Ooty ("we," "our," or "us") operates the ooty.io website and the Ooty suite of MCP server applications (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service.
By using the Service, you consent to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, you must not access the Service.
2. Information We Collect
2.1 Account Information
When you create an account, we collect your email address and password (hashed using bcrypt before storage). If you use magic link authentication, we collect only your email address. If you sign in with Google, we receive your email address and profile name from Google.
2.2 Licence and Device Information
When you activate a licence, we collect your device's hardware identifier, platform type (macOS, Windows, or Linux), and a user-assigned device name. This data is processed solely for licence validation and device management.
2.3 Usage Data
We collect anonymised usage data to improve the Service, including feature usage patterns, error reports, and performance metrics. We do not collect the content of your projects, data queries, or research.
2.4 Session Data
When you use the Service, we generate short-lived session metadata for connection management and rate limiting. This includes a session identifier, the product being used, your licence reference, and timestamps. Session metadata expires automatically within 30 minutes and does not contain the content of your requests or responses.
2.5 Payment Information
Payment processing is handled by Paddle, the Merchant of Record for all Ooty transactions. Paddle processes all payments, handles tax compliance, and manages billing on our behalf. We do not directly collect or store your payment card information. Refer to Paddle's Privacy Policy for details on their data handling practices.
3. Google API Services User Data Policy
Ooty's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
3.1 Data Accessed Through Google APIs
When you connect your Google account, we may request access to the following data depending on which Ooty products you use:
Google Search Console -- search performance data (clicks, impressions, queries, position), URL inspection results, and indexing status for websites you have verified ownership of. Used by Ooty SEO.
Google Analytics 4 -- website analytics data including sessions, page views, traffic sources, conversions, and audience demographics for properties you have access to. Used by Ooty Analytics.
YouTube channel data -- channel statistics, video metadata, subscriber counts, and playlist information for YouTube channels you own or manage. Used by Ooty Video.
YouTube analytics data -- video performance data including watch time, audience retention, traffic sources, demographics, and revenue/monetisation metrics for channels you own. Used by Ooty Video.
Google advertising data -- keyword search volume estimates, cost-per-click data, competition levels, and campaign performance metrics for Google Ads accounts you have access to. Used by Ooty SEO and Ooty Ads.
Google Business Profile data -- business listing information, customer reviews, posts, and performance metrics for Google Business Profile listings you own or manage. Used by Ooty SEO (Local SEO features).
Google Merchant Center data -- product listing data, pricing, and status information from Google Merchant Center accounts you have access to. Used by Ooty Ads.
3.2 URL Indexing
Ooty SEO may submit URLs for indexing on your behalf using Google's search indexing service. This functionality is limited to websites for which you have verified ownership in Google Search Console and for which you have granted Ooty explicit permission.
3.3 Use of Google API Data
Google API data is used solely to provide analytics and insights within the Service.
Data is displayed to you within your AI assistant for the purpose of analysing your own website, channel, or account performance.
We do not use Google API data for advertising purposes.
We do not sell, share, or transfer Google API data to third parties.
We do not use Google API data to build user profiles for advertising or marketing.
3.4 Google API Data Storage and Retention
Google API data is processed on our servers in real-time and returned to your AI assistant. Response data is not permanently stored. Temporary caching may occur to improve performance, with cached data automatically expiring within 24 hours. You may revoke Ooty's access to your Google account at any time through your Google Account permissions page.
3.5 Server-Side API Keys
For certain Google APIs that do not require individual user authentication (such as PageSpeed Insights and Knowledge Graph Search), we use our own developer API keys on the server side. No personal user data is transmitted through these APIs. They return publicly available data about websites and entities.
4. Meta Platform Data
Ooty uses the Meta Pixel on ooty.io (with your consent) to measure website traffic and advertising effectiveness. When you consent to analytics cookies, the Meta Pixel may collect page view data, button clicks, and conversion events. This data is processed by Meta in accordance with Meta's Data Policy.
When you connect your Meta account to Ooty products, we may access the following data depending on which products you use:
Facebook Page engagement data (post reactions, comments, shares, reach) for Pages you manage. Used by Ooty Social.
