1. Who is responsible
IndexerPal ("IndexerPal", "we") is the controller of the personal data described here. Contact us about privacy at [email protected].
2. What we collect
| Data | Where it comes from |
|---|---|
| Account data: full name, email address, password (stored only as a salted hash), language preference | You, when you sign up or change language |
| Google sign-in data: name, email address, profile picture URL and Google account ID | Google, only if you choose "Continue with Google" |
| Order data: what you bought, amount, date, status, Stripe customer and payment IDs | You and Stripe |
| Billing data: billing name, address, tax ID, card brand and last four digits | You, entered on Stripe's checkout page or in Account settings. Full card numbers never reach us. |
| Your projects: the URLs you submit, the options you choose, and each URL's status and index results | You, and our indexing checks |
| API and connected apps: the names of your API keys, the apps and AI agents you connect and the permissions you give them, when each was last used, and how many requests your account makes each day | You, and the apps and agents you use |
| Agent requests: the email address an AI agent gives when it asks for access to an account, the name it gives itself, and the IP address it calls from | The agent. You approve the request with a code, or ignore it. |
| USDC payments: the blockchain transaction of a pack paid with x402, which shows the paying wallet address | Your wallet and the blockchain |
| Messages: name, email, website and message from the contact and support forms, and emails you send us | You |
| Technical data: IP address and browser user agent attached to login sessions and form submissions, and the IP address that registered an app | Your browser |
We use Google Analytics to measure how the website is used: pages viewed, where visits come from, and device and browser. We don't sell personal data.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Creating and running your account, signing you in | Contract (6(1)(b)) |
| Taking payment, sending and checking your URLs, keeping your credit balance | Contract (6(1)(b)) |
| Running the API, the MCP server and the apps and agents you connect, and applying usage limits | Contract (6(1)(b)) |
| Passing an agent's access request to the person it names, and stopping abuse of those requests | Legitimate interests (6(1)(f)): letting agents ask for access safely, without anyone getting access without the account owner's approval |
| Service emails: confirmation, password reset, receipts, project reports | Contract (6(1)(b)) |
| Keeping invoices and accounting records | Legal obligation (6(1)(c)) |
| Answering your messages | Legitimate interests (6(1)(f)): replying to people who contact us |
| Security: rate limiting, preventing fraud and abuse, enforcing our Terms, keeping logs | Legitimate interests (6(1)(f)): protecting our users and the Service |
| Measuring how the website is used, with Google Analytics | Legitimate interests (6(1)(f)): seeing which pages help and which don't |
We don't send marketing emails. If we ever want to, we'll ask for your consent first. Project report emails can be turned off in Account settings.
4. Who we share data with
We use a small number of service providers ("processors") who process data on our behalf, under contract:
| Provider | What for | Location |
|---|---|---|
| Stripe | Payments, invoices, fraud prevention | EU and United States |
| Resend | Sending service emails | United States |
| Sign-in, only if you use "Continue with Google" | United States | |
| Google Analytics | Measuring how the website is used | United States |
| The x402 payment facilitator or blockchain node provider we use, only for packs paid in USDC | Checking a USDC payment and submitting it to the blockchain. It receives the signed payment (wallet address and amount), never your name or email. | Depends on the provider, possibly outside the EEA |
| Our hosting, database and infrastructure providers | Running the website and our indexing system, and storing data. Infrastructure that processes the URLs you submit receives only the URLs, never your name, email or account details. | European Union; URL processing may take place outside the EEA |
Search engines receive the URLs you submit, as the Service requires. A USDC payment is recorded on a public blockchain, where anyone can see the paying wallet, the amount and the time, and where it can't be deleted. Apps and agents you connect receive the data their permissions allow, under their own privacy policies. We may also disclose data where the law requires it, or to protect our rights in a dispute.
5. International transfers
Where a provider processes personal data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision (such as the EU-US Data Privacy Framework, for certified companies).
6. How long we keep it
- Account data and projects: while your account exists, and up to 30 days after you ask us to delete it.
- Orders, invoices and credit history: as long as tax and accounting law requires, typically up to 10 years.
- Contact and support messages: up to 24 months after the conversation ends.
- Login sessions: until they expire (30 days) or you log out.
- API keys and connected apps: while your account exists. A disconnected app or agent is deleted 90 days after you disconnect it.
- Agent requests: deleted 7 days after the request expires (a request stays open 24 hours), whether you approved it or not.
- Daily request counts: 90 days.
7. Cookies
Some cookies keep the site working. Google Analytics sets its own, listed at the end of this table.
| Name | Purpose | Lifetime |
|---|---|---|
better-auth.session_token | Keeps you signed in | 30 days |
better-auth.state and related | Protects the Google sign-in flow | A few minutes |
better-auth.last_used_login_method | Remembers whether you last signed in with Google or with email, so the login page can point it out | 30 days |
NEXT_LOCALE | Remembers the language you chose | 1 year |
theme | Remembers light or dark mode, if you pick one (otherwise we follow your device) | 1 year |
tz | Your time zone, so the dashboard shows dates in your local time | 1 year |
checkout_pack | Remembers the pack you chose while you create an account | 2 hours |
_ga, _ga_* | Google Analytics: distinguishes visitors and stores the session | Up to 2 years |
Stripe sets its own cookies on its checkout page, for fraud prevention, under Stripe's privacy policy.
8. Your rights
You can ask us to access, correct, delete, restrict or export your personal data, and you can object to processing based on legitimate interests. Write to [email protected] from the email address on your account. We reply within one month. You also have the right to complain to your local data protection authority.
9. Security
Passwords are stored only as salted hashes. All traffic is encrypted with TLS, access to production data is limited to the people who need it, and sign-in attempts are rate limited. No system is perfectly secure; if a breach ever affects your data, we'll tell you and the relevant authority as the law requires.
10. Children
IndexerPal is a business service and isn't meant for anyone under 18. We don't knowingly collect data about children.
11. Changes
If we change this policy in a way that matters, we'll update the date at the top and, for significant changes, email account holders before the change takes effect.