Privacy Policy

1. Who We Are

LocalSpy AI is a software-as-a-service (SaaS) product developed and operated by Cognalith Solutions Private Limited, a company incorporated under the Companies Act, 2013 in India (CIN: U73100BR2025PTC075899).

Registered Address: Ward No.12, P.O - Aniruddha Belsar, Vaishali, Bihar, India – 844111

Contact: support@localspyai.com

When this policy refers to "LocalSpy AI", "we", "us", or "our", it means Cognalith Solutions Private Limited and its LocalSpy AI product. "You" or "User" means any person who accesses or uses localspyai.com or our services.

2. Data We Collect

2.1 Account Information

When you create an account, we collect:

• Email address (required for account creation and communication)
• Full name (optional, used to personalise your experience)
• Password (stored as a cryptographic hash — we never store plaintext passwords)
• Account creation date and last login timestamp

2.2 Usage Data

When you use LocalSpy AI, we collect:

• Search queries you enter (e.g. "plumber in Austin TX") — stored to display your scan history
• Competitors you scan and track
• Reports generated and viewed
• Feature interactions (which tools you use)
• Scan count per billing period (for plan limit enforcement)

2.3 Payment Information

We never store your credit card details. All payment processing is handled by Razorpay, Inc. We receive only:

• A Razorpay Customer ID (a reference token, not payment details)
• Subscription status (active, cancelled, past due)
• Plan type (Free, Pro, Agency)
• Billing email address

2.4 Technical Data

• IP address (for security and fraud prevention)
• Browser type and version
• Operating system
• Pages visited within the app and timestamps
• Error logs (to diagnose and fix issues)

2.5 Data You Generate

The intelligence reports, competitor analyses, AI-generated images, and keyword research you generate within LocalSpy AI are stored in your account and associated with your user profile.

3. How We Use Your Data

We use your data strictly to provide and improve the service:

• Service delivery: Running your scans, generating reports, and storing your results
• Account management: Authentication, plan enforcement, billing communication
• Product emails: Transactional emails (password reset, account confirmations) and your opted-in Monday competitor alerts
• Security: Detecting fraud, abuse, and unauthorised access
• Support: Responding to your help requests
• Product improvement: Aggregate, anonymised analytics to understand how features are used

4. Third-Party Services

We use the following trusted third-party services to operate LocalSpy AI. Each has their own privacy policy:

We do not sell, rent, or share your personal data with any other third parties for marketing or commercial purposes.

5. Cookies & Tracking

We use minimal cookies necessary to operate the service:

• Authentication cookies: Keeps you logged in across browser sessions (essential — cannot be disabled)
• Session cookies: Temporary session data cleared when you close your browser
• Preference cookies: Remembers your in-app settings (optional)

We do not use advertising cookies, cross-site tracking, or third-party analytics tools like Google Analytics that track you across the web.

6. Data Storage & Security

Your data is stored on Supabase infrastructure, which uses PostgreSQL databases hosted on AWS. Data at rest is encrypted using AES-256. Data in transit is encrypted using TLS 1.2 or higher.

We implement the following security measures:

• Row-Level Security (RLS) — each user can only access their own data
• API authentication via JWT tokens with expiry
• Environment secrets stored securely and never exposed to the browser
• Regular automated database backups

Despite our best efforts, no system is 100% secure. If you discover a security vulnerability, please report it to support@localspyai.com.

Data Retention

We retain your data for as long as your account is active. When you delete your account:

• Your personal profile data is deleted within 30 days
• Your scan history and reports are deleted within 30 days
• Billing records are retained for 7 years as required by Indian tax law (IT Act)
• Anonymised aggregate usage statistics may be retained indefinitely

7. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of all data we hold about you
• Correction: Update or correct inaccurate data (you can do this directly in your account settings)
• Deletion: Request deletion of your account and all associated data
• Portability: Request your data in a machine-readable format (JSON/CSV)
• Objection: Object to specific types of processing (e.g. marketing emails)
• Restriction: Request that we limit how we process your data

To exercise any of these rights, email us at support@localspyai.com with the subject line "Data Rights Request". We will respond within 30 days.

If you are an EU or UK resident, you also have the right to lodge a complaint with your local data protection authority under GDPR. If you are an Indian resident, this policy is also compliant with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDPA).

8. Children's Privacy

LocalSpy AI is a professional business tool and is not intended for use by children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at support@localspyai.com and we will delete it immediately.

9. International Data Transfers

Cognalith Solutions Private Limited is incorporated in India. Our service providers (Supabase, Vercel, OpenAI, Razorpay) operate infrastructure globally, which means your data may be processed in the United States or European Union.

We ensure all such transfers comply with applicable data protection laws through the use of Standard Contractual Clauses (SCCs) and by choosing providers with appropriate certifications (SOC 2, ISO 27001).

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to all registered users
• Display a notice in the dashboard for 14 days

Continued use of the service after changes take effect constitutes your acceptance of the updated policy.

11. Contact Us

For any privacy-related questions, data requests, or concerns: