Privacy Policy

Last Updated: September 11, 2026

This Privacy Policy explains how Presot Matteo ("we", "our", or "us") collects, uses, discloses, and protects your personal data when you visit our website (fast8d.com) and when you use our multi-tenant SaaS application (app.fast8d.com) for tracking and resolving manufacturing production complaints via the 8D methodology.

We act as the Data Controller for the data processed when you browse our website and manage your account. When Tenant Owners invite users and manage operational complaint workflows within their tenant space, the Tenant Owner may also act as a Data Controller, and we act as a Data Processor regarding that tenant's internal operations.

1. Data We Collect and How We Collect It

We limit the collection of personal data to what is strictly necessary to provide our services.

A. For Standard Users (End-Users)

Registration & Authentication (AWS Cognito): We collect your name and email address. This data is processed securely through AWS Cognito to manage your login, generate secure access tokens, and apply custom access claims.
Profile & Application Usage: Inside the application, your profile contains only your name and email.
Tenant Invites: Your email address is visible to your Tenant Owner (who issued the invitation) to manage access and collaboration within the same tenant.

B. For Tenant Owners (Account Holders)

Tenant Configuration: We collect a specific administrative email address for the tenant profile.
Billing and Payment Information (Stripe): To process invoices and payments, we collect billing details (e.g., Company Name, Billing Address, VAT/Tax ID) and payment methods. This sensitive transactional data is shared with and securely processed directly by our third-party payment gateway, Stripe.

C. Automatically Collected Data

Security & Anti-Bot (AWS WAF): We process telemetry data, network requests, and device signatures when you submit forms (login, contact forms) to prevent spam, bot scraping, and cyber attacks.
Analytics (Google Analytics): On our public marketing site only, we collect anonymous browsing data (e.g., pages visited, device type) to analyze traffic, subject to your explicit cookie consent.

2. Legal Basis for Processing

Under the GDPR, we rely on the following legal bases to process your personal data:

Performance of a Contract (Art. 6(1)(b) GDPR): Processing your login credentials (AWS Cognito), profile information, and tenant billing details (Stripe) is necessary to deliver the SaaS platform services you requested.
Legitimate Interests (Art. 6(1)(f) GDPR): We process operational notifications (e.g., 8D claim approvals, system invitations) and use AWS WAF to maintain the platform's security, stability, and effective business communication.
Consent (Art. 6(1)(a) GDPR): On our marketing website, we only run Google Analytics or send voluntary marketing newsletters/product updates if you give us your explicit opt-in consent.

3. How We Use Your Personal Data

We use your data strictly for the following operational purposes:

To authenticate your identity and maintain a secure session.
To operate the 8D production complaint tracking workflows (e.g., sending an email when a user requests approval for a specific claim).
To handle user invitations within designated tenants.
To process financial invoices and prevent payment fraud.
To provide customer support when you contact us with inquiries.
To send product updates or newsletters, provided you have opted in.

We do not sell your personal data. We only share your data with trusted service providers essential to running our platform:

Amazon Web Services (AWS): For cloud infrastructure, database storage, authentication (Cognito), application security, and anti-bot verification (AWS WAF).
Stripe: For secure processing of open invoices, credit card transactions, and payment tokenization.
Google LLC: For optional website traffic analytics (Google Analytics).

Within a tenant workspace, users share visibility of names and email addresses with their Tenant Owner and authorized peers to coordinate production complaint tracking.

5. Data Transfers Outside the European Union (EU)

Your core application data, user accounts, and 8D complaint logs are stored infrastructure-wise within the European Union, specifically in the AWS Europe (Milan) region (eu-south-1).

Some of our third-party sub-processors (such as Stripe and Google) may process metadata or transactional information in the United States. To guarantee a GDPR-compliant level of data protection:

Google operates under the EU-U.S. Data Privacy Framework.
AWS and Stripe utilize Standard Contractual Clauses (SCCs) approved by the European Commission.

6. Data Retention and Portability Requests

We retain your personal data only as long as necessary to fulfill the purposes outlined in this policy:

Active Accounts: Core user profile and tenant data are kept as long as your account or tenant subscription is active.
On-Demand Data Export (Account Active): You can request a copy of your personal data at any time without closing your account. Once requested, a secure download link will be generated. This link will expire after 2 days for security, but the export file is stored safely on our servers for 14 days before being purged. Within this 14-day window, you can contact us to have the link resent.
Account Deletion Flow: When you choose to close your account permanently, you will be offered the option to export your data one last time under the exact same conditions (link valid for 2 days, files kept for 14 days for safety before total deletion). If you decline the export, your operational data and AWS Cognito profiles are permanently erased immediately.
Legal and Financial Exceptions: Please note that financial transaction records, invoices, and billing histories processed via Stripe cannot be deleted upon account closure. This data must be retained for up to 10 years to comply with statutory tax, legal, and accounting obligations under national law.
Session Storage / LocalStorage: Token data remains on your local device until you log out or clear your browser's data.

As an EU resident, you have the following rights regarding your personal data:

Right of Access & Portability: You have the right to request and export a copy of your personal data in a structured, machine-readable format at any time, directly through your dashboard settings and without needing to close your account.
Right to Rectification: You can update or correct your profile data directly inside the SaaS application.
Right to Erasure ("Right to be Forgotten"): You can request the permanent deletion of your account and related operational data at any time through your dashboard settings.

To exercise any of these rights, or if you encounter issues during the self-service export or deletion process, please contact us at: privacy@fast8d.com.

8. Contact Information

For any questions about this Privacy Policy or our privacy practices, please contact us:

Data Controller: Presot Matteo
Registered Address: Via Germania 4, 10043 Orbassano Torino (IT)
VAT / Tax ID: 12549690019
Privacy Email: privacy@fast8d.com
Support Email: support@fast8d.com