DataFast
Closed-source SaaS SaaS only From $9/mo
← All tools

DataFast Review (2026)

Multi-processor revenue attribution for indie founders — Stripe + LemonSqueezy + Polar + Paddle + Shopify + Dodo + Woo + custom API. Singapore JustShipIt Pte Ltd. $9 entry

🇸🇬 Singapore Since 2024 Closed-source SaaS

DataFast is the only tool in this directory with revenue attribution across eight payment processors at $9/month. Stripe, LemonSqueezy, Polar, Paddle, Shopify, DodoPayments, WooCommerce, plus a custom Payment API. Seline matches Stripe alone; nothing else in the directory does multi-processor.

— Mark Sutton, editor
DataFast multi-processor revenue attribution dashboard with Stripe and GSC integration
Main dashboard view
Editor score 3.5/5
From $9/mo Cloud only
Hosting SaaS only · US hosted
Privacy passport

DataFast compliance at a glance

GDPR posture, sub-processors under DPA, per-jurisdiction stance, and encryption — everything a procurement team checks.

GDPR Compliant EU General Data Protection Regulation EU's omnibus privacy law requiring a lawful basis for processing personal data (consent, legitimate interest, etc.). Applies to anyone handling EU-resident data. DataFast's posture: Consent or legitimate interest.
CA
CCPA Compliant California Consumer Privacy Act California Consumer Privacy Act — rights for California residents (access, deletion, opt-out of sales). Triggered at $25M revenue or 50k+ CA-consumer records.
UK PECR Not held UK Privacy and Electronic Communications Regulations UK Privacy and Electronic Communications Regulations sit on top of GDPR specifically for cookies and electronic marketing. PECR Reg 6 governs analytics-cookie consent.
SOC 2 · II Not held SOC 2 Type II SOC 2 Type II — independent audit verifying security/availability controls operate effectively over 6+ months. Standard B2B procurement requirement.
ISO27001
ISO 27001 Not held ISO/IEC 27001 information-security ISO/IEC 27001 — international information-security management standard, certified by accredited bodies on a 3-year renewal cycle.
HIPAA Not held US HIPAA (with BAA) US health-data law requiring a Business Associate Agreement (BAA) for any tool touching protected health information. Without BAA the tool cannot legally process PHI.

Per-jurisdiction posture

🇫🇷
France CNIL Banner required Default mode requires cookie banner. Cookieless mode is configurable but degrades attribution.
France · CNIL Default mode requires cookie banner. Cookieless mode is configurable but degrades attribution.
🇬🇧
United Kingdom UK ICO / PECR Banner required Default cookies trigger PECR Reg 6 consent.
United Kingdom · UK ICO / PECR Default cookies trigger PECR Reg 6 consent.
🇩🇪
Germany TTDSG Banner required TTDSG §25 applies to cookies. Cookieless mode bypasses but kills multi-day.
Germany · TTDSG TTDSG §25 applies to cookies. Cookieless mode bypasses but kills multi-day.
🇮🇹
Italy Garante Banner required Italian Garante is strictest. Default mode incompatible.
Italy · Garante Italian Garante is strictest. Default mode incompatible.

Sub-processors (9)

GDPR Art. 28 disclosure — third parties under DPA that may receive data.

Amazon Web Services Application infrastructure United States
Vercel Dashboard hosting United States
TinyBird Events warehouse (managed ClickHouse) ES
ClickHouse Analytics database United States
MongoDB App database United States
Upstash Caches United States
Mapbox Realtime map (api-realtime-map endpoint) United States
OpenAI AI insights / chat-with-data feature United States
Stripe Payment processing United States

Collected

  • URLs visited and page titles
  • HTTP referrer + UTM parameters
  • Click IDs (gclid, fbclid)
  • Browser, OS, device type
  • Country/city (via Mapbox)
  • IP addresses (default mode — used for tracking; cookieless mode hashes with 24h salt)
  • Cookies: datafast_visitor_id + datafast_session_id (default mode)
  • Stripe payment metadata (visitor_id pass-through)

Explicitly NOT collected

  • (in cookieless mode) cookies, persistent device IDs
  • (in cookieless mode) cross-domain visitor linking
Data retention

Starter 3y / Growth 5y+ retention per pricing.

Encryption
  • In transit: HTTPS (Vercel + AWS managed)
  • At rest: Not explicitly published
DPA Yes · click through
AI & Modern Capabilities

How DataFast works with AI agents

Tier 3 — no AI yet — vendor focuses on classic privacy-first analytics; no AI/MCP features advertised.