Instagram Business account insights (post performance, audience demographics, engagement rates, reach) for accounts you manage. Used by Ooty Social.
Threads profile information and post insights for accounts you own. Used by Ooty Social.
Facebook and Instagram advertising data (campaign performance, ad spend, impressions, conversions) for advertising accounts you manage. Used by Ooty Ads.
4.1 Use of Meta Data
Meta data is used solely to provide social media analytics and advertising insights within the Service.
We do not post, modify, or delete any content on your behalf without your explicit action.
We do not sell or share Meta data with third parties.
4.2 Meta Data Retention
Meta API data is processed in real-time and cached for up to 24 hours.
Meta Pixel data is processed by Meta under their own retention policies.
4.3 Meta Data Deletion
You may request deletion of all Meta-related data by contacting .
You may revoke Ooty's access to your Meta account at any time through Facebook Settings > Apps and Websites.
We support Meta's data deletion callback. When notified by Meta, we delete all associated data within 30 days.
5. Social Media Platform Data
When you connect social media accounts to Ooty Social, we may access the following data:
X (Twitter) -- public profile information, tweet analytics, engagement metrics (likes, reposts, replies), and follower data for accounts you authorise. Access is read-only.
LinkedIn -- Company Page analytics (follower counts, post impressions, engagement rates, audience demographics) for Pages you manage. We do not access personal LinkedIn profile data beyond what is required for authentication.
Reddit -- public subreddit data, post performance, and comment analytics. We access only public data and data from accounts you explicitly authorise.
TikTok -- account metrics, video performance data (views, likes, shares, comments), and audience insights for accounts you authorise. Access is read-only.
Pinterest -- account metrics, pin performance data, and audience insights for business accounts you authorise. Access is read-only.
5.1 Use of Social Media Data
Social media data is used solely to provide analytics and insights within the Service.
Data from multiple platforms may be combined within the Service to provide unified cross-platform analytics. This combined view is accessible only to you.
We do not sell, share, or transfer social media data to third parties.
We do not post, modify, or delete content on any platform on your behalf unless you explicitly initiate the action.
You may revoke Ooty's access to any social media account at any time through that platform's settings or by contacting .
6. Amazon Marketplace Data
When you connect your Amazon Seller account to Ooty Commerce, we may access:
Product listing data (titles, descriptions, pricing, BSR rankings)
Sales and order data for your seller account
Advertising campaign data (impressions, clicks, spend, ACoS)
Keyword performance and search ranking data
Amazon data is used solely to provide seller analytics within the Service. We do not modify your listings, prices, or advertising campaigns without your explicit action. We do not sell or share Amazon data with third parties.
You may revoke Ooty's access to your Amazon account at any time through Amazon Seller Central > Apps & Services > Manage Your Apps.
7. How We Use Your Information
We use the information we collect for the following purposes:
To provide, maintain, and improve the Service
To manage your account and provide customer support
To process transactions and manage your subscription
To validate your licence and manage device activations
To send service-related communications (account verification, security alerts, billing updates)
To detect, prevent, and address technical issues and security threats
To comply with legal obligations
8. Data Sharing and Disclosure
We do not sell your personal information. We may share your information only in the following circumstances:
Service providers: We share data with third-party service providers who assist in operating the Service (including Supabase for database and authentication, Paddle for payment processing, Upstash for session management and rate limiting, Vercel for hosting, and Resend for transactional email). A full list of sub-processors is available on our Sub-Processors page.
Legal requirements: We may disclose your information where required by law, regulation, or legal process.
Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
With your consent: We may share your information for any other purpose with your explicit consent.
9. Data Security
We implement appropriate technical and organisational measures to protect your information, including:
HTTPS encryption (TLS 1.2+) for all data in transit
Password hashing using bcrypt
Row-level security (RLS) policies ensuring users can only access their own data
Encrypted storage of OAuth tokens and sensitive credentials
Regular security assessments of our codebase and infrastructure
No method of electronic transmission or storage is completely secure. Whilst we take all reasonable steps to protect your information, we cannot guarantee absolute security.
