Privacy Notice

Last updated: 14 July 2026

1. Who we are

Fastic is operated by Eric Hamisi ("we", "us"). For questions about this notice or your data, email . We act as the data controller for personal data you provide through the Service.

2. What we collect and why

Account data (email, display name, login credentials) — to create and secure your account. Legal basis: contract performance.
Profile & goals (weight, height, timezone, plan, targets) — to power the fasting timer, insights, and reminders. Legal basis: contract performance.
Health & activity logs (fasts, meals, water, weight, mood, body measurements, steps) — to provide the core features. Legal basis: contract performance and, where required, your explicit consent.
Meal photos & chat messages — sent to our AI provider to estimate nutrition and generate coach replies. Legal basis: contract performance.
Support messages — to answer your questions. Legal basis: legitimate interests.
Device & usage data (IP address, browser, error logs) — to keep the Service secure and reliable. Legal basis: legitimate interests.

We do not collect or store your card details. Payment data is handled directly by Paddle — see below.

3. Who we share it with

Paddle — merchant of record for our sales. Paddle handles payments, tax compliance, invoicing, subscription management, and refunds. See Paddle's privacy notice.
Hosting & database — our backend runs on Supabase (auth, database, storage). Data at rest is encrypted.
AI provider — meal photos and chat prompts are sent to our AI provider to generate responses. Prompts are not used to train the provider's public models.
Professional advisers (legal, accounting) — where necessary for legitimate business needs.
Authorities — where required by law.

4. International transfers

Some processors are located outside your country. Where transfers leave the UK/EEA we rely on Standard Contractual Clauses or an adequacy decision.

5. How long we keep it

We keep account and activity data for as long as your account is active, and for a reasonable period afterwards for legal and accounting purposes (typically up to 6 years for invoices and up to 12 months for other data). You can request deletion at any time.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, port, or object to the processing of your personal data, and to withdraw consent where processing is based on consent. To exercise any of these rights, email . We aim to respond within one month. You may also lodge a complaint with your local data-protection authority.

7. Security

We use appropriate technical and organisational measures — including encrypted transport (HTTPS), encryption at rest, row-level access controls, and least- privilege access — to protect your data. No system is 100% secure; if we ever learn of a breach affecting your data we will notify you as required by law.

8. Cookies

The Service uses only essential cookies and local storage for sign-in and preferences. We do not currently use advertising cookies.

9. Changes

If we make material changes to this notice we will let you know in the app or by email.