Privacy policy

1. What data we collect

• —Account and company: the company name and the owner's first name, last name, phone number and login. Passwords are stored only as a hash (bcrypt).
• —Workspace data: products (with photos and videos), orders, comments, staff and partners.
• —Customer data: the customer's name, phone number and address that the company enters into the CRM.
• —SMS verification: the phone number and a one-time code. The code is deleted automatically after 5 minutes.
• —Technical data: a request log (including IP address) and a log of staff actions in the system.
• —Facebook and Instagram (Ads section): when a targetologist connects their Facebook account — Facebook user ID and name, business account, list of Pages, lead forms and their questions, leads from ads (name, phone and other answers entered in the form), campaign, ad set and ad names. Access tokens are stored encrypted (AES-256).
• —Leads from the targetologist's own website (“Your website”): the fields the website form sends (usually name and phone).
• —Telegram: when you connect the bot — your Telegram user ID and username, and the IDs and names of groups and channels connected for lead notifications.

2. Why we use it

• —Creating the company workspace and providing access to the panels.
• —Running orders: operators, delivery and partners.
• —Confirming phone numbers with an SMS code.
• —Keeping the service secure and finding faults.
• —Delivering a lead from Facebook/Instagram or a website to the destination chosen by the targetologist: creating an order in the company CRM or sending it to the targetologist's external system (webhook).
• —Notifying the targetologist about a lead and its delivery result via Telegram (only if the targetologist enabled it).

3. Service providers

We do not sell data. The service relies on these providers:

• —GetSMS — sending verification codes by SMS.
• —DigitalOcean — servers and storage of uploaded files.
• —Vercel — hosting the fastsell.uz website.
• —Meta Platforms (Facebook, Instagram) — retrieving lead forms and leads with the targetologist's permission (Graph API).
• —Telegram — sending notifications.

4. How long data is kept

• —Account and workspace data — while the account is active or until a deletion request is completed.
• —Staff action log — 60 days, then deleted automatically.
• —SMS verification code — 5 minutes.
• —Facebook access tokens — while the account is connected. If the account is disconnected in the panel or the app is removed in Facebook settings, the tokens stop working and are deleted.
• —Leads and their delivery log — until the integration or account is deleted. Orders created from leads are company data.

5. Security

The website and API run over HTTPS, and passwords are stored as hashes. Data is kept separately for each company.

6. Facebook and Instagram data

Facebook and Instagram data is used only after the targetologist connects their account and grants permission, and only to deliver leads to the destination they choose. This data is not sold, not used for advertising and not shared with third parties — except the destination the targetologist specifies (the company CRM or their own external system).

Permission can be revoked at any time: disconnect the account in the panel (Ads → Accounts) or remove the FastSell app in Facebook → Settings → Business integrations. See the “Data deletion” page for the deletion process.

7. Your customers' data

The company is responsible for the customer data it enters into the CRM, including collecting and using it lawfully. FastSell processes this data only to provide the service to the company.

8. Your rights

• —Ask what data we hold about you.
• —Correct inaccurate data.
• —Request deletion of your account and data — see the Data deletion page.