10. Data Retention
We retain your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we shall delete your personal information within 30 days, except where retention is required by law or for legitimate business purposes (such as resolving disputes or enforcing our agreements).
Licence activation and device event logs are retained for audit purposes and automatically purged after 12 months.
Specific retention periods:
Session metadata: automatically deleted after 30 minutes.
Rate limiting data: rolling window; no content stored.
Account data: retained until account deletion.
Platform API responses: not permanently stored. Data passes through our servers during processing and is not retained.
11. Your Rights
Depending on your location, you have the following rights regarding your personal information:
Access: You may request a copy of the personal information we hold about you.
Rectification: You may update your account information at any time through your dashboard.
Erasure: You may delete your account and all associated data through your dashboard settings, or by contacting us.
Data portability: You may export your data in a machine-readable format (JSON) through your dashboard settings.
Revoke platform access: You may revoke Ooty's access to your Google account or any other connected platform at any time through that platform's settings.
Objection: You may object to processing based on our legitimate interest. We shall cease processing unless we can demonstrate compelling legitimate grounds.
Restriction: You may request restriction of processing in certain circumstances (for example, whilst we verify the accuracy of your data).
Complaints: You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been processed unlawfully.
To exercise any of these rights, contact us at .
12. Lawful Basis for Processing
Under UK GDPR, we process your personal data on the following lawful bases:
Contract: Account data, licence data, and device data are processed as necessary to perform the contract for the Service.
Legal obligation: Payment records and transaction data are retained as required by financial regulations.
Legitimate interest: Anonymised usage analytics, error monitoring, and security measures are processed on the basis of our legitimate interest in improving and securing the Service.
Consent: Analytics cookies and Google API access are processed only with your explicit consent, which you may withdraw at any time.
13. Cookies and Tracking
We use cookies to provide and improve the Service. You may manage your cookie preferences at any time using the cookie banner or by clearing your browser cookies.
13.1 Essential Cookies (Always Active)
These cookies are strictly necessary for the Service to function and cannot be disabled.
Authentication session: Managed by Supabase to maintain your signed-in state.
Currency preference: Stores your selected display currency.
Cookie consent: Stores your cookie preferences.
Theme preference: Stores your light/dark mode selection.
13.2 Analytics Cookies (Optional)
With your consent, we use Google Analytics 4 and the Meta Pixel to analyse how the Service is used. These cookies collect anonymised data about page views and interactions. They do not track you across other websites.
14. International Data Transfers
Your data may be transferred to and processed in countries outside the UK, including the United States. Our service providers maintain appropriate safeguards for international transfers:
Supabase: Database and authentication. Our project is hosted in the EU (London, AWS eu-west-2). Supabase Inc. is US-headquartered; transfers are covered by Standard Contractual Clauses.
Paddle: Payment processing (Merchant of Record), UK-based. No international transfer is required for UK/EEA customers.
Upstash: Session management and rate limiting. Data is hosted in the UK (London, AWS eu-west-2). Upstash Inc. is US-headquartered; transfers are covered by Standard Contractual Clauses.
Vercel: Web hosting and deployment, US-based (with global edge network); covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.
Resend: Transactional email, US-based; covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.
Google: Analytics services (Google Analytics 4, consent-gated), US-based; covered by the EU-US Data Privacy Framework.
15. Sub-Processors
A current list of third-party sub-processors we use to provide the Service is maintained at ooty.io/legal/sub-processors. We shall notify existing users by email before adding any new sub-processor. If you require a Data Processing Agreement, our standard DPA is available at ooty.io/legal/dpa.
16. Children's Privacy and Age Verification
The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that personal information has been collected from a child, we shall take steps to delete that information.
To comply with this requirement, we collect your year of birth during account registration solely for the purpose of verifying that you are 16 or over. Your year of birth is not stored after verification is complete -- we retain only a confirmation that age verification was completed and the date it was performed. This data is not used for marketing, profiling, or any purpose other than age verification.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We shall notify you of any changes by posting the revised Privacy Policy on this page and updating the "Last updated" date. For material changes, we shall notify you by email or through the Service prior to the change becoming effective.