# Privacy Policy How TryFast handles personal data: as controller for our website, the app and your account, and as processor for the visitors of the websites our customers test. Last updated: 2026-10-25 TryFast is an A/B testing service operated by subprocess.eu/company, Osloer Str. 83, 13359 Berlin, Germany ("we", "us"). This policy explains what personal data we process, why, for how long, and what rights you have under the EU General Data Protection Regulation (GDPR). ## 1. Our two roles - **Controller** for the visitors of tryfast.eu, for the people who use the TryFast app, API or MCP server (account holders, team members, people who create a workspace without an account), and for anyone who emails us. Sections 3 to 5 describe this processing. - **Processor** for the visitors of our customers' websites. When a website runs the TryFast script, the website operator decides what is tested and is the controller; we process the data only on their behalf under our [Data Processing Agreement](data-processing-agreement.md). Section 6 summarizes this processing. If you are a visitor of such a website, the website operator's privacy notice applies, and requests about your data go to them first. ## 2. Controller and contact subprocess.eu/company\ Osloer Str. 83\ 13359 Berlin, Germany\ Email: legal@tryfast.eu The person responsible is Liam van der Viven, reachable at liam@tryfast.eu. We have not appointed a data protection officer, as we are not required to (§ 38 BDSG); privacy questions go to legal@tryfast.eu. ## 3. Our website The public pages of tryfast.eu (landing page, pricing, documentation, legal pages, the live numbers page) set no cookies and run no analytics, advertising or tracking scripts. Fonts and images are served from our own server. - **No access logs.** Our web server does not write access logs. Your IP address is used only in memory, to apply rate limits against abuse, and is not stored. Application logs record errors and background jobs and never contain IP addresses. - **Anonymous page-view counts.** We count page views of tryfast.eu as one anonymous number per hostname. Before a request is counted, the web server removes its IP address, headers, cookies and query string; only the running count is kept, never the individual request. ## 4. Accounts, the app, the API and the MCP server ### 4.1 Sign-in with login0 You sign in to TryFast with login0 (accounts.login0.eu), the sign-in service that subprocess.eu/company operates for its products on the same infrastructure as TryFast. login0 stores your login details (email address, name, password hash or passkey, second factor) and requires every user to set up two-factor authentication or a passkey at first sign-in. Emails that login0 sends (email verification, password reset, account setup when you are invited) are delivered through Amazon Simple Email Service in the AWS region eu-central-1 (Frankfurt). When you sign in, TryFast receives and stores your login0 user id, email address (lowercased), name, and the time of your last sign-in. An email address you change at login0 is updated in TryFast at your next sign-in. ### 4.2 Workspaces and your team We store your workspace memberships and roles. When an owner or admin invites someone, we store the invitee's email address, role and the inviter for 14 days; if the invited person has no login0 account yet, we create one at login0 so that login0 can send them an email to set it up. TryFast itself does not send emails. ### 4.3 What you create Projects (website domains and settings), experiments, variations including the CSS, JavaScript and HTML you write, goals, audiences, results, preview and editor links. Every change is written to the workspace's activity log with who made it: the person's email address, the name of an API key, or an AI agent together with the person it acts for (for example "Claude for ana@acme-shop.de"). ### 4.4 Workspaces without an account You can start without an account. The browser that creates such a workspace receives the cookie `tryfast_grant`, and you receive a recovery link containing a secret token; we store only hashes of both. The cookie stays valid for 90 days after the browser last used it, so that browser can still open and save a paused workspace. Anyone with the recovery link can open and save the workspace, so keep it private. A workspace without an account that was never used is deleted after 24 hours; one that is not used for 30 days is paused, and one that is not used for 90 days is deleted with all its data. Saving it to an account (signing in) stops this. ### 4.5 API keys and AI agents For API keys we store a name, a hash of the key, its first characters for display, its permission level, who created it and when it was last used. When you connect an AI agent (for example Claude, ChatGPT or Cursor), we store the agent's registration (its name, website and redirect addresses), the permissions you