Privacy Policy

FASY Solutions, operated by GMS Agency ("FASY", "we", "us"), is a software consultancy based in Trinidad and Tobago. We build custom business software, operate a client portal at fasy.app, and run a payments platform that lets our business clients accept card payments from their customers.

We handle personal data in line with the principles of the Data Protection Act, 2011 of Trinidad and Tobago. For anything in this policy, contact us at support@fasy.app.

• Contact and booking details. When you fill a form, book a call, or request a demo: your name, email, WhatsApp number, company, and what you tell us about your project.
• Messages you send us on Instagram or WhatsApp. Your Instagram username, profile name and the account identifier Instagram gives us, or your WhatsApp number and profile name; the messages you send and receive, links to the photos, audio and files you share, and when each message was sent.
• Account data. When we create your client account: email, name, and login credentials. Passwords are stored hashed by our authentication provider; we never see them in plain text.
• Project data. Onboarding answers, files and brand assets you upload, feedback, support messages, and progress records for your project.
• Billing data. Invoices, payment status, and payout details for platform payments. Card numbers go directly to Stripe and never touch our servers.
• Buyer data on platform payments. If you buy from a business that uses our payments platform, we process your name, email, and the transaction amount as merchant of record for that payment.
• Device data for notifications. If you allow notifications on a device, the address your browser gives us to deliver them.
• Technical data. Server logs and IP addresses, kept for security and troubleshooting.

• To answer your messages and help you book a call.
• To deliver the services you hired us for and operate your workspace.
• To process payments, send invoices, and meet accounting obligations.
• To send transactional messages: invites, receipts, call reminders, project updates, support replies.
• To keep the platform secure and investigate abuse.

AI processing. Parts of our service use AI models: to answer messages (see the next section) and to draft proposals, project plans, and similar work products from the information you give us (for example, call transcripts and onboarding answers). Our AI providers process that content only to provide the service to us; we do not use your data to train models.

We do not sell your personal data. We do not send marketing messages without your consent.

Messages you send to FASY on Instagram or WhatsApp may be answered by Javi, an automated assistant powered by AI. Javi tells you it is automated in its first reply and never presents itself as a person.

• Javi answers questions about our services and helps you book a free call. It does not quote prices beyond our published starting price; the real price comes from a person, in a written proposal.
• When you share your name, business, email, or WhatsApp number in the chat, Javi saves them in our customer records so we can follow up.
• A person at FASY can read the conversation and take it over at any time. Ask for a person and Javi hands the conversation to us.
• Javi does not make decisions that have legal or similarly significant effects on you.

• WhatsApp. If you give us your WhatsApp number when you book a call, we send you messages about that call: confirmation, reminders, and changes. Reply or write to us to stop them.
• Email. Transactional email about your bookings, account, and projects.
• Push notifications. Only on devices where you turn them on in your account. You can turn them off in your browser or device settings.

• Essential. Cookies that keep you signed in to your account and remember interface choices, such as a collapsed sidebar.
• Where you came from. When you open fasy.app, we store in two first-party cookies the source, campaign, and referring site of your first visit (kept 90 days) and of your latest visit from a campaign or another site (kept 30 days). If you send us a form or book a call, that source is saved with it so we know which channel brought you.
• Meta advertising. If you arrive from one of our ads on Facebook or Instagram, we store Meta's click identifier in its _fbc cookie. When we run ads, our public pages may also load the Meta Pixel, which sets Meta's _fbp cookie and records page views, and our server uses Meta's Conversions API when you book a call or send a form. With a booking or form, we send Meta your email, phone number, and first name only in hashed form, plus your IP address and browser details, so Meta can match the visit to an ad. You can control how Meta uses this in your Meta ad preferences.
• Analytics. Vercel Analytics and Speed Insights measure traffic and performance in aggregate, without cookies.

You can delete or block cookies in your browser; the site keeps working, but you will need to sign in again.

We share data only with the providers we need to run the service, under their own security and privacy commitments:

• Supabase (database, authentication, file storage)
• Vercel (hosting and analytics)
• Stripe (payment processing and payouts)
• Resend (transactional email)
• Meta Platforms (Instagram and WhatsApp messaging, and the Meta Pixel when we run ads)
• WhatChimp (our WhatsApp Business messaging provider)
• OpenRouter and the AI model providers it routes to, such as Anthropic (writing replies and drafting work products, as described above)
• Apple, Google, and Mozilla push services (delivering push notifications you turned on)

We may also disclose data when the law requires it or to protect our rights, users, or the public.

We keep your data while your account or project is active, and keep the conversations and contact details from Instagram and WhatsApp while we have a business relationship with you or until you ask us to delete them. Billing records are kept as long as tax and accounting rules require. You can ask us to delete your data at any time; we will remove what we are not legally required to keep.

You can ask us to access, correct, export, or delete your personal data, and you can object to or restrict certain processing. Email support@fasy.app and we will respond within 30 days. If you are in a jurisdiction with specific data protection rights (such as the GDPR), we honor those rights for you.

To have us delete your data, including your Instagram or WhatsApp conversations with us, email support@fasy.app or write "delete my data" to FASY on Instagram or WhatsApp. The steps, what we delete, and what we must keep are on our data deletion page.

Data is encrypted in transit, access is scoped per workspace with row-level security, and secrets are stored separately from application data. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you without undue delay.

We operate from Trinidad and Tobago, and our infrastructure and AI providers process data primarily in the United States. By using the service you understand your data is processed in those locations.

Our services are for businesses and are not directed at anyone under 18. We do not knowingly collect data from minors. If you believe a minor has sent us their data, write to us and we will delete it.

If we make material changes, we will update the date at the top of this page and notify active clients by email. Continued use of the service after changes take effect means you accept the updated policy.