Privacy Policy
Last updated 3 November 2026
This policy explains what personal data FastOption holds about you, what we do with it, who sees it, and the rights you have over it. It is written to meet Kenya's Data Protection Act, 2019.
1. Who this covers
FastOption is the data controller for the personal data described here. This policy covers anyone who visits our website, opens an account or contacts us. Paystack, Deriv and the other services listed in section 5 handle data under their own privacy policies when they act on their own account.
2. Data we collect
| Type | What it includes | Where it comes from |
|---|---|---|
| Account details | Your name, email address, phone number, and the dates you joined and last signed in | You |
| Profile details | If you add them: your date of birth, nationality, home address, employment status, occupation, source of funds, trading experience, country of tax residence and tax number | You |
| Verification documents | If you submit them: images of your identity document, a photo of you holding it, and a document showing your address. They're encrypted when stored and only our staff can open them, to review them | You |
| Login data | A scrambled version (hash) of your password, and session tokens. We can't read your password. If you turn them on: an encrypted authenticator key, scrambled backup codes, and your passkeys' public keys. Your fingerprint or face never reaches us | Created when you sign up and sign in |
| Trading records | Every contract: market, type, stake, payout, entry and exit prices, times and result. Also your balance and its history | Created when you trade |
| M-Pesa and card deposits | Amount, currency, status, date and Paystack's payment reference | You and Paystack |
| Saved cards | If you choose to save a card: a Paystack token, the last 4 digits, bank, card type and expiry date | Paystack |
| Crypto deposits and withdrawals | Amount, asset, network, wallet address and transaction hash | You |
| Withdrawals | Amount, destination, status and review notes | You and our staff |
| Support messages | What you send us in live chat or on another channel, and your contact details on the channel you use | You |
| Staff records | Internal notes on your account, and a log of staff actions on it, such as balance changes and suspensions | Our staff |
| Technical data | Your IP address, used briefly to limit repeated requests. Our hosting provider may also keep routine server logs | Your device |
You can choose to submit verification documents from your profile. We may also ask for identity or source-of-funds documents if the law requires it or to check a withdrawal. If we do, we'll explain why at the time.
3. Data we don't collect
- Your full card number or security code. These go directly to Paystack through its payment window.
- Your M-Pesa PIN. You enter it only on your own phone, and we will never ask for it.
- Your wallet's private keys or seed phrase. Never share these with anyone, including anyone claiming to be us.
- Analytics or advertising tracking data. We don't run analytics or advertising trackers on the platform.
4. Why we use it
| Purpose | Legal basis |
|---|---|
| Creating your account, signing you in, and running your balance and contracts | Performing our contract with you |
| Processing and reviewing deposits and withdrawals | Performing our contract with you |
| Answering your questions and complaints | Performing our contract with you, and our legitimate interests |
| Preventing fraud and abuse, and protecting accounts and the platform | Our legitimate interests, and legal obligations |
| Keeping financial records, and responding to lawful requests from authorities | Legal obligations |
| Telling you about important changes to the service or our terms | Performing our contract with you |
| Saving a card for future deposits | Your consent. Remove the card at any time to withdraw it |
We don't sell your personal data, and we don't use it for third-party advertising. We'll only send you marketing if you've agreed to it, and you can opt out at any time.
6. Your browser and cookies
FastOption doesn't set its own cookies. We use your browser's local storage instead:
| Item | What it holds | When it's removed |
|---|---|---|
fastoption_session | Your sign-in token, name, email and user ID, so you stay signed in on that browser | When you log out. The token stops working after 30 days or sooner |
fastoption_intent | The market or action you chose on the home page, so the terminal opens on it after you sign in | After it's used |
fastoption_theme | Your dark or light choice, when it differs from your device's theme | When you clear your browser's site data, or switch back to match your device |
fastoption_account | Whether you last selected your Real or Demo balance, so the terminal opens on it | When you clear your browser's site data |
Paystack may set its own cookies in its payment window. Clearing your browser's site data signs you out.
Don't stay signed in on a shared device. Anyone using the browser could access your account while the token is valid.
7. Transfers abroad
Some of the services in section 5 process data outside Kenya, including in countries whose data protection laws differ from Kenya's. Where we transfer personal data abroad, we rely on the safeguards or grounds that the Data Protection Act allows, such as the transfer being necessary to perform our contract with you. You can ask us for more details.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account details | While your account is open. After closure, for as long as needed to meet legal obligations and deal with disputes |
| Trading and financial records | For as long as tax, anti-money-laundering and financial record-keeping laws require, even after your account closes |
| Verification documents | For as long as anti-money-laundering and record-keeping laws require, even after your account closes. A replaced document is deleted once it's no longer needed for a review |
| Saved cards | Until you remove them, or your account is closed or deleted |
| Passkeys and authenticator keys | Until you remove them or your account is closed |
| Password reset codes | 10 minutes |
| Session tokens | Up to 30 days, or until you log out |
| Rate-limit data (IP address) | Short periods, in temporary memory |
| Support messages | As long as needed to resolve your query and keep a record of it |
| Staff action logs | As long as needed for security and audit |
When we no longer need personal data, we delete or anonymise it.
9. Security
We protect your data in these ways, among others:
- Passwords are stored only as bcrypt hashes.
- Each sign-in has its own token, and tokens expire. Suspending an account or resetting a password ends its sessions.
- You can only reach your own account data, and staff access is limited to authorised accounts.
- Repeated requests for sensitive actions are limited.
- Card numbers never reach our servers.
No online service is completely secure. If a breach poses a real risk to you, we'll notify the Data Commissioner as the law requires, and tell you what happened and what you can do. You can help by using a unique password, logging out on shared devices and checking you're on the real site before signing in.
10. Your rights
Under the Data Protection Act, 2019, you have the right to:
- Be informed about how your personal data is used, as this policy does;
- Access the personal data we hold about you;
- Correct data that is false or misleading;
- Delete data that is false, misleading, or no longer needed. Some records must be kept by law, so we may not be able to delete them;
- Object to our use of your data, including any direct marketing;
- Move your data, by receiving it in a commonly used format, or having it sent to another controller where that's possible;
- Withdraw consent wherever we rely on it, which doesn't affect what we did before;
- Complain to the Office of the Data Protection Commissioner.
To use any of these rights, contact us through the Support page from the email address on your account. We may need to confirm your identity first. There's no charge for a reasonable request.
11. Automated decisions
Contract settlement is automatic: software applies the rules in our Terms to market prices. It uses only the contract and the market data, not a profile of you. Quotes aren't personalised. Withdrawals and crypto deposits are reviewed by people. If you disagree with a result, you can ask a person to review it through the complaints process.
12. Under-18s
FastOption is only for adults aged 18 or over. We don't knowingly collect data from anyone younger. If you think someone under 18 has opened an account, please tell us and we'll close it and deal with its data appropriately.
13. Changes to this policy
We'll update this policy when our practices or the law change, and change the date at the top. If a change significantly affects how we use your data, we'll tell you through the platform or by the contact details on your account.
14. Contact and complaints
For a privacy question or request, use the channels on our Support page and mark your message "Privacy".
If you aren't satisfied with our response, you can complain to Kenya's Office of the Data Protection Commissioner at odpc.go.ke.