granted, which person or browser granted them, hashes of its tokens and when it was last used. We store no IP addresses of agents. The data an agent reads through TryFast is sent to the AI provider you chose to use; that is governed by your agreement with that provider. ### 4.6 Cookies and browser storage in the app The app at tryfast.eu/app uses only cookies and browser storage it needs to work: | Name | Type | Purpose | Lifetime | |---|---|---|---| | `tryfast_session` | cookie, HttpOnly | keeps you signed in | 30 days | | `tryfast_grant` | cookie, HttpOnly | lets the browser that created a workspace without an account open it | 90 days after your last use, renewed while you use it | | `tryfast_returning` | cookie | records that this browser has signed in before, so the app offers sign-in instead of creating a new workspace | 1 year | | `state`, `pkce` | cookies | protect the sign-in redirect against forgery | 30 minutes; both are removed when sign-in completes | | `tryfast.editTokens` | local storage | a copy of the recovery tokens of workspaces created in this browser | until you remove it | | `tryfast.lastWorkspace` | local storage | opens the workspace you used last | until you remove it | | `tryfast.theme` | local storage | your light or dark theme choice | until you remove it | | `tryfast.drafts` | local storage | unsaved code you are editing | until saved or discarded | | `tryfast.dismissed` | local storage | notices you dismissed, such as the card with your workspace link, so they stay hidden | until you remove it | | `tryfast.invite` | session storage | the invitation from the link you opened, while you sign in to accept it | until you accept the invitation or close the tab | | `tryfast.claimBannerHidden` | session storage | that you hid the banner asking you to save your workspace to an account | until you close the tab | | `tryfast.chunkReload` | session storage | when the app last reloaded itself to load a new version after an update, so it does that at most once a minute | until you close the tab | The host `cdn.tryfast.eu`, which serves the scripts for our customers' websites, never reads or sets cookies. ### 4.7 Email Email you send to our addresses (support@, legal@, security@, liam@tryfast.eu) is received by our mail forwarder in Germany and forwarded to our support mailbox, which is hosted by Google Workspace (Google Cloud EMEA Limited, Ireland; see section 9 for transfers). We keep correspondence as long as needed to answer it and as required by commercial and tax law. ### 4.8 Paid plans For paid plans we process billing details (company name, billing address, VAT ID, contact email) and issue invoices by email. ## 5. Purposes and legal bases - Providing TryFast, your account, workspaces, the API and the MCP server: Art. 6(1)(b) GDPR (contract and pre-contractual steps, including starting without an account). - Team features (invitations, roles, activity log): Art. 6(1)(b) GDPR towards the account holder, and Art. 6(1)(f) GDPR (our customers' and our legitimate interest in working together and in a reliable record of changes) for invited team members. - Security, abuse prevention and rate limits: Art. 6(1)(f) GDPR (legitimate interest in the security of our service and of our customers' websites). - Anonymous page-view counts and service statistics: Art. 6(1)(f) GDPR (legitimate interest in operating and sizing the service). - Billing and accounting: Art. 6(1)(c) GDPR (legal obligations under commercial and tax law). - Answering your emails: Art. 6(1)(b) or (f) GDPR, depending on the request. - Cookies and browser storage in the app: strictly necessary to provide the service you request (§ 25(2) No. 2 TDDDG); the related processing is based on Art. 6(1)(b) GDPR. ## 6. Visitor data we process for our customers When a website runs the TryFast script, we process the following on behalf of the website operator. The [Data Processing Agreement](data-processing-agreement.md) governs this processing, and [Privacy and consent](../docs/privacy-and-consent.md) documents every detail. - **Consent first by default.** New projects wait for the visitor's consent: before it, the script stores nothing in the browser, sends nothing, and shows the original page. The website operator chooses the consent mode and is responsible for it. - **In the visitor's browser:** after consent, a random visitor id in a first-party cookie (`tf_vid`, expiring at most 390 days after it was created; visits never extend it) and in local storage, plus local storage entries for the variations the visitor was shown, the current visit and unsent events. Attributes the website sets for targeting stay in the browser and are not sent to us. - **Sent to us:** the visitor id, a visit id, page URLs reduced to origin, path and `utm_*` parameters, the referrer's origin, device class, browser family, new or returning, traffic type, which experiment variations were shown, and conversions defined by the website operator (goal key, optionally revenue, currency, order id and up to 10 properties). - **Not stored:** IP addresses (used only in memory for rate limits and discarded) and the full user agent (used only to filter bots and to determine the device class and browser family). - **No cross-site tracking.