Privacy Policy

Welcome to Moistur AI ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

Data controller. The controller responsible for your personal information is Moistur AI Private Limited, a company incorporated in India (Gurgaon, Haryana). You can reach our privacy team at privacy@moistur.ai. If you are in the European Economic Area (EEA) or the United Kingdom, you may contact us at that address about our processing of your personal data; where we are required to designate a representative under Article 27 of the GDPR, that representative's details will be published here.

Personal Information

When you register for an account, we collect:

• Email address
• Name (if provided via Google OAuth)
• Profile picture (if provided via Google OAuth)

Usage Data

We automatically collect certain information when you use our platform:

• Prompts you create and execute
• LLM responses and sentiment analysis results
• Usage statistics and analytics
• Browser type and version
• IP address and approximate location data

We use your information to:

• Provide and maintain our service
• Execute prompts across LLM providers
• Analyze sentiment and provide brand insights
• Process payments and manage subscriptions
• Send you service-related notifications
• Improve our platform and user experience
• Detect and prevent fraud or abuse

Legal bases for processing (EEA / UK)

Where the EU or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to create and operate your account, execute prompts, deliver analytics, and provide support.
• Legitimate interests (Art. 6(1)(f)) — to secure the Service, prevent fraud and abuse, and improve our product, balanced against your rights and freedoms.
• Legal obligation (Art. 6(1)(c)) — to retain billing and tax records and to respond to lawful requests.
• Consent (Art. 6(1)(a)) — for optional marketing communications, which you may withdraw at any time.

We share your data with the following sub-processors:

• LLM Providers: OpenAI, Anthropic, and Google AI to execute your prompts
• Payment Processor: PayPal (USA) — subscription and one-time payments. We never store full card numbers ourselves.
• Infrastructure: Vercel (USA, hosting and edge runtime), Supabase (USA / EU, database, auth, file storage)
• Email Delivery: Resend (USA) — transactional and bulk email send.
• Error Tracking: Sentry (USA) — client and server error reports, with PII fields scrubbed before transmission.
• Product Analytics: PostHog (USA) for privacy-friendly product analytics.
• Authentication: Google OAuth — when you choose to sign in with Google, your email and basic profile are exchanged with Google under Google's privacy policy.

We do not sell your personal information to third parties.

We implement industry-standard security measures including encryption at rest and in transit, secure authentication via OAuth 2.0, and row-level security policies on all database tables. However, no method of transmission over the Internet is 100% secure. We strive to use commercially acceptable means to protect your data but cannot guarantee absolute security.

We retain personal data only for as long as necessary for the purposes described in this policy. Our retention periods are:

• Account & profile data: for the life of your account, then deleted within 30 days of account closure (unless a longer period is required by law).
• Prompt & analytics history: by plan — 90 days (Starter), 12 months (Pro), 18 months (Agency); Enterprise per contract. Older records are archived or deleted by an automated job.
• Security audit logs: 365 days, then automatically purged.
• Billing & transaction records: up to 7 years, to meet tax and accounting obligations.
• Error & diagnostic logs: a short rolling window (typically up to 90 days) held by our error-tracking processor.

On a verified deletion or erasure request we remove your personal data within 30 days, except where we are required to retain specific records for legal or regulatory purposes. Aggregated, anonymized data that can no longer identify you may be retained for analytics.

Depending on your jurisdiction, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Opt-out of marketing communications
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at privacy@moistur.ai.

We use essential cookies required for authentication and session management. We use PostHog for privacy-friendly product analytics. You can instruct your browser to refuse all cookies or indicate when a cookie is being sent. Note that disabling essential cookies may prevent you from using certain features of the Service.

Our service is not intended for children under 16. We do not knowingly collect personal information from children under 16. If we learn we have collected data from a child under 16, we will delete that information promptly.

Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ. We ensure appropriate safeguards are in place, including standard contractual clauses, to protect your data during such transfers.

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting the updated Privacy Policy on this page with a new "Last updated" date. We encourage you to review this page periodically.

If you have questions about this Privacy Policy, please contact us: