Privacy Policy

OwnMoat, Inc.

Last updated: July 19, 2026

This Privacy Policy explains how OwnMoat, Inc. ("OwnMoat," "we," "us"), a Delaware corporation, collects, uses, and protects information when you use ownmoat.com and the OwnMoat platform (the "Service"). By using the Service, you agree to this Policy.

Contact: [email protected]

1. What OwnMoat does

OwnMoat is an SEO and AI-search-visibility platform. It connects to data sources you authorize — principally Google Search Console and Google Analytics — analyzes your website's search performance, and produces prioritized recommendations. Understanding what we collect starts with understanding that the Service exists to analyze your website's data on your instruction.

2. Information we collect

Account information. When you create an account: your name, email address, and authentication credentials (managed by our authentication provider, Supabase). If you contact us, we retain the correspondence.

Google user data (with your explicit authorization). When you connect your Google account via OAuth, we access:

• Google Search Console data (read-only): search queries, impressions, clicks, ranking positions, index coverage, and URL inspection results for the website properties you select.
• Google Analytics data (read-only): aggregated traffic, session, and conversion metrics for the properties you select.

We request read-only scopes. We do not write to, modify, or delete anything in your Google account. You can revoke our access at any time from your Google Account settings (myaccount.google.com/permissions) or from within the Service; revocation takes effect immediately for future data collection.

Website content. We crawl and analyze publicly accessible pages of the website(s) you register — page content, structure, metadata, and technical characteristics. This is public information retrieved the same way a search engine retrieves it.

Third-party SEO data. We obtain backlink and search-market data about your registered websites from commercial data providers (currently DataForSEO). This concerns your website's public web presence, not your personal information.

Usage and technical data. Standard service logs: IP address, browser type, pages visited within the Service, and actions taken (e.g., which recommendations you accepted). Our marketing site uses Cloudflare Web Analytics, which is cookieless and does not track you across sites.

Payment information (when billing launches). Payment card details are collected and processed directly by our payment processor and never touch our servers. We retain only billing records (plan, invoices, transaction status).

3. How we use information

We use the information described above solely to:

• Provide the Service: run analyses, generate recommendations and briefings, measure your site's visibility in search engines and AI assistants, and display results to you;
• Operate, secure, and debug the Service;
• Communicate with you about your account, the Service, and support requests;
• Comply with legal obligations.

We do not sell your information. We do not use your data for advertising. We do not train our own machine-learning models on your data, and our AI subprocessors are contractually barred from training on it (see Section 5).

4. Google API Services — Limited Use

OwnMoat's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy , including the Limited Use requirements. Specifically:

1. We use Google user data only to provide and improve the user-facing features of the Service that are visible and prominent to you — your dashboards, audits, briefings, and recommendations.
2. We do not transfer Google user data to third parties except as necessary to provide those user-facing features (to the subprocessors listed in Section 5, acting on our instructions), as required by law, or as part of a merger or acquisition with prior notice to you.
3. No human reads your Google user data except (a) with your explicit consent to view specific data (for example, during a support session you initiate), (b) as necessary for security or abuse investigation, (c) to comply with applicable law, or (d) when the data has been aggregated and de-identified.
4. We do not use Google user data for advertising of any kind.
5. We do not use Google user data to train generalized artificial-intelligence or machine-learning models. Where the Service processes your data through large-language-model APIs to generate your recommendations, those providers process it under API terms that prohibit training on the data.

5. Subprocessors and service providers

We share data only with providers who process it on our behalf, under contract, to run the Service:

We will update this list as providers change; material changes will be reflected in this Policy.

6. Data retention and deletion

We retain your data while your account is active. When you delete your account (or request deletion at [email protected]), we delete your account information, stored Google user data, and analysis history within 30 days, except records we must retain for legal, tax, or security purposes. Disconnecting a Google property deletes stored data for that property on the same schedule. Backups are purged on a rolling basis within 90 days.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal information, and to object to processing or withdraw consent.

• European Economic Area / United Kingdom (GDPR/UK GDPR): Our legal bases are performance of contract (providing the Service you signed up for), legitimate interests (security, service improvement), and consent (Google account connection, which you may withdraw at any time). You may lodge a complaint with your supervisory authority.
• California (CCPA/CPRA): We do not sell or share personal information as those terms are defined in the CCPA. You may exercise access and deletion rights as described below.
• India (DPDP Act 2023): You may access, correct, and erase your personal data and nominate a grievance redressal contact. Grievance Officer: [email protected] (attn: Grievance Officer).

To exercise any right, email [email protected]. We will verify your identity and respond within the time required by applicable law.

8. International data transfers

We are a U.S. company and process data in the United States and other countries where our subprocessors operate. Where required, transfers from the EEA/UK are protected by Standard Contractual Clauses or an equivalent lawful mechanism.

9. Security

We protect your data with encryption in transit (TLS), encrypted storage, scoped read-only API access, access controls, and secrets management. No system is perfectly secure; we will notify you and relevant authorities of a personal-data breach as required by applicable law.

10. Children

The Service is not directed to anyone under 18, and we do not knowingly collect data from them.

11. Changes to this Policy

We may update this Policy. Material changes will be announced by email or in-Service notice before they take effect. The "Last updated" date reflects the current version.

12. Contact

OwnMoat, Inc.

[email protected]

Registered address: to be updated