** The visitor id is a first-party value of each website, and our event database stores it only as a hash computed per project, so the same browser on two websites that use TryFast cannot be linked. We never sell visitor data or use it for advertising. - **Opt-out:** any visitor can stop TryFast on a website by opening it with `?tf_optout=1` in the address, or through the website's own opt-out. ## 7. Retention - Account data: until you delete your TryFast account. Your activity log entries then remain, labelled "deleted user". - Sign-in sessions: 30 days. Invitations: 14 days. Single-use links for the visual editor: 10 minutes. Stored request replays (idempotency): 24 hours. - AI agent connections: authorization codes 60 seconds, access tokens 1 hour, refresh tokens 30 days without use; expired tokens are deleted after 7 days. - Workspaces without an account: deleted 24 hours after creation if never used, paused after 30 days without use, deleted after 90 days without use. - Activity log: 2 years, also after a workspace is deleted, as an audit trail. - Customer website visitors (section 6): raw event logs 30 days; per-visitor experiment data while the experiment runs and 90 days after it stops; daily visit data 35 days; hashed order ids 90 days; the monthly tested-visitor list for the current month (the previous month until the 3rd); the recent events view 24 hours, in memory only. Totals without visitor data are kept 400 days, experiment results until deleted. - Backups: deleted data leaves the backups of the application database within 2 days and the backups of the event database and raw logs within 35 days. - Email correspondence and invoices: as required by commercial and tax law (up to 10 years for invoices and accounting records). ## 8. Recipients We use a small number of subprocessors, listed with their roles and locations at [Subprocessors](subprocessors.md): Hetzner Online GmbH (servers in Nuremberg and backup storage in Germany), our own mail forwarder for inbound email, Google Cloud EMEA Limited for our support mailbox (Google Workspace), and Amazon Web Services EMEA SARL for the emails of our sign-in service. Members of your workspace see the workspace's data and activity log. We do not sell or share personal data for advertising. Data your AI agent reads goes to the AI provider you chose; data the TryFast script passes to your website's dataLayer goes to the tools you configured there. ## 9. International transfers TryFast is hosted in Germany (Hetzner Online GmbH: servers in Nuremberg, backups in Hetzner Object Storage in Germany), and we do not transfer visitor data or project data to third countries. Two providers can involve a third country: - **Email you send us.** Our support mailbox is hosted by Google Workspace, provided by Google Cloud EMEA Limited (Ireland). Google states that it may store and process Workspace data in the EU and the US. The safeguard is Google's Cloud Data Processing Addendum, which includes the EU Standard Contractual Clauses. This concerns only the emails you send us and what you include in them. - **Sign-in emails.** Amazon Web Services EMEA SARL (Luxembourg) delivers the emails of our sign-in service from the EU region eu-central-1; as AWS belongs to a US group, its Data Processing Addendum includes the EU Standard Contractual Clauses as a safeguard for any access from outside the EU. ## 10. Your rights You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Contact legal@tryfast.eu. Many of these you can exercise yourself: export through the API, delete your account in the app. You also have the right to lodge a complaint with a supervisory authority; the authority responsible for us is the Berliner Beauftragte fuer Datenschutz und Informationsfreiheit. If you are a visitor of a website that uses TryFast, please contact the website operator; we support them in answering your request. ## 11. Security All connections are encrypted with TLS, secrets are stored only as hashes, and access to production systems is limited to the named operator. The [compliance page](compliance.md) describes our security measures in full. ## 12. No automated decisions We make no decisions with legal or similarly significant effects based solely on automated processing. Assigning a website visitor to a variation is random and is not a decision about that person. ## 13. Children TryFast is a service for businesses and is not directed at children. ## 14. Changes We publish updates to this policy on this page and change the date above. Material changes are announced to account holders by email.