Privacy Policy

1. Who we are and scope

INDEXA.digital (“Indexa”, “we”) provides hosted search, product indexing, widget, reporting, and related account services. This policy applies to our website, office dashboard, APIs, and support communications.

For account and website data, Indexa acts as the data controller. When a customer uses Indexa on its own online store, that customer controls its visitors’ data and Indexa processes search activity on the customer’s instructions.

2. Data we process

• Account and contact information you provide when registering, managing your profile, or contacting support.
• Store content and settings needed to provide product search and related features.
• Search activity, interactions with results, and technical identifiers such as IP addresses.
• Subscription, payment, referral, communication, and basic service-diagnostic information.

3. Purposes and legal bases

We process data to provide the service and perform our agreement, secure accounts and prevent abuse, answer requests, meet legal and accounting duties, and improve Indexa. Optional analytics storage is based on consent. You may withdraw analytics consent at any time without affecting essential service functions.

4. Search history and IP addresses

We keep search history and associated IP addresses for a limited period to provide useful search features, measure service quality, prepare statistics, and protect the service from misuse. The applicable search-history period depends on the customer’s tariff; older records are removed.

Customers must give their own visitors an appropriate privacy notice and obtain any consent required for analytics on their websites.

5. Cookies and analytics

Essential cookies keep the service secure, remember your preferences, and support requested account functions. Analytics helps us understand how Indexa is used and improve it.

Before you allow analytics, Google receives only limited signals without analytics cookies. If you allow it, analytics cookies may be used. Advertising personalisation remains disabled. You can change your choice through Cookie settings.

6. Google user data and Google Tag Manager

If you choose Google sign-in or connect Google Tag Manager, Indexa receives limited information from Google. For Google sign-in, this may include your Google account identifier, verified email address, and display name. For Google Tag Manager, Indexa accesses account, web-container, workspace, and existing tag, trigger, and variable metadata needed to show available workspaces and carry out the installation you request.

Indexa uses this information only to authenticate or link your Indexa account, maintain the requested Google Tag Manager connection, identify the selected account, container, and workspace, and create the requested Indexa tags, triggers, and variables. We do not access Google services or data beyond the scopes and functionality needed for these user-initiated features.

Google account identifiers and email addresses used for authentication may be retained as account data while needed to provide Google sign-in or account-linking functionality. Google Tag Manager access tokens are stored in the authenticated session only for their validity period and are removed when they expire or the session ends. Workspace and resource metadata obtained during a request is used to complete that request and is not retained as a separate Google-data profile.

7. Recipients and processors

We disclose data only as needed to infrastructure, email, authentication, payment, monitoring, and analytics providers; to professional advisers; when required by law; or in a business reorganisation. Providers may process data only for agreed services and must protect it appropriately. We do not sell personal data.

8. Google User Data Sharing and Disclosure

Indexa.digital does not sell Google user data and does not share, transfer, or disclose Google user data to advertising platforms, data brokers, information resellers, or other third parties for advertising, marketing, profiling, creditworthiness, lending, or similar purposes.

Google user data may be processed by service providers acting on behalf of Indexa.digital only when necessary to operate, secure, maintain, or support the service, and only under appropriate confidentiality and data protection obligations. We may also disclose data when required by applicable law, legal process, or to protect the security and integrity of the service.

Google Tag Manager data accessed through the Google API is used only to perform functionality explicitly initiated by the user, such as identifying the selected GTM account, container and workspace and creating the requested Indexa tag and trigger. We do not transfer Google Tag Manager data to third parties for independent use.

9. Google API Limited Use

Indexa.digital’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Indexa.digital does not use Google user data obtained through Google APIs to develop, improve, or train generalized artificial intelligence or machine learning models.

10. International transfers

Some providers may process data outside your country. Where required, we use recognised safeguards such as adequacy decisions, standard contractual clauses, and supplementary security measures.

11. Retention

Account and configuration data is kept while the account is active. Search logs follow the tariff-specific retention period. Security records are kept only as long as needed to investigate and prevent abuse. Payment and transaction records may be retained for the statutory accounting period. Backups are rotated and expire on a controlled schedule.

12. Your rights

Depending on applicable law, you may request access, correction, a portable copy, restriction, objection, or deletion of personal data, and may withdraw consent. You may also complain to the competent data-protection authority.

13. Export and deletion process

Send an export or deletion request from the email address registered to your account to [email protected] and state the customer account or website concerned. We will verify control of the account before acting.

For an export, we provide account information and available customer configuration and analytics data in a commonly readable electronic format. For deletion, we close the account and remove or anonymise account, catalog, configuration, search-history, and IP-address records, subject to technical completion time.

We normally respond within 30 calendar days. We may retain narrowly limited payment, fraud-prevention, dispute, or legal-compliance records where the law requires or permits it, and will explain any such exception.

14. Security and policy changes

We use access controls, encryption in transit, credential hashing, monitoring, backups, and data-minimisation practices appropriate to the risks. No system can be guaranteed completely secure.

We may update this policy when the service or law changes. The version and effective date appear above; material changes will be communicated through the service or by email when appropriate.