Privacy Policy

This policy explains what Superstar SEO LLC ("we", "us") collects when you use Legiit Keywords (the "Service"), why, and what you can do about it. Contact us at help@legiit.com with any question.

1. What we collect

Account data

• Your email address, the display name you choose, and a password if you set one (stored only as a hash).
• Sign-in and session records kept by our authentication provider (Supabase).

Data you submit

• The website URLs you add, their settings (market, brand terms, excluded terms), competitor domains you add, and the keywords you ask us to investigate.
• Corrections you make to a site profile, and feedback you leave on recommendations.

Research results

• Site profiles, page inventories, keyword lists, results-page snapshots, excerpts of ranking pages, feasibility assessments, recommendations, briefs and reports produced for your sites. These are stored so you can reopen them and so repeat runs can reuse them.
• A cost record per run listing which third-party requests were made and what they cost.

Usage data

• Standard server logs (IP address, browser type, pages requested, timestamps) kept for security and debugging.

2. What we do not collect

We do not collect or store payment card details. Payments are processed by Stripe under its own privacy policy; we keep your Stripe customer reference, your plan, and the ids of the invoices and purchases that granted credits.

3. Cookies

We use cookies only to keep you signed in and to protect the sign-in flow, and Stripe sets its own on its payment pages. We do not use advertising or cross-site tracking cookies. The Cookie Policy lists each one. Blocking cookies will prevent sign-in.

4. Third-party services

To run the Service we send limited data to these providers:

• DataForSEO receives the keywords, domains and market you research, and returns search data.
• Firecrawl receives the URLs of your site and of ranking pages we read.
• Anthropic (Claude) receives page text, keyword lists and your site profile so its models can classify, assess and write briefs. Under our agreement these inputs are not used to train models.
• Stripe takes payments and holds your card details; we receive a customer reference and the outcome of each payment.
• Supabase hosts our database and authentication; Vercel serves the website and Railway runs the research workers. Vercel Web Analytics counts visits to the public pages without cookies.
• Resend delivers sign-in links and run notifications.

We do not sell your data and do not share it with advertisers.

5. How we use data

• To provide the Service: run research, show results, charge credits, send run notifications.
• To avoid repeat purchases: third-party responses (for example a results page for a keyword and market) are cached and may be reused across accounts. Cached data never includes your account details.
• To keep the Service working and secure, and to answer support requests.
• To improve the Service, using aggregated or de-identified usage.

6. Who can see your data

Your sites, runs and results are visible to you and to our administrators for support. A report you share with a link is visible to anyone who has the link until you revoke it. Data is otherwise not shared except with the providers above and where the law requires.

7. Retention and deletion

• Account data and research results are kept while your account exists.
• Delete a site in the app to remove it and all of its runs, keywords, recommendations and briefs.
• To delete your account, use Account settings or email help@legiit.com from your account address. We delete the account and its sites, runs and results within 30 days, except payment records we must keep for tax purposes and de-identified cached third-party data.
• Server logs are kept for up to 90 days.

8. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your data, or to object to some processing. Email help@legiit.com and we will respond within the time the law requires. If you are in the EU or UK, you may also complain to your data protection authority; the GDPR Policy has the detail.

9. Security

Data is encrypted in transit and stored with a hosting provider that encrypts it at rest. Database access is restricted per account. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.

10. International transfers

Our providers process data mainly in the United States. Where data leaves your region, we rely on the providers' standard contractual clauses or equivalent safeguards.

11. Children

The Service is not for people under 18 and we do not knowingly collect their data.

12. Changes

We will post changes here and update the effective date. For material changes we will also email account holders.

13. Contact

Superstar SEO LLC, 2411 N. Oak Street 105E, Myrtle Beach, SC 29577, USA. help@legiit.com. This policy is governed by the laws of the State of South Carolina, United States.