AI Chat Not yet

Conversational natural-language interface

Not advertised by vendor

MCP Server Not yet

Model Context Protocol — Claude / Cursor / Codex

Not advertised by vendor

Agent API Not yet

Programmatic AI-agent endpoints

Not advertised by vendor

AI Insights Not yet

Anomaly detection / hypothesis / summaries

Not advertised by vendor

Export for AI Not yet

Structured export formatted for LLM ingestion

Not advertised by vendor

Strengths & weaknesses

What makes DataFast worth a look — and where it falls short.

Strengths 7

  • Multi-processor revenue attribution — 8 processors at $9/mo
  • Native GSC integration with revenue-per-keyword estimate
  • 𝕏 links attribution included on every plan
  • Solo-founder economics — $9/mo entry beats Plausible/Pirsch/Fathom/Matomo
  • AI-builder install guides (Bolt, Lovable, v0, Replit)
  • 8 server-stack proxy guides (Next.js, Express, PHP, Flask, FastAPI, Nginx, Caddy, Firebase)
  • Marc Lou named founder (ShipFast/Indie Maker creator)

Weaknesses 8

  • No third-party security certs (/security returns 404)
  • US infrastructure + Singapore jurisdiction (no EU residency option)
  • Cookies on by default (required for Stripe metadata pass-through)
  • Cookieless mode kills multi-day attribution (24h salt rotation)
  • DNT not honored, OpenAI sub-processor processes events
  • Attribution model undocumented (no last-touch vs first-touch statement)
  • Single-site cap on $9 Starter — 30-site Growth from $19
  • Closed-source, no self-host, founder-as-product (bus factor 1)

Feature matrix

All 38 verified checks across 4 categories. Hover any row for the editor's note.

Tracking & Reporting 15

  • Pageviews & visitors Yes
  • Live visitor count Yes
  • Top pages report Yes
  • Top referrers Yes
  • UTM campaign tracking Yes
  • Country & city breakdown Yes
  • Device, browser, OS Yes
  • Bounce / engagement Yes
  • Time on site Yes
  • Custom events Yes
  • Goals / conversions Yes
  • Funnels Yes
  • Outbound link tracking ~Partial
  • File download tracking ~Partial
  • 404 / error tracking No

Privacy & Compliance 9

  • Cookieless by default ~Partial
  • No personal data collected No
  • GDPR-compliant out of the box No
  • Data hosted in EU No
  • Data hosted in US Yes
  • Self-hostable No
  • Open source No
  • Data retention period 36
  • Bot & spam filtering Yes

Setup & Integrations 10

  • Script weight (KB) ·
  • Single-snippet install Yes
  • WordPress plugin ~Partial
  • Proxy / first-party domain Yes
  • Public API Yes
  • Data export (CSV/JSON) Yes
  • Google Search Console connector Yes
  • Email digests No
  • Slack / webhook alerts No
  • Public shareable dashboard No

Pricing & Plans 4

  • Free tier exists No
  • Entry price ($/mo) $9/mo
  • Price at 100k pageviews $19/mo
  • Unlimited sites on entry plan ~Partial

DataFast vs alternatives

How it compares to the closest 3 rivals on key buyer-decision fields.

Seline

Seline

SaaS-friendly cookieless analytics with funnels, user profiles, and AI chat — flat $14/mo, EU-hosted Germany

  • FromFree
  • HostingSaaS only
  • EU-hostedYes
  • CookielessYes
Plausible

Plausible

Privacy-first GA alternative, EU-hosted, simple dashboard

  • From$9/mo
  • HostingSelf-host ✓
  • EU-hostedYes
  • CookielessYes
Simple Analytics

Simple Analytics

No-cookie analytics with AI-powered insights

  • FromFree
  • HostingSaaS only
  • EU-hostedYes
  • CookielessYes

Pricing tiers

Real plans, real numbers — pulled from datafa.st (verified May 2026).

Trial

Trial/14 days

Full access

  • ✓ No card required
Starter $9

$9/mo

10K events

  • ✓ 1 site
  • ✓ 1 seat
  • ✓ 3y retention
  • ✓ 𝕏 mentions limited
Starter $19

$19/mo

100K

  • ✓ 1 site
  • ✓ 1 seat
Growth $19

$19/mo

10K

  • ✓ 30 sites
  • ✓ 30 team members
  • ✓ 5y retention
  • ✓ 𝕏 unlimited
  • ✓ + link attribution
Growth $39

$39/mo

100K

  • ✓ 30 sites
  • ✓ 30 seats
Growth $399

$399/mo

10M+

  • ✓ 30 sites
  • ✓ 30 seats

Tech specs

Stack, repo health, deployment options — for engineers evaluating self-host.

