Privacy Policy

1. Who We Are

Skymoon Infotech is an AI-first digital growth studio registered and operating in India. We help businesses grow through SEO, Generative Engine Optimisation (GEO), Paid Advertising, Content Marketing, Web Design and Development, Conversion Rate Optimisation (CRO), and Branding.

Registered address: 408, Iscon Emporio, Satellite, Ahmedabad, Gujarat 380015, India

Contact: [email protected]  |  011-69320384

Under the DPDPA 2023, Skymoon Infotech acts as a Data Fiduciary - the entity that determines the purpose and means of processing your personal data.

2. Data We Collect & Why

We collect only the data that is necessary for the specific purpose described. We do not collect data we do not need.

3. Consent

How we obtain your consent

Under the DPDPA 2023, your consent must be free, specific, informed, unconditional, and unambiguous. We obtain it through an affirmative action - for example, checking a consent box, submitting a form with a clear consent statement, or explicitly opting in to communications.

Pre-ticked boxes, implied consent, or bundled consent are not used on our website.

How to withdraw your consent

You may withdraw your consent at any time by:

• Emailing [email protected] with the subject line "Withdraw Consent"
• Clicking the unsubscribe link in any marketing email you receive from us
• Requesting erasure of your data via our Grievance Officer (see Section 17)

Withdrawal of consent will not affect the lawfulness of data processed before the withdrawal. We will stop processing your data for the withdrawn purpose within 72 hours of receiving your request, unless a legal obligation requires us to retain it.

Legitimate use without consent

In limited circumstances, we may process your data without consent where it is necessary for:

• Compliance with a court order or statutory requirement under Indian law
• Responding to a medical emergency involving you or someone else
• Employment-related processing for our own staff (where applicable law permits)

4. How We Use Your Data

We use personal data strictly for the purposes stated at the time of collection. Specific uses include:

• Service delivery: To provide, manage, and improve our digital marketing services for clients
• Audit requests: To analyse your website, ad accounts, or search presence and deliver a customised audit report
• Communication: To respond to your inquiries, proposals, and support requests
• Invoicing and payments: To process and record payments for services
• Marketing: To send newsletters, case studies, or SEO insights - only when you have opted in
• Website improvement: To understand how visitors interact with our site and improve user experience
• Legal and compliance: To comply with applicable Indian laws, court orders, or regulatory requirements

We will not use your personal data for any purpose materially different from those described above without first notifying you and obtaining your consent.

5. AI Tools & Artificial Intelligence

Skymoon Infotech is an AI-first digital growth studio. We use artificial intelligence tools to enhance the quality, speed, and effectiveness of our work. This section explains how AI is used and what it means for your data.

AI tools we use internally

Our AI data-handling principles

• No PII in AI prompts: We do not enter personally identifiable information (names, email addresses, phone numbers, financial data) into third-party AI tools without your explicit consent.
• Human oversight: All AI-generated content and recommendations are reviewed and approved by a qualified human team member before delivery to clients or publication.
• No automated decisions about you: We do not use AI to make fully automated decisions that have a legal or similarly significant effect on you as an individual without human review.
• Third-party AI terms apply: When AI tools process any data, their own privacy policies and terms of service also apply. We recommend reviewing Anthropic's (anthropic.com/privacy) and OpenAI's (openai.com/policies/privacy-policy) policies.
• AI-generated content disclosure: Where content published on behalf of clients is substantially AI-assisted, we disclose this to the client and follow platform and regulatory guidelines on AI content transparency.

6. Third-Party Services & Tools

We use trusted third-party service providers to operate our business. These providers are authorised to process your data only for the specific purposes we have engaged them for and are contractually required to maintain confidentiality and security.

Once you leave our website or are redirected to a third-party platform, their privacy policies govern your data. We encourage you to review these independently.

7. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to improve your experience on our website and to understand how it is used.

You can manage, update, or withdraw your cookie consent at any time by clicking the "Cookie Preferences" link in the footer. You may also control cookies through your browser settings, but note that disabling all cookies may affect the functionality of our website.

8. Your Rights Under DPDPA 2023

As a Data Principal under India's Digital Personal Data Protection Act, 2023, you have the following rights. These are in addition to any rights under other applicable laws.

9. Children's Privacy

Our website and services are not directed at children under the age of 18. We do not knowingly collect personal data from children. Under the DPDPA 2023, processing personal data of a child (person under 18 years) requires verifiable parental or guardian consent.

If you believe we have inadvertently collected data from a person under 18, please contact us at [email protected] and we will delete it promptly.

10. Data Retention

We retain your personal data only for as long as necessary for the purpose it was collected, or as required by law. Our standard retention periods are:

In line with Section 8(7) of the DPDPA 2023, we will erase personal data once the purpose for which it was collected is no longer being served, or upon the withdrawal of your consent, unless a legal obligation requires retention.

11. Cross-Border Data Transfers

Some of our third-party service providers (including Google, Meta, Anthropic, OpenAI, and others listed in Section 6) process or store data on servers located outside India - including in the United States, European Union, and Singapore.

Where data is transferred outside India, we ensure appropriate safeguards are in place, including contractual obligations on the receiving party to maintain a standard of data protection consistent with the DPDPA 2023.

As India's DPDP Rules 2025 finalise the list of permitted and restricted countries for cross-border transfers, we will update our data transfer practices accordingly.

12. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted to and from our website
• Access controls - personal data is accessible only to authorised personnel who need it for their role
• Regular security reviews of third-party tools and integrations
• Password policies and two-factor authentication on internal systems
• No storage of payment card data on our servers (Razorpay is PCI-DSS Level 1 certified)

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security.

13. Payment Information

We use Razorpay as our payment processing partner. Razorpay is PCI-DSS Level 1 certified and does not store your card data on its servers in unencrypted form. Your card and bank details are encrypted using AES-256 encryption during transmission.

We receive only a transaction reference ID and payment status - we never see or store your full card number, CVV, or PIN. Purchase transaction data is used only to confirm and record the payment.

For more details on how Razorpay handles your payment data, see: razorpay.com/privacy

14. Email Marketing

With your explicit opt-in, we may send you email communications including SEO insights, case studies, GEO updates, and Skymoon Infotech service news.

• You will only receive marketing emails if you have actively opted in - no pre-ticked boxes
• Every marketing email includes a clear and easy one-click unsubscribe link
• Unsubscribe requests are processed within 48 hours
• Unsubscribing from marketing does not affect transactional emails related to active services

15. Data Breach Notification

In the event of a personal data breach that is likely to result in harm to you, we will:

• Notify the Data Protection Board of India within the timeframe required by the DPDPA 2023 and DPDP Rules 2025
• Notify affected data principals (you) as required by the Board, or sooner if we judge that notification would help you mitigate harm
• Document the breach, its cause, its impact, and the remedial action taken in our internal breach register

If you believe your data may have been involved in a security incident, please contact us immediately at [email protected].

16. Changes to This Privacy Policy

We review and update this Privacy Policy periodically to reflect changes in our services, technology, and applicable law. The version number and "Last Updated" date at the top of this page will always indicate the most recent revision.

For material changes - changes that significantly affect how we collect or use your personal data - we will notify you by email (if you have provided one) or by a prominent notice on our website at least 15 days before the change takes effect. Continued use of our website after that date constitutes acceptance of the updated policy.