Privacy Policy

This policy explains what Superstar SEO LLC ("we", "us") collects when you use Legiit Keywords (the "Service"), why, and what you can do about it. Contact us at help@legiit.com with any question.

1. What we collect

Account data

• Your email address, the display name you choose, and a password if you set one (stored only as a hash).
• Sign-in and session records kept by our authentication provider (Supabase).

Data you submit

• The website URLs you add, their settings (market, brand terms, excluded terms), competitor domains you add, and the keywords you ask us to investigate.
• Corrections you make to a site profile, and feedback you leave on recommendations.
• Files you upload for a site: a Google Ads search terms report, and your own customers' messages (support emails, chats, call transcripts, survey answers). Before we store customer messages we remove email addresses, phone numbers, order and account numbers, and the names in greetings, sign-offs and introductions. The rest may still contain personal data your customers wrote. We process it only to research and write for that site, as described in section 6 of the Terms, where you are the controller and we are your processor.

Research results

• Site profiles, page inventories, keyword lists, results-page snapshots, excerpts of ranking pages, feasibility assessments, recommendations, briefs and reports produced for your sites. These are stored so you can reopen them and so repeat runs can reuse them.
• A cost record per run listing which third-party requests were made and what they cost.

Usage data

• Standard server logs (IP address, browser type, pages requested, timestamps) kept for security and debugging.

2. What we do not collect

We do not collect or store payment card details. Payments are processed by Stripe under its own privacy policy; we keep your Stripe customer reference, your plan, and the ids of the invoices and purchases that granted credits.

3. Cookies

We use cookies to keep you signed in and to protect the sign-in flow, and Clicky, our analytics tool, sets first-party cookies so that it can recognize a returning visitor. Stripe sets its own on its payment pages. We do not use advertising or cross-site tracking cookies. The Cookie Policy lists each one and explains how to opt out of the analytics cookies; blocking the sign-in cookies will prevent sign-in.

4. Third-party services

To run the Service we send limited data to these providers:

• DataForSEO receives the keywords, domains and market you research, and returns search data.
• Firecrawl receives the URLs of your site and of ranking pages we read.
• Anthropic (Claude) receives page text, keyword lists and your site profile so its models can classify, assess and write briefs. Under our agreement these inputs are not used to train models.
• Stripe takes payments and holds your card details; we receive a customer reference and the outcome of each payment.
• Supabase hosts our database and authentication; Vercel serves the website and Railway runs the research workers. Vercel Web Analytics counts visits without cookies. Clicky (Roxr Software Ltd, United States) records visits with first-party cookies and receives your IP address, browser details and the pages you view, as the Cookie Policy describes. Intercom (Intercom, Inc., United States) runs the support chat and stores what you write in it, along with your name, email, plan and credit balance when you are signed in, so that the person replying can see your account.
• Resend delivers sign-in links and run notifications.

We do not sell your data and do not share it with advertisers.

5. Google data (Search Console and Analytics)

If you connect a Google account from a site's settings, we ask Google for read-only access to Search Console (the webmasters.readonly scope) and Google Analytics (the analytics.readonly scope), plus the email address of the Google account so we can show which one is connected. You can decline, and the rest of the Service works the same.

• What we read. The list of Search Console and Analytics properties the account can see; and, for the property you choose, the search queries, impressions, clicks and average position of your own site, and the sessions and conversions of pages on your own site. We never write to your Google account and never read data that belongs to other sites.
• Why. To start the keyword research from the searches your site already gets, and to show each page you mark as published what it earned after going live. We use it for nothing else.
• What we store. The refresh token Google issues, encrypted at rest, so we can read on a nightly schedule; the property names you chose; per-page measurements (impressions, clicks, position, the top queries, sessions and conversions) attached to the pages they describe; and a limited set of search queries copied into a research run as keyword candidates, with their impressions and clicks as evidence.
• Who sees it. You, and anyone you share a plan with by link. Our public accuracy report shows aggregates across many sites and never names a site, a page or an account. We do not sell Google data, use it for advertising, or use it to train machine-learning models.
• Deleting it. Disconnect Google in the site's settings and the token is deleted at once; delete the site and the measurements go with it. You can also revoke our access at any time from the third-party access page of your Google account.
• Limited Use. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. How we use data

• To provide the Service: run research, show results, charge credits, send run notifications.
• To avoid repeat purchases: third-party responses (for example a results page for a keyword and market) are cached and may be reused across accounts. Cached data never includes your account details.
• To keep the Service working and secure, and to answer support requests.
• To improve the Service, using aggregated or de-identified usage.

7. Who can see your data

Your sites, runs and results are visible to you and to our administrators for support. A report you share with a link is visible to anyone who has the link until you revoke it. Data is otherwise not shared except with the providers above and where the law requires.

8. Retention and deletion

• Account data and research results are kept while your account exists.
• Delete a site in the app to remove it and all of its runs, keywords, recommendations and briefs.
• Remove an uploaded file from the site's settings to delete its stored rows. Quotes a past run already used stay in that run's evidence until you delete the run or the site.
• To delete your account, use Account settings or email help@legiit.com from your account address. We delete the account and its sites, runs and results within 30 days, except payment records we must keep for tax purposes and de-identified cached third-party data.
• Server logs are kept for up to 90 days.

9. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your data, or to object to some processing. Email help@legiit.com and we will respond within the time the law requires. If you are in the EU or UK, you may also complain to your data protection authority; the GDPR Policy has the detail.

10. Security

Data is encrypted in transit and stored with a hosting provider that encrypts it at rest. Database access is restricted per account. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.

11. International transfers

Our providers process data mainly in the United States. Where data leaves your region, we rely on the providers' standard contractual clauses or equivalent safeguards.

12. Children

The Service is not for people under 18 and we do not knowingly collect their data.

13. Changes

We will post changes here and update the effective date. For material changes we will also email account holders.

14. Contact

Superstar SEO LLC, 2411 N. Oak Street 105E, Myrtle Beach, SC 29577, USA. help@legiit.com. This policy is governed by the laws of the State of South Carolina, United States.