Privacy Policy
NicheSpy is operated by Biplob Ghatak (sole proprietor) from West Bengal, India. This policy explains what data we collect when you use nichespy.com and the app at app.nichespy.com, why we collect it, where it’s stored, and what you can do about it.
1. Who we are
Data controller: Biplob Ghatak, t/a NicheSpy.
Contact: support@weeziq.com
Jurisdiction: India. We comply with India’s Digital Personal Data Protection Act, 2023 (DPDPA) and, where applicable, the EU GDPR and UK GDPR for users in those regions.
2. What we collect
- Account data: email address, hashed password (or magic-link token), display name, account creation date, last login.
- Billing data: we don’t store card numbers. Polar (our merchant of record) returns a customer ID, subscription ID, plan, billing interval, and the country we’re instructed to invoice — we store those.
- Project data you give us: the domains you add, keywords you research, prompts you track, sites you crawl, and the resulting reports.
- Crawl & API outputs: public HTML and SEO metadata we fetch from your own sites (and from the public SERP) on your behalf. We do not crawl pages behind authentication unless you give us credentials, and we don’t store full page bodies — only the structured findings.
- Usage data: feature events (which screens you opened, which jobs you ran), error/diagnostic logs, and aggregate counters used to enforce plan limits.
- Technical data: IP address (truncated after 30 days), browser type, device type, referring URL. We use this for security and fraud prevention only.
We do not collect special-category personal data (health, biometric, political views, etc.). Don’t put any in a tracked prompt or audit report.
3. Why we collect it (legal bases)
- Performance of contract — to actually run keyword lookups, audits, citation checks and the dashboard you signed up for.
- Legitimate interest — security, fraud prevention, abuse detection, debugging.
- Legal obligation — tax / invoicing records (kept by Polar on our behalf as merchant of record).
- Consent — optional product-update emails. You can opt out from any email or from Settings → Account.
4. Where your data lives (sub-processors)
We’re a one-person company and we deliberately use a small number of well-known processors. Each one only sees the data it needs to do its job:
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | US / EU |
| Vercel | Web hosting, request edge | Global |
| Inngest | Background jobs (crawls, scheduled checks) | US |
| Polar | Payments & invoicing (merchant of record) | EU / US |
| Resend | Transactional & digest email | EU / US |
| Serper.dev | Public SERP data for keywords you search | US |
| Google Gemini API | Content generation, intent classification, citation parsing | US |
| OpenAI / Perplexity / Anthropic | Citation-target queries (only if enabled) | US |
Transfers outside India / the EEA are covered by Standard Contractual Clauses where the processor offers them. We do not sell or rent data to third parties. We do not use it to train any AI model.
5. Cookies & tracking
We use one strictly-necessary cookie for authentication (your Supabase session). We do not run third-party advertising trackers. If we enable a privacy-respecting analytics tool (e.g. Plausible or self-hosted PostHog), we’ll list it in the sub-processor table above and never link it to your email.
6. How long we keep it
- Active account: as long as the account exists.
- Cancelled account: 30 days, then permanently deleted. You can request immediate deletion at any time.
- Invoices & tax records: retained by Polar for the period required by their merchant regulations (typically 7–10 years).
- Diagnostic logs: 30 days.
7. Your rights
You can: access your data, get a copy in a portable format (CSV/JSON), correct it, delete it, restrict or object to certain processing, and withdraw consent for optional emails. Most of these are one-click in Settings → Account. For anything else email support@weeziq.com — we aim to respond within 7 days and complete the request within 30.
If you’re in the EEA or UK and unhappy with our response, you may complain to your local supervisory authority. If you’re in India, you may complain to the Data Protection Board of India.
8. Security
Data is encrypted in transit (TLS 1.2+) and at rest in our database. Row-level security ensures one tenant’s data can’t be read by another. The service-role key is only used in server-side jobs. Passwords are hashed (never plaintext). We’ll notify affected users within 72 hours of becoming aware of any personal-data breach likely to result in risk to your rights.
9. Children
NicheSpy is not directed at children under 16. We don’t knowingly collect their data.
10. Changes to this policy
We’ll post any change on this page with a new “last updated” date. If the change is material — for example, a new sub-processor with a different purpose — we’ll email account holders at least 14 days before it takes effect.
11. Contact
Questions, requests or complaints: support@weeziq.com. See also our Terms of Service.