Moskey CMS Data Privacy Policy
Effective Date: September 4, 2026 | Last Updated: September 6, 2026
1. Executive Overview & Scope
Moskey Technologies ("Company," "we," "us," or "our") operates Moskey CMS, an omnichannel content distribution, multimedia scheduling, and analytics workspace accessible at moskey.in/cms. This Privacy Policy details our protocols regarding the collection, receipt, handling, storage, protection, and deletion of user data and sensitive information when users connect their third-party accounts (including YouTube, Instagram, Facebook, TikTok, LinkedIn, Threads, Discord, and X) via OAuth 2.0 authorization.
By accessing or using Moskey CMS, you acknowledge that you have read and agreed to the practices described in this Privacy Policy.
2. OAuth Access Scopes & Use of Google User Data
Moskey CMS strictly adheres to the Principle of Least Privilege. When connecting external publishing channels, we request only the narrowest, granular permissions critical to providing automated cross-posting and analytics features initiated by the user.
YouTube Data API v3 (Google) Requested Scopes:
- https://www.googleapis.com/auth/youtube.upload: Used solely to upload user-created video assets and YouTube Shorts directly to the user's authenticated YouTube channel upon explicit, user-initiated publishing actions from the Moskey CMS workspace.
- https://www.googleapis.com/auth/youtube.readonly: Used exclusively to retrieve and display the authenticated channel's title, profile thumbnail, subscriber count, total video count, and aggregate view statistics inside the user's private Moskey CMS analytics dashboard.
- https://www.googleapis.com/auth/userinfo.profile: Used as a fallback to display the authenticated account manager's display name when channel metadata is unavailable.
No Broad or Destructive Permissions: Moskey CMS does not request or use broad management scopes (youtube), partner content ID scopes (youtubepartner), or deletion/modification scopes (youtube.force-ssl). We never delete videos, alter channel settings, or post unauthorized comments.
Other third-party social integrations (Meta, TikTok, LinkedIn, Discord, and X) likewise utilize minimal scopes solely to publish user-approved media and display engagement telemetry.
3. Data Protection Mechanisms for Sensitive Data
Moskey Technologies implements comprehensive technical, administrative, and physical safeguards designed to protect sensitive user data, authentication credentials, and Google OAuth tokens against unauthorized access, destruction, loss, alteration, or disclosure:
Data Encryption in Transit
All communications between user web browsers, Moskey CMS application servers, cloud storage backends, and Google/YouTube APIs are strictly encrypted in transit using industry-standard Transport Layer Security (TLS 1.2 and TLS 1.3) protocols and enforced HTTPS. Insecure HTTP connections are unconditionally rejected.
Data Encryption at Rest
All sensitive data, including OAuth 2.0 access tokens, refresh tokens, and authentication secrets, are encrypted at rest using AES-256-GCM (Advanced Encryption Standard with 256-bit Galois/Counter Mode). Encryption keys are managed independently in secure cloud key vaults, completely isolated from application code and client environments.
Role-Based Access Control (RBAC) & MFA
Production server and database environments are protected by strict Role-Based Access Controls and zero-trust policies following the principle of least privilege. Only authorized engineering personnel with verified business needs have backend access, protected by mandatory Multi-Factor Authentication (MFA) and audited session logs.
Automated Processing & Zero Human Inspection
Google user data and uploaded video files are handled exclusively through automated algorithmic pipelines to execute user-requested uploads and generate analytics. No Moskey employee, contractor, or third party reads, views, or inspects user Google data unless affirmative written consent is provided for specific troubleshooting requests.
Infrastructure Resilience & Vulnerability Management
Moskey CMS databases and servers are hosted within certified, tier-1 cloud infrastructure providers adhering to ISO/IEC 27001, SOC 1, SOC 2 Type II, and PCI DSS compliance standards. We employ automated Web Application Firewalls (WAF), distributed denial-of-service (DDoS) mitigation, real-time threat monitoring, and regular automated dependency and security vulnerability patching.
4. Google API Services User Data Policy & Limited Use Disclosure
Moskey CMS's use and transfer to any other app of information received from Google APIs adheres strictly to the Google API Services User Data Policy, including the Limited Use requirements:
- No Transfer to Third Parties: We do not transfer Google user data to third parties, unless such transfer is strictly necessary to provide or improve user-facing features of Moskey CMS, to comply with applicable laws, or as part of a merger or acquisition with explicit user notification.
- No Advertising Use: We never use or disclose Google user data for serving advertisements, including personalized, retargeted, or interest-based advertising.
- No Data Commercialization: We never sell, rent, monetize, or lease Google user data or any derived personal information to data brokers, advertisers, or third parties.
- No AI/ML Model Training: Google user data is not used to train generalized artificial intelligence (AI), machine learning (ML), or large language models (LLMs).
- No Human Access: No human is permitted to read Google user data unless we have obtained your affirmative agreement for specific messages/files, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for internal operations on aggregated, de-identified data.
5. Data Retention, Revocation & Deletion Procedures
Users maintain full control over their connected accounts, credentials, and published assets:
- Immediate In-App Disconnection: You can disconnect your YouTube or Google account at any time directly through the Moskey CMS Accounts Settings. Upon disconnection, stored OAuth access tokens, refresh tokens, and channel credentials are immediately and permanently erased from our active database.
- Revocation via Google Security Settings: You can revoke Moskey CMS's authorization permissions at any time directly through Google's security portal at https://myaccount.google.com/permissions.
- Complete Workspace & Account Deletion: You can submit a permanent account deletion request at any time using our online Account Deletion Portal or by contacting our privacy team at privacy@moskey.in. All associated personal records, brand settings, and media records are irreversibly purged within 30 days.
6. YouTube Terms of Service & External Platform Policies
By using YouTube integration features through Moskey CMS, you acknowledge and agree that your use is also subject to the:
7. Payment Information & Payment Gateway Security (PhonePe)
When you purchase a Moskey CMS subscription, elevated publishing tiers, or digital service credits, payment transactions are processed through certified third-party payment gateway partners, primarily PhonePe Payment Services Pvt. Ltd. ("PhonePe").
Zero Storage of Payment Instrument Data: Moskey Technologies does not receive, view, or store sensitive payment credentials such as full credit/debit card numbers, CVVs, card expiration dates, net banking credentials, or UPI MPINs.
Payment Security Standards: All payment communications are encrypted via end-to-end TLS (Transport Layer Security) and handled in accordance with Payment Card Industry Data Security Standards (PCI-DSS Level 1) and Reserve Bank of India (RBI) payment security directives.
For information on how cancellations and refunds are handled, please review our Refund and Cancellation Policy and Return Policy.
8. User Rights & Statutory Privacy Protections
Depending on your jurisdiction (including under India's Digital Personal Data Protection Act 2023, EU GDPR, and CCPA/CPRA), you have enforceable rights regarding your personal information, including the right to access, rectify, export, or delete your account data, and the right to revoke third-party platform authorization at any time. We never sell, rent, or trade personal data or Google user data for monetary value or behavioral advertising.
9. Contact Governance & Grievance Redressal
If you have questions, security disclosures, or wish to exercise data rights regarding this Privacy Policy:
Moskey Technologies Privacy & Data Governance Office
Designated Grievance Officer: Naveen Poddar
Privacy Email: privacy@moskey.in
Customer Support: support@moskey.in
Phone: +91 7975730964 / +91 9263866339
Registered Address: Near Gumla Traders, Booty More, Ranchi, Jharkhand - 834001, India
Website: https://www.moskey.in
Statutory complaints will be acknowledged within 48 hours and resolved within 30 days as mandated under Indian IT Rules.