FastSpring

What is FastSpring?

FastSpring is a US based payment platform incorporated as Bright Market LLC in Santa Barbara, California. It operates as a merchant of record (MoR) for software, SaaS and digital products: when a customer pays through FastSpring, Bright Market LLC is the legal seller of record on the invoice, collects EU VAT and other sales taxes, handles refunds, chargebacks and dispute management and remits the net revenue to the publisher.

Publishers integrate FastSpring with the Popup Storefront (an overlay on their site), the Web Storefront (a hosted product page) or the Embedded Storefront (a checkout in an iframe). The Storefront.js library and the Order API allow advanced flows such as price localisation, subscription management and B2B quoting.

Cookies and data collected

On the hosted FastSpring checkout, only strictly necessary first party cookies are set on fastspring.com and onfastspring.com: a session cookie that maintains the cart, a CSRF protection token and a fraud risk score cookie. FastSpring also collects billing data (name, email, address, country, payment method) needed to complete the purchase. When the publisher uses the Library API to display localised prices on its own page, geo IP lookups happen server side without setting cookies on the publisher domain.

As a merchant of record, FastSpring also stores enough billing information to produce a compliant invoice with EU VAT, to honour refund requests and to deal with payment scheme rules. Card data is tokenised through PCI DSS Level 1 processors; FastSpring never exposes raw PAN to the publisher.

GDPR and ePrivacy implications

Because FastSpring acts as the merchant of record, it is a controller for the invoicing and tax remittance data and a processor for the publisher's customer data. Strictly necessary cookies set on the hosted checkout are exempt from prior consent under Art. 5(3) ePrivacy and the EDPB ePrivacy guidance. The customer's explicit choice to start a purchase is the legal basis for the processing of the payment data.

International data transfers

FastSpring processes EU customer data on AWS US East regions. The FastSpring DPA incorporates the EU Standard Contractual Clauses (modules 2 and 3) and the UK International Data Transfer Addendum, and FastSpring is self certified under the EU US Data Privacy Framework. EU customers can request additional information on access controls and on the categories of sub processors used.

Practical compliance steps

Sign the FastSpring DPA from your account. List FastSpring (Bright Market LLC) in your privacy notice as merchant of record and processor, mention the US transfer with SCCs and DPF, and add it to your Article 30 register. No cookie banner update is needed for the hosted checkout itself, but any third party analytics that you wire to FastSpring events (Google Analytics, GA4 ecommerce, Meta CAPI) must remain in the consent gated tag manager.