Privacy Policy

1. Information We Collect

We collect the following types of information when you use MarketGap:

• Account Information: Email address, username, and hashed password (or Google OAuth profile data) when you create an account.
• Search Data: Niche search queries you submit, search results returned, and timestamps.
• Usage Data: IP address, browser type, pages visited, and feature usage patterns.
• Payment Data: Transaction IDs and purchase records. Full payment card details are handled exclusively by Stripe and never stored on our servers.
• Affiliate Data: Referral codes, referral relationships, and commission records for affiliate program participants.

2. Cookies and Sessions

We use PHP session cookies to maintain your login state and track free search usage. These cookies are:

• Session cookies: Essential for authentication and security (CSRF protection). Expire when you close your browser.
• Affiliate tracking: If you arrive via a referral link, we store the referral code in your session for attribution purposes.

We do not use third-party tracking cookies or advertising pixels.

3. How We Use Your Information

We use collected information to:

• Provide and improve the niche research service
• Authenticate your identity and maintain account security
• Process payments and deliver purchased tokens
• Enforce usage limits and prevent abuse (rate limiting, IP tracking)
• Generate aggregated, anonymized analytics to improve the platform
• Manage the affiliate program and calculate commissions
• Communicate important service updates (we do not send marketing emails)

4. Third-Party Services

We integrate with the following third-party services, each governed by their own privacy policies:

• OpenAI: Your search queries are sent to OpenAI's API to generate AI-powered niche analysis. OpenAI processes this data under their privacy policy.
• Stripe: Payment processing is handled by Stripe. Your payment information is transmitted directly to Stripe and never touches our servers. See Stripe's privacy policy.
• YouTube Data API: We use YouTube's API to fetch relevant tutorial videos for niche topics. No user data is shared with YouTube through this integration.
• Google OAuth: If you sign in with Google, we receive your email and profile name from Google. We do not access any other Google account data.

5. Data Security

We implement industry-standard security measures to protect your data:

• Passwords are hashed using PHP's password_hash with bcrypt (never stored in plain text)
• CSRF tokens protect all form submissions
• Rate limiting prevents brute-force attacks
• IP-based access control for administrative functions
• HTTPS encryption for all data in transit
• Security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy)

6. Your Rights

You have the right to:

• Access: View the personal data we hold about you through your account dashboard.
• Correction: Update your username and password through account settings.
• Deletion: Request deletion of your account and associated data by contacting support.
• Portability: Request a copy of your search history and account data.

7. Data Retention

We retain your data as follows:

• Account data: Retained for the lifetime of your account, deleted upon account deletion request.
• Search history: Retained for up to 12 months, then automatically archived.
• Guest search IP logs: Automatically deleted after 24 hours.
• Rate limiting records: Automatically deleted after 24 hours.
• Payment records: Retained for 7 years for tax and legal compliance.

8. Children's Privacy

The Service is not intended for users under 13 years of age. We do not knowingly collect personal information from children. If we become aware that a child under 13 has provided us with personal data, we will take steps to delete that information.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a revised "Last updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

10. Contact

For questions or concerns about this Privacy Policy or your personal data, visit our Support Center.