Fast MonkeyPrivacy Policy
Last updated: 25/10/2026
This policy explains how the Fast Monkey portal (app.kabrath.media), the website and the instances we operate process personal data, under Brazil’s General Data Protection Law (LGPD, Law 13.709/2018) and the Brazilian Internet Act (Law 12.965/2014).
1. Who is responsible
Controller: [legal name, tax ID and address] (“Fast Monkey”). Data Protection Officer (art. 41): [DPO e-mail].
For data about the audience of our customers’ channels (section 3), the customer is the controller and Fast Monkey acts as processor (art. 39), following the customer’s instructions.
2. Data we collect as controller
- Account: name, work e-mail, company name and password, stored only as a bcrypt hash. Date and version of the acceptance of these terms.
- Single sign-on (Google, Microsoft or your company’s provider): name, e-mail and the account identifier given by the provider. We never receive your password there.
- Team: e-mails of the people invited to your company and their role (owner, engineer, operator).
- Access and security: date of last sign-in and last activity, IP address and a record of security and administrative actions (sign-ins, changes to team, plans, licenses and instances).
- Sign-in codes: 6-digit codes sent by e-mail, stored only as a hash, single use, valid for 10 minutes.
- Billing: payments are processed by Stripe; we store only the customer and subscription identifiers and status. We never receive card numbers.
- Licenses: license key (hash) and the identifier of the machine where it was activated.
- Website contact: when you fill in a form on the site (contact, trial download request, demo or consultation) we receive name, business e-mail, company, business type, product of interest, your description of requirements, optional technical details, page, language and IP address.
3. Data we process on behalf of customers (instances)
In Fast Monkey Station instances, the player sends audience metrics to the customer’s own instance: session identifier, browser/system/device type, page and referrer, playback quality and errors. The viewer’s IP address is stored only as a salted hash and this data is kept for 30 days. The customer decides what to publish and is responsible for informing its audience. We use this data only to provide the service to that customer.
4. Purposes and legal bases (art. 7)
- Creating the account, providing the portal, instances and licenses, team management, service e-mails (codes, invitations, notices) — performance of a contract (V).
- Answering a website contact or a quote request — preliminary procedures related to a contract, at your request (V).
- Security, fraud prevention, access and audit records — legitimate interest (IX) and legal obligation (II; Internet Act art. 15).
- Billing, invoices and accounting — legal obligation (II) and performance of a contract (V).
We do not send marketing e-mails and do not use your data for advertising. If that changes, we will ask for specific consent first.
5. Who we share with
- Hosting of the portal and its database: cloud server in Brazil (Hostinger).
- Payments: Stripe (USA).
- Transactional e-mail: e-mail delivery provider used to send codes and notices.
- Instances: server and content delivery (CDN) providers used to run the instances and deliver the public video signal, which may be outside Brazil.
- Single sign-on: Google or Microsoft, only when you choose to sign in with them.
- MCR Box licenses: the partner that issues the licenses (company identifier and license data).
- Authorities: when required by law or court order.
We do not sell personal data. Transfers outside Brazil follow art. 33 of the LGPD, using the standard contractual clauses approved by the ANPD (Resolution CD/ANPD 19/2024) or another valid mechanism. The up-to-date list of processors is available from the DPO.
6. How long we keep it
- Account, team and licenses: while the account exists. When you delete it, they are erased at once.
- Access and security records: 12 months (the law requires at least 6), then deleted automatically.
- Website contacts: 24 months from the last interaction, then deleted automatically.
- Sign-in codes and password reset links: deleted automatically after they expire.
- Fiscal and payment data: for the legal period (5 years), kept by Stripe and in our accounting.
- Audience metrics of the instances: 30 days.
7. Your rights (art. 18)
Confirmation and access, correction, anonymization, blocking or deletion, portability, information about sharing and about refusing consent, and review of automated decisions. In My account → Privacy you can download your data and delete your account yourself. For anything else, write to [DPO e-mail]; we answer within 15 days. You may also complain to the ANPD (gov.br/anpd).
8. Security
Encrypted connections (HTTPS), bcrypt-hashed passwords, single-use codes, rate limiting, restricted and audited administrative access. Instance panels are not exposed on the internet: they only open through the portal, over a private encrypted tunnel, for members of the customer company. Instance credentials are stored encrypted (AES-256-GCM). If a security incident may cause relevant risk or damage, we will notify the ANPD and the affected people as set out in art. 48 and Resolution CD/ANPD 15/2024.
9. Cookies and local storage
Only what is needed to run the service — no advertising or third-party tracking cookies.
__Secure-next-auth.session-token— keeps you signed in (up to 7 days).__Host-next-auth.csrf-tokenand__Secure-next-auth.callback-url— protect the sign-in and return you to the right page (session).__Host-fm_gw— authorizes access to an instance you opened through the portal (8 hours, only on that instance’s address).fm_lang— remembers the chosen language (1 year).- Website: no cookies; the browser stores the chosen language and the variant of the page you saw (local storage).
10. Children
The service is for companies and professionals and is not intended for people under 18.
11. Changes
When this policy changes, we update the date above and, for relevant changes, notify you in the portal or by e-mail before they apply.