Privacy Policy

1. Who we are

Skymoon SEO Suite ("we", "us", "our") is run by Skymoon Infotech, 408, Iscon Emporio, Satellite, Ahmedabad, Gujarat 380015, India. We decide why and how your personal data is used, which makes us the "controller" under the GDPR.

This policy explains what we collect, why, who else handles it, how long we keep it and what you can do about it. For any privacy question, email privacy@skymooninfotech.com.

2. What we collect

Account data: your email address, display name and sign-in credentials, handled by Supabase. If you sign in with Google, we receive your Google profile name and email.

Your sites and results: the websites you add, the pages we read when you ask us to scan them (addresses, titles, descriptions, headings, links and the author and organisation details a page declares), the issues we find, the fixes we suggest, keywords you add and the AI visibility checks you run.

Tool runs: when you are signed in, each run records the tool, the date, the credits used and a summary of the input and result, so you can see your history.

Files you upload: images sent to the alt text tool are read in memory and are not stored. Content you paste or convert while signed in may be kept with your run history as described above.

Free use without an account: we record your IP address and a device fingerprint to count and limit free runs.

Your email, if you leave it: if you give us your email in a prompt on a tool page, we save it with your name and use case if you gave them, the tool you were using and how you found us. We keep it in our database and in a spreadsheet our team uses, and we may email you about the product. You can ask us to stop at any time.

Messages: feedback and contact messages, with the email you give, are stored so we can reply.

Technical error reports: when something breaks, we record the page address, the error message and where in the code it happened, so we can fix it. We remove email addresses, tokens and ids from the text first, and we do not record who you are.

Cookies and analytics: see the cookie section below.

3. Why we use it and our legal basis

To provide the service you asked for (contract): creating and securing your account, running tools, keeping your history and credit balance, answering support requests.

To keep the service safe and fair (legitimate interests): limiting free use, preventing abuse and fixing faults. You can object to this, see your rights below.

To understand how the site is used (consent): Google Analytics runs only if you choose "Accept all" in the cookie banner.

To email you about the product (consent): only if you left your email asking for updates. You can ask us to stop at any time.

To meet legal duties: such as tax and accounting records.

We do not sell your personal data. We do not use it for advertising. We make no decisions about you by automated means that have legal or similarly significant effects.

4. Cookies and local storage

A banner asks for your choice the first time you visit. "Essential only" is as easy to pick as "Accept all", and you can change your mind any time with "Cookie settings" in the footer. Your choice is kept for six months.

Essential (always on, no consent needed):
• Supabase sign-in cookies (names start with "sb-"): keep you signed in. Removed when you sign out.
• sky_consent: remembers your cookie choice. 6 months.
• In your browser's local storage, set only when you use a feature: sky_theme (light or dark), sky_last_project and the site you picked last (so tools open on your site), and flags that remember you dismissed or answered a prompt (sky_lead_captured, sky_visit_prompt_shown, sky_visit_count), and in the signed-in app whether the sidebar is folded (sky_dash_rail) and whether you dismissed the getting started list (sky_dash_checklist_dismissed).
• In your browser's session storage, for the current tab only: sky_brief_handoff holds your content brief for up to six hours when you press Continue from the brief to the meta tags, so both can be saved in one document. It never leaves your browser and is gone when you close the tab.

Analytics (only if you accept all):
• Google Analytics 4: the cookies _ga and _ga_G-6DKFNR231V, which last up to 2 years. They count visits, pages viewed, the device type and a rough location. We turn off Google signals and ad personalisation, and we do not use Google Analytics for advertising. If you choose "Essential only" afterwards, we stop it and remove its cookies.

5. Who else handles your data

We use these providers to run the service. Each handles data only on our instructions, except where noted.

Supabase (database and sign-in): our project is hosted in Mumbai, India (ap-south-1).

Vercel (hosting): our servers run in the United States, so requests and logs pass through there.

Google (Gemini API): the AI features send the text you ask them to work on, such as a keyword, a page excerpt or a title, to Google's Gemini API to produce the result. We may use OpenAI as a fallback if Google is unavailable. We send only what the feature needs.

Serper (serper.dev): when you are signed in and use the content brief, the keyword and country you enter are sent to Serper to read Google search results.

Google Analytics (only if you accept all) and Google Sheets (our internal list of people who asked for updates).

Email delivery: our mail server sends the messages described in this policy.

These providers may process data in countries outside the EEA and UK, including India and the United States. Where the GDPR requires it, the transfer rests on the Standard Contractual Clauses or the provider's equivalent safeguard.

6. How long we keep it

Account, sites, results and run history: for as long as your account exists. When you ask us to delete your account, we delete this data within 30 days, except what the law requires us to keep.

Free-use counters (IP address and fingerprint): kept only as long as needed to limit free use.

Your email in our updates list: until you unsubscribe or ask us to delete it.

Feedback and contact messages: until they are dealt with, or until you ask us to delete them.

Technical error reports: grouped by kind and kept until we clear fixed ones out by hand, which we do at least once a year.

Analytics: Google Analytics keeps event data for the period set in our Google Analytics account.

7. Your rights

Under the GDPR and UK GDPR you can ask us to: show you the data we hold about you, correct it, delete it, restrict how we use it, give it to you in a portable format, or stop using it where we rely on legitimate interests. Where we rely on consent you can withdraw it at any time, without affecting what we did before. Cookie consent can be withdrawn through "Cookie settings" in the footer.

If you are in India, the Digital Personal Data Protection Act 2023 gives you similar rights, including to nominate someone to act for you and to have a grievance heard.

To use any of these, email privacy@skymooninfotech.com. We answer within one month. If you are unhappy with our answer, you may complain to your data protection authority, such as the supervisory authority in your EU country or the UK Information Commissioner's Office.

8. Children

The service is for businesses and professionals. It is not meant for anyone under 16, and we do not knowingly collect their data. If you think a child has given us data, tell us and we will delete it.

9. Security

We use HTTPS everywhere, row-level security on our database so each account sees only its own data and hashed passwords. No system is perfectly secure. If you find a vulnerability, please tell us at privacy@skymooninfotech.com. If a breach puts your rights at risk, we will tell you and the authorities as the law requires.

10. Changes to this policy

When we change what we collect or why, we update this page and its date. If the change needs your consent, we ask again, for example by showing the cookie banner once more.

11. Contact

Skymoon Infotech
408, Iscon Emporio, Satellite, Ahmedabad, Gujarat 380015, India
Email: privacy@skymooninfotech.com