Stack

  • Written inClosed-source
  • HostingAWS + Vercel
  • DBClickHouse + TinyBird + MongoDB
  • CachesUpstash
  • MapsMapbox
  • AIOpenAI
  • LicenseClosed-source SaaS
  • Min specsN/A — SaaS only

Deploy

  • · Cloud SaaS only
Mark Sutton

Editor review

Independently reviewed by Mark Sutton, cross-checked against vendor documentation. Click any panel to expand.

+ What it does well

DataFast is the only tool in this directory with revenue attribution across eight payment processors at $9/month. Stripe, LemonSqueezy, Polar, Paddle, Shopify, DodoPayments, WooCommerce, plus a custom Payment API. Seline matches Stripe alone; nothing else in the directory does multi-processor.

The integration is metadata-pass-through (no webhook). DataFast sets datafast_visitor_id + datafast_session_id cookies on first visit; you inject them into Stripe Checkout metadata; DataFast pulls payments via Stripe API key, joins by metadata. Sane indie-SaaS pattern.

Layer Google Search Console on top and you get revenue-per-keyword estimates — essentially nothing else in this list ships that out of the box. For a solo founder running Twitter ads + organic + a Stripe checkout, this is the cheapest path to "did the $400 I spent on Reddit actually return?"

Founder-fit features. 𝕏 links attribution included on every plan (useful for indie founders running on X). AI-builder install guides for Bolt, Lovable, Replit, Vercel v0 (captures the vibe-coding cohort directly). Marc Lou (ShipFast/Indie Maker creator) is the named founder.

Weaknesses & gotchas

Three things to know before you trust it with revenue data.

(1) Zero third-party certs. No SOC 2, no ISO 27001 — /security returns 404. The legal entity is JustShipIt Pte. Ltd. in Singapore; infrastructure is "outside the EU, including in the United States" (DPA verbatim) on AWS + Vercel + ClickHouse + TinyBird + MongoDB + Upstash + Mapbox + OpenAI. EU B2B buyers will rule this out on the data-residency question alone.

(2) Default tracking uses cookies, full stop — Stripe attribution literally depends on the datafast_visitor_id cookie. The cookieless variant exists but rotates its salt every 24 hours, which means "each calendar day can look like a different visitor" (vendor verbatim) and kills the multi-day attribution you bought the product for.

(3) Attribution model is undocumented. No public statement of last-touch vs first-touch, no attribution-window definition. The product copy says "first click to customer" but the actual joiner logic isn't published. DNT is not honored.

Single-site cap on $9 tier. 30-site Growth tier starts at $19 (10K) → $39 (100K) → climbs fast. Closed-source, no self-host, founder-as-product (Marc Lou, bus factor 1).

Best for

Best for: indie SaaS founders / bootstrappers running paid acquisition who need to know "did Twitter/Reddit/Google Ads actually pay back?" — and who use Stripe / LemonSqueezy / Polar / Paddle (the indie-SaaS payment stack). Vibe-coded SaaS on Bolt / Lovable / v0 / Replit (install guides exist for those exact stacks). Shopify stores wanting channel-revenue attribution beyond GA4. Small content sites monetized through Stripe checkouts (info products, courses on Podia/Kajabi).

Real value: the combination of GSC keyword data + Stripe revenue → revenue-per-keyword estimate is genuinely useful and rare in this price band. Channel-level "Revenue per Visitor" by source is the right metric for indie acquisition decisions. 8-processor coverage means it works with whatever payment stack you already have.

Not for: EU-regulated B2B (no SOC 2/ISO, US infra, OpenAI sub-processor, cookies on by default — pick Matomo Cloud or Piwik PRO instead). Multi-touch attribution shops (this is single-touch only — buy Triple Whale, Northbeam, or Dreamdata). High-traffic publishers (10M+ events): at $199 Starter / $399 Growth, you're paying premium for an analytics tool with no certs. Privacy-purist sites that promise "no cookies, no banners" — default mode contradicts that. Anyone needing DNT honored — only Fathom does that.

