1. In short
- We collect only what the Service needs: your account, your purchases, and the URLs you ask us to send.
- The systems that process and check your URLs receive the URLs only, never who you are.
- We use Google Analytics to see how the website is used. We never sell data.
- Every processor we use is under a data processing agreement, and transfers outside the EEA are covered by Standard Contractual Clauses or an adequacy decision.
- You can access, correct, export or delete your data by emailing [email protected].
2. Our role
IndexerPal is the controller for the personal data in your account, your purchases, your projects and your messages.
3. Lawful bases
We rely on contract (running your account and delivering what you bought), legal obligation (keeping invoices), and legitimate interests (security, fraud prevention, answering messages, analytics). We don't rely on consent for anything today, because we send no marketing. The table in section 3 of the Privacy Policy maps each purpose to its basis.
4. Your rights, and how to use them
| Right | What it means |
|---|---|
| Access (art. 15) | Get a copy of the personal data we hold about you |
| Rectification (art. 16) | Have inaccurate data corrected |
| Erasure (art. 17) | Have your data deleted, except what we must keep by law (such as invoices) |
| Restriction (art. 18) | Have us pause processing while a question is resolved |
| Portability (art. 20) | Receive your data in a machine-readable format (your project reports export as CSV from the dashboard) |
| Objection (art. 21) | Object to processing based on legitimate interests |
Email [email protected] from the address on your account, saying which right you want to use. We answer within one month, and may ask you to confirm your identity first. It's free, unless a request is manifestly unfounded or excessive.
You can also complain to the data protection authority in the EU country where you live or work.
5. Processors
Stripe (payments), Resend (email delivery), Google (optional sign-in and analytics), the x402 payment facilitator or blockchain node provider we use (only for packs paid in USDC), and our hosting, database and infrastructure providers (infrastructure that processes your URLs receives the URLs only). Section 4 of the Privacy Policy lists what each one does and where.
6. Data breaches
If a personal data breach is likely to put your rights at risk, we notify the competent supervisory authority within 72 hours of becoming aware of it and, where the risk is high, we tell you directly without undue delay.
7. Data processing agreement
Customers who need a data processing agreement for their own records can request one at [email protected].