Privacy Policy

Welcome to Moistur AI ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

Data controller. The controller responsible for your personal information is Moistur AI Private Limited, a company incorporated in India (Gurgaon, Haryana). You can reach our privacy team at privacy@moistur.ai. If you are in the European Economic Area (EEA) or the United Kingdom, you may contact us at that address about our processing of your personal data; where we are required to designate a representative under Article 27 of the GDPR, that representative's details will be published here.

Personal Information

When you register for an account, we collect:

• Email address
• Name (if provided via Google OAuth)
• Profile picture (if provided via Google OAuth)

Usage Data

We automatically collect certain information when you use our platform:

• Prompts you create and execute
• LLM responses and sentiment analysis results
• Usage statistics and analytics
• Browser type and version
• IP address and approximate location data

Free AI Visibility Grader

When you use the free grader without an account, we collect:

• The brand, category, market and website you enter, and the resulting AI answers and score
• A keyed one-way hash of your IP address and a random session cookie, used only for rate limiting and abuse prevention (we do not store your IP address)
• Campaign parameters (such as utm_source) and the website that referred you, if any
• Your email address, only if you choose to unlock the full result, and whether you opted in to marketing email

We use your information to:

• Provide and maintain our service
• Execute prompts across LLM providers
• Analyze sentiment and provide brand insights
• Process payments and manage subscriptions
• Send you service-related notifications
• Improve our platform and user experience
• Detect and prevent fraud or abuse

Legal bases for processing (EEA / UK)

Where the EU or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): to create and operate your account, execute prompts, deliver analytics, and provide support.
• Legitimate interests (Art. 6(1)(f)): to secure the Service, prevent fraud and abuse, and improve our product, balanced against your rights and freedoms.
• Legal obligation (Art. 6(1)(c)): to retain billing and tax records and to respond to lawful requests.
• Consent (Art. 6(1)(a)): for optional marketing communications, which you may withdraw at any time.

We share your data with the following sub-processors:

• AI and Search Providers: OpenAI, Anthropic, Google (Gemini), Perplexity, and SerpAPI (for Google AI Overviews, Google AI Mode and Microsoft Copilot results) to execute your prompts; xAI (Grok) for workspaces with the Grok add-on
• Machine-Learning Processing: Modal: embedding, sentiment and anomaly models run on scan results.
• Payment Processor: PayPal (USA): subscription and one-time payments. We never store full card numbers ourselves.
• Infrastructure: Vercel (hosting and edge runtime) and Supabase (database, auth, file storage). Our production database (Supabase, AWS ap-southeast-1) and application servers (Vercel, sin1 region) are located in Singapore. Upstash (Redis) for caching and rate limiting.
• Email Delivery: Resend (USA): transactional and bulk email send.
• Error Tracking: Sentry (USA): client and server error reports, with PII fields scrubbed before transmission.
• Analytics: PostHog (USA) for product analytics; Google Analytics for website analytics.
• Website Services: Cloudflare Turnstile (bot protection on sign-in and sign-up), Calendly (demo booking, when you open the booking form, including any text you typed into the homepage prompt box).
• News Monitoring: Google News receives your brand and industry keywords to find related coverage.
• Integrations You Connect: Slack and Microsoft Teams receive alerts and digests at the destinations you configure.

We do not sell your personal information to third parties.

We implement industry-standard security measures including encryption at rest and in transit, secure authentication via OAuth 2.0, and row-level security policies on all database tables. However, no method of transmission over the Internet is 100% secure. We strive to use commercially acceptable means to protect your data but cannot guarantee absolute security.

We retain personal data only for as long as necessary for the purposes described in this policy. Our retention periods are:

• Account & profile data: for the life of your account, then deleted within 30 days of account closure (unless a longer period is required by law).
• Prompt & analytics history: by plan: 90 days (Starter), 12 months (Pro), 18 months (Agency); Enterprise per contract. Older records are archived or deleted by an automated job.
• Security audit logs: 365 days, then automatically purged.
• Billing & transaction records: up to 7 years, to meet tax and accounting obligations.
• Error & diagnostic logs: a short rolling window (typically up to 90 days) held by our error-tracking processor.
• Free grader results: deleted after 180 days unless you gave us your email; grader emails are kept until you ask us to delete them.

On a verified deletion or erasure request we remove your personal data within 30 days, except where we are required to retain specific records for legal or regulatory purposes. Aggregated, anonymized data that can no longer identify you may be retained for analytics.

Depending on your jurisdiction, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Opt-out of marketing communications
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at privacy@moistur.ai.

We use essential cookies required for authentication and session management. We use PostHog for privacy-friendly product analytics. You can instruct your browser to refuse all cookies or indicate when a cookie is being sent. Note that disabling essential cookies may prevent you from using certain features of the Service.

Our service is not intended for children under 16. We do not knowingly collect personal information from children under 16. If we learn we have collected data from a child under 16, we will delete that information promptly.

Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ. We ensure appropriate safeguards are in place, including standard contractual clauses, to protect your data during such transfers.

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting the updated Privacy Policy on this page with a new "Last updated" date. We encourage you to review this page periodically.

If you have questions about this Privacy Policy, please contact us: