Privacy

Privacy Policy

This Privacy Policy explains how iSuggest.ai (“iSuggest.ai”, “we”, “us”) collects, uses, stores, shares and protects personal data when you use https://isuggest.ai and related services. It is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023 (“DPDP Act”) together with the rules made under it, to the extent each applies and as and when its provisions come into force.

For personal data you give us, iSuggest.ai acts as the “Data Fiduciary” and you are the “Data Principal” under the DPDP Act. By creating an account, verifying your email with a one-time password (OTP), submitting the contact form, or otherwise using the service, you consent to the processing described here. If you do not agree, please do not use iSuggest.ai.

1. Personal data we collect

  • Account data: your email address, account creation and login timestamps, your credit balance and credit ledger.
  • Authentication data: one-time codes, held briefly to complete login or signup, and session identifiers.
  • Audit inputs: page URLs you submit for audit or for publishing to an AI directory.
  • Audit and snapshot content: the report generated from a public web page (metadata, headings, links, images, structured data, response times), and, when you publish to an AI directory, a frozen capture of that page's readable content. This is content from the page you chose, not data we collect about you, but it may contain personal data if the page does.
  • Contact submissions: your name, email, phone number and any message you send us.
  • Technical data: IP address, browser user agent, request path and timestamps recorded in server logs for security, abuse prevention and debugging.
  • Payment data (if and when paid credits are offered): transaction reference, amount, date and status returned by our payment gateway. We do not see or store your full card number, CVV, UPI PIN or net-banking credentials; those are handled by the RBI-authorised payment aggregator.

We do not knowingly collect sensitive personal data such as passwords, financial account credentials, health information or biometric data. Please do not include any in messages or submitted pages.

2. Purposes and legal basis

We process personal data only for lawful purposes for which you have given consent, or for the “certain legitimate uses” the DPDP Act permits:

  • To create and secure your account and verify your email through OTP (consent, and to provide the service you requested).
  • To run audits, generate suggestions, and publish snapshots you ask us to publish.
  • To maintain and audit your credit balance and ledger.
  • To respond to support, legal or partnership requests you send us.
  • To detect abuse, fraud and security incidents, and to keep the service reliable.
  • To comply with law, court orders and lawful requests from government authorities.
  • To process payments and maintain tax and accounting records (if and when paid credits are offered).

We collect only what is needed for these purposes. We do not use your data for advertising, we do not sell it, and we do not build behavioural advertising profiles.

3. Your audits are private; published snapshots are public

Your audits are private. A report you run can be opened only by the account that ran it or, if you ran it while signed out, by that same browser session. It is not listed, searchable or reachable by another person, and we do not show one person's audits to another. An audit becomes public only when you choose to publish a page. When you publish a page to the Gemini, ChatGPT or Claude directory, we create an immutable snapshot at a stable public URL, served as HTML, JSON and Markdown and intentionally made available to search engines and AI crawlers. Because a snapshot is a permanent record of a public page as it was at that moment, we generally do not edit it after publication. Only publish pages you have the right to publish. If a report or snapshot contains personal data, is unlawful, or infringes your rights, write to us (see Grievance Officer below) and we will de-list, restrict or remove it as required by law. Copies already retrieved by search engines, AI systems or third parties are outside our control.

4. Cookies and sessions

We use a first-party session cookie (isuggest_ai) that is HttpOnly and SameSite=Lax and lasts up to 365 days and is renewed each time you visit, until you log out, and a security token to protect forms against cross-site request forgery. These are strictly necessary to keep you logged in and to keep the service secure. We do not use advertising or cross-site tracking cookies. You can clear cookies in your browser at any time; you will then need to log in again.

5. Who we share data with

We share personal data only with service providers who process it on our behalf under confidentiality and security obligations, and only as needed:

  • Hosting and infrastructure providers that store our application and JSON data.
  • Email delivery providers (our hosting server's mail transport or an email service such as Resend) that deliver OTP emails to your address.
  • Audit and page-capture engine that fetches and analyses the public URL you submit.
  • AI providers (currently Google Gemini) that generate improvement suggestions. The content of the page you submitted, not your email address, is sent for this purpose.
  • Payment gateway (if and when paid credits are offered) to process payments.
  • Authorities and courts where we are required by law, court order, or to protect rights, safety and security.

If iSuggest.ai is ever merged, acquired or restructured, personal data may transfer to the successor, which will be bound by this policy.

6. Storage location and cross-border transfer

Our providers may store or process data in India or in other countries. Under the DPDP Act, personal data may be transferred outside India except to countries the Central Government restricts by notification. We choose providers that apply reasonable security safeguards and we remain responsible for the data we entrust to them.

7. Retention

  • Account data and credit ledger: while your account is active, and afterwards for as long as needed for accounting, dispute resolution and legal compliance.
  • Reports and snapshots: until you ask for removal or we remove them under this policy or the law.
  • Contact submissions: for as long as needed to respond and keep a record of communications.
  • Server logs: for a limited period for security and diagnostics, and as required by law (for example, intermediary log-retention requirements), then deleted or anonymised.
  • Payment and tax records: for the period required by Indian tax and company law.

When personal data is no longer needed for the purpose it was collected for, and retention is not required by law, we erase it.

8. Security

We apply reasonable security safeguards appropriate to the data we hold: HTTPS in transit, time-limited OTPs, HttpOnly session cookies, CSRF protection, restricted access to storage, and least-privilege access for administrators. No system is completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users in the form and time required by law.

9. Your rights as a Data Principal

Under the DPDP Act you have the right to:

  • Access a summary of the personal data we process about you and the processing activities carried out, and the identities of those we have shared it with.
  • Correct, complete and update your personal data.
  • Erase your personal data when it is no longer necessary for the purpose it was collected, unless retention is required by law.
  • Withdraw consent at any time. Withdrawal is as easy as giving consent, does not affect processing already done, and may mean we can no longer provide the service to you.
  • Grievance redressal through the officer below, and, if unsatisfied, the right to complain to the Data Protection Board of India.
  • Nominate another person to exercise these rights on your behalf in the event of your death or incapacity.

Write to privacy@isuggest.ai from the email address on your account. We may need to verify your identity before acting. You are also expected to give accurate information and not to file false or frivolous complaints.

10. Children

iSuggest.ai is intended for adults. Under Indian law a person below 18 years is a child, and we do not knowingly process personal data of children or offer services to them. If you believe a child has given us personal data, contact us and we will delete it.

11. Grievance Officer

In accordance with the Information Technology Act, 2000, the Intermediary Guidelines Rules, 2021 and the DPDP Act, our Grievance Officer can be reached at privacy@isuggest.ai (subject line “Grievance”) or through the contact form. We acknowledge complaints within 24 hours for content-removal requests and within a reasonable period for other requests, and aim to resolve them within 15 days, or sooner where the law requires. Please include your account email, the URL concerned, and a clear description of the issue.

12. Changes to this policy

We may update this policy to reflect product changes or legal requirements. The date below shows the latest version. If a change is material, we will notify you (for example by email or a notice on the site) and, where the law requires, seek fresh consent.

13. Governing law

This policy is governed by the laws of India. See our Terms of Service for jurisdiction, and our Refund & Cancellation Policy for payments and credits.

Last updated: September 26, 2026