Setup walkthrough

1. Sign up at datafa.st, 14-day trial, no card.
2. Drop the script in :
`html
<script defer data-website-id="dfid_" data-domain="yourdomain.com" src="https://datafa.st/js/script.js">
`
3. Connect Stripe via API key (read-only on charge, customer, checkout.session). No webhook needed.
4. Wire metadata pass-through (load-bearing step):
`javascript
const session = await stripe.checkout.sessions.create({
metadata: {
datafast_visitor_id: cookieStore.get('datafast_visitor_id')?.value,
datafast_session_id: cookieStore.get('datafast_session_id')?.value
},
});
`
For LemonSqueezy / Polar / Paddle / Shopify, follow the equivalent metadata-field pattern in their per-processor doc page.
5. Connect Google Search Console (owner or full-user permission required).
6. Define one custom goal (signup) and one funnel (landing → signup → paid).
7. Make one real test purchase end-to-end and verify it appears with utm_source populated. If "unattributed," your metadata pass-through is wrong — fix before migrating away from GA4.

Migrating from GA4

From GA4 + UTM spreadsheet → DataFast. Run them side-by-side for two to three weeks; visit-count parity within ~5-10% is normal (DataFast filters bots, GA4 doesn't). Channels port directly — DataFast reads the same utm_source/utm_medium/utm_campaign/utm_term/utm_content GA4 expects, no re-tagging needed.

Stripe attribution is the breaking change: only payments that flow through your wired-up checkout (with datafast_visitor_id metadata) attribute. Historical payments before you wired the metadata appear as "unattributed" forever.

The UTM-spreadsheet → revenue join most indies maintain by hand becomes obsolete — DataFast's Campaigns tab + GSC integration replaces the utm_source × Stripe export VLOOKUP.

Watch out: if your checkout lives on a third-party domain (Lemon-hosted page, Stripe Payment Link without metadata wired), attribution silently dies. Test one purchase end-to-end before declaring migration done.

Cookie banner stays if you stay on default script. Switching to cookieless to drop the banner means accepting 24h-salt-rotation, which breaks multi-day attribution and undoes the migration's value.

Help & FAQ

Where to get help with DataFast and the questions buyers email us about.

Support

HoursAsync (solo founder Marc Lou)Asia/Singapore (UTC+8)
ChannelsEmail
LanguagesEnglish
Response SLA~48h

FAQ (7)

What does DataFast actually do?

Multi-processor marketing-channel revenue attribution. It tracks visitors via a first-party script + cookies, then joins payments from 8 processors (Stripe + LemonSqueezy + Polar + Paddle + Shopify + DodoPayments + WooCommerce + custom Payment API) back to the marketing source/medium/campaign. The headline metric is 'Revenue per Visitor' broken down by channel.

How does Stripe attribution work?

Metadata pass-through (no webhook). DataFast sets datafast_visitor_id + datafast_session_id cookies on first visit. When the buyer hits Stripe Checkout, you must inject those cookies into Stripe metadata. DataFast pulls payment objects via Stripe API key, sees the metadata, joins payment to source attributes.

Does this require cookies?

YES in default mode — datafast_visitor_id + datafast_session_id cookies are how Stripe metadata pass-through works. Cookieless mode exists but rotates salt every 24h, which means 'each calendar day can look like a different visitor' (vendor verbatim) — kills multi-day attribution which is the product's whole point.

What's different from Seline's Stripe revenue tracking?

DataFast spans 8 payment processors (Stripe + LemonSqueezy + Polar + Paddle + Shopify + Dodo + Woo + custom). Seline supports Stripe only. For indie founders running on multiple payment platforms, DataFast covers the stack; for Stripe-only, Seline's $14 flat may be cheaper than DataFast's $9 Starter (Seline = unlimited sites, DataFast Starter = 1 site).

Is there an EU hosting option?

No. DPA verbatim: 'Most of our infrastructure is located outside the EU, including in the United States.' AWS + Vercel + ClickHouse + MongoDB + Upstash + Mapbox + OpenAI — all US-resident. EU buyers with strict no-US-transfer should pick Plausible/Pirsch/Wide Angle.

Are there third-party security certifications?

No. /security page returns 404. No SOC 2, no ISO 27001, no HIPAA, no Cyber Essentials. Self-attested GDPR + CCPA only. For regulated industries, look elsewhere (Piwik PRO has full enterprise stack).

What happens to attribution data if I cancel?

Standard DPA terms apply (30-day deletion). Closed-source, no self-host, no public S3 export. Schedule periodic CSV exports via the read API to maintain your own historical archive.