Privacy Policy

Information we collect

We collect information you provide directly, information collected automatically, and information from the service providers we use to operate.

• Account information: when you create an account, our authentication provider (Clerk) processes your name and email address.
• Contact information: when you use our contact form, we collect your name, email, chosen topic, and message.
• Audit inputs: when you run a scan, we collect the website URL or domain you submit and the results we generate.
• Payment information: payments are processed by Stripe. We do not see or store full card numbers. We receive limited billing details such as the last four digits, card brand, and transaction status.
• Usage data: with your permission, Google Analytics processes approved product and website usage events. Separately, we use a hashed form of your IP address and your browser user agent for rate limiting and abuse prevention. Those strictly necessary security controls do not depend on analytics consent.

How we use information

• Provide, operate, and maintain our products and services.
• Run the audits you request and deliver results.
• Process payments, subscriptions, and credits.
• Respond to your messages and support requests.
• Protect our services against fraud, abuse, and security threats.
• Improve our products and understand how they are used.
• Comply with legal obligations.

Cookies and analytics

We use strictly necessary cookies and similar technologies for authentication, security, abuse prevention, and checkout. With your permission, we also use Google Analytics to understand aggregate product and website usage. Analytics is not required for the service to work. If analytics consent is missing, denied, expired, or withdrawn, we do not send protected content-attribution events to Google Analytics.

Content attribution and analytics choices

If you follow an approved index365 content link, we may store a first-touch attribution record in that browser tab for up to 30 minutes. The record may include an approved source path, source channel, campaign identifier, and content identifier. It does not include your email address, name, submitted website, payment information, or raw Google Analytics identifiers.

When you make an analytics choice, we store a local browser record. For authenticated product use, we may also create a signed receipt that expires no later than 180 days after the original local decision. If you create an account while valid consent and attribution are present, we may link that account-creation event to the approved content source. Google Analytics receives only the fields allowed by our event contract. Supabase remains the source of truth for account and product activation, and Stripe remains the source of truth for billing and revenue.

You may withdraw analytics consent at any time through the controls we provide. Withdrawal stops future protected analytics delivery, cancels unsent protected events, and removes protected identifiers from pending records. Account deletion removes the consent authority and protected attribution data associated with that account.

Service providers we share with

We share information only with the service providers needed to run our business. We do not sell your personal information.

• Clerk: authentication and account management.
• Stripe: payment and subscription processing.
• Supabase: database and storage.
• Vercel: application hosting.
• Cloudflare: bot protection and network security (including Turnstile).
• Google Analytics: consented aggregate product and website usage analytics.

We may also disclose information when required by law or to protect our rights, users, or the public.

Data retention

We retain information only for as long as needed to provide the services, protect the product, comply with legal obligations, resolve disputes, and enforce our agreements. For the analytics and attribution system described above:

• A browser-tab attribution record expires after 30 minutes.
• A signed consent receipt expires no later than 180 days after the original local decision.
• After consent is withdrawn, a minimal revocation record may remain until 180 days after the revocation time to enforce the choice and prevent stale consent from being restored.
• Protected attribution links are deleted after 90 days.
• Terminal analytics delivery payloads are removed after 30 days.
• Identified first-party funnel events are deleted after 400 days.
• Long-term reporting keeps aggregate counts only, without the protected identifiers used for delivery.

Account deletion removes the account’s consent authority and protected attribution data. We may retain other information for a longer period when required for security, fraud prevention, billing, legal compliance, or dispute resolution. We delete or anonymize information when it is no longer needed for these purposes.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. To make a request, reach us through our contact form. We will respond within the timeframe required by applicable law.

Security

We use industry-standard safeguards, including encryption in transit, access controls, and reputable infrastructure providers, to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

Our services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

International users

We operate from the United States. If you access our services from outside the United States, you understand your information may be processed in the United States, where data protection laws may differ from those in your country.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. Material changes will be communicated through the site.