sent cannot be recalled. Ordinary workflow execution remains available. Reconnecting after removal requires new AI consent. Outputs and workflow history remain subject to the retention and deletion controls below. Data you choose to export to another connected service is subject to that service's controls; withdrawing consent does not delete external copies.

Removing a Garmin connection stops future access and removes usable OAuth credentials. It does not itself erase existing workflow history. You can request deletion of retained Garmin data through FastHook support or delete your FastHook account. Account erasure removes owned workflow records, stored payloads and AI permission records while preserving other users' data. See the Garmin Connect privacy notice and Cloudflare Workers AI data usage policy.

7. Data Retention

We retain account, workflow configuration, execution, connected-app, webhook, routing, and MCP authorization data only as long as needed for service delivery, the retention settings of the applicable FastHook plan or feature, security, legal compliance, and legitimate business operations. Temporary request bins state their shorter expiry in the product. OAuth access tokens are short lived. Google and HubSpot OAuth refresh credentials and Slack installation credentials are retained while the corresponding connection remains active and are deleted or made unusable when the connection is removed or access is revoked. Trigger cursors, channel state, and event data derived from Gmail, Drive, Sheets, Slack, or HubSpot are retained only as needed to operate the configured workflow and according to the applicable feature or plan retention period. Users can stop future access by deleting the provider connection in FastHook or revoking FastHook in their Google or Slack account settings, and can request deletion of retained account data by contacting support. MCP refresh access can be revoked by disconnecting FastHook from the MCP client or revoking the authorization. Extension-local data remains in your browser profile until removed, overwritten, or the extension is uninstalled. First-touch campaign attribution may be retained in your browser for up to 180 days. Google Analytics event-level data is retained according to the property retention setting.

Workflow versions, run records, Step outputs, test samples, and fixtures can have different retention and cleanup behavior. Database cleanup and payload-object storage lifecycles are separate. Pausing a Workflow or revoking an account stops or limits future processing; it does not by itself erase previous runs, queued work, provider-side records, or copies already delivered to another service. Transforming a later Step does not remove an inbound payload already captured. See data handling and retention.

8. Security

FastHook uses technical and organizational safeguards to protect data, including encrypted transport (HTTPS/TLS), access controls, and monitoring designed to reduce unauthorized access and misuse.

Authorized team members can inspect workflow configuration and execution evidence. Audit previews limit the size and depth of returned data and redact common sensitive field names. This cannot identify every secret embedded in free text or stored under an unexpected name. Keep unnecessary personal data and credentials out of samples, mappings, and payloads. Usable connected-account credential material is stored encrypted.

9. Your Choices and Rights

• You can pause Workflows, review configured mappings and recipients, and disconnect connected accounts.
• You can request deletion of retained personal data by contacting support.
• You can stop using the extension at any time by uninstalling it.
• You can request account or data-related support by contacting FastHook.
• You can revoke Google access in your Google account permissions panel.
• You can revoke a Slack workspace connection in FastHook Settings or from Slack's app management page.
• You can revoke a HubSpot connection in FastHook or uninstall FastHook from HubSpot's Connected Apps page.
• You can disconnect FastHook from ChatGPT or another MCP client to revoke its ongoing access.

10. Children's Privacy

FastHook services are not intended for children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date on this page.

12. Contact

For privacy questions or requests, contact us at support@fasthook.io.

You can also access FastHook services at dashboard.fasthook.io.