1. Introduction
IndexGraph ("we", "us", "our") is operated by Adexorb Technologies Private Limited ("Company"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our SEO and AI search optimization services available at indexgraph.ai (the "Service").
By using our Service, you consent to the practices described in this policy. If you do not agree, please do not use the Service.
2. Information we collect
2.1 Information you provide
- Account information: email, name, password (hashed)
- Website information: URLs you submit for audit
- Payment information: handled by Razorpay; we do not store card details
- Communications: emails, support requests, feedback
2.2 Information collected automatically
- IP address, browser type, device information
- Usage data: pages visited, features used, time spent
- Cookies and similar tracking technologies
2.3 Information from third parties
- Google OAuth (if you sign in with Google): name, email, profile image
- Google Search Console / Analytics (if you connect these)
3. How we use your information
- Provide, operate, and maintain the Service
- Perform SEO and AI search audits on URLs you submit
- Process payments and manage subscriptions
- Send service-related communications (verification emails, billing notices)
- Respond to your inquiries and provide customer support
- Improve our Service and develop new features
- Detect and prevent fraud, abuse, and security incidents
- Comply with legal obligations
4. How we share your information
We do not sell your personal information. We share data only with:
- Service providers: Vercel (hosting), Razorpay (payments), Resend (email), Postgres (database) — all under data processing agreements
- AI providers: OpenAI, Google Gemini, Anthropic, Perplexity — when running AI-powered audits on URLs you submit
- DataForSEO: for backlink and keyword data when you run relevant features
- Law enforcement: if required by law or to protect our rights
4.1 Google API Services User Data
When you connect Google Search Console or Google Analytics to IndexGraph, we receive data from those Google APIs. In compliance with the Google API Services User Data Policy (including the Limited Use requirements), our handling of that data adheres to the following commitments.
4.1.1 Limited Use
- We use Google user data only to provide user-facing features within IndexGraph.
- We do not transfer Google user data to third parties except as necessary to provide or improve the Service, comply with applicable law, or as part of a merger, acquisition, or sale of assets with appropriate notice to users.
- We do not use Google user data to serve advertisements.
- We do not allow humans to read your Google user data unless we have your affirmative agreement, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for our internal operations — in which case the data is aggregated and anonymised.
4.1.2 No use for AI or model training
We do not use any data received from Google APIs (including Google Search Console and Google Analytics data) to develop, improve, or train generalised AI or machine learning models, whether our own or those operated by any third-party AI provider.
4.1.3 Scopes and purposes
- webmasters.readonly— when you connect Google Search Console, we read your verified site list, search performance metrics, sitemap status, and URL inspection results. This is a read-only scope — we cannot modify, create, or delete data in your Google Search Console account.
- analytics.readonly— when you connect Google Analytics 4, we read aggregated traffic, session, and conversion data. This is a read-only scope — we cannot modify, create, or delete data in your Google Analytics account.
- openid, profile, email— when you sign in with Google, we receive your basic profile information (name, email address, profile picture) for account creation and authentication only.
4.1.4 Revoking access
You can revoke IndexGraph's access to your Google data at any time:
- Visit https://myaccount.google.com/permissions and remove IndexGraph from the list of connected apps; or
- Email support@indexgraph.ai requesting deletion of your connection.
Upon revocation, we will delete the connection record and any imported Google API data from our active systems within 30 days. Backup copies are deleted within 90 days as part of our normal retention schedule.
5. Data retention
We retain your account information as long as your account is active. Audit data is retained for the duration of your subscription plus 90 days. Google API data (Search Console and Analytics) is deleted within 30 days of disconnection or account deletion, with backup purge within 90 days.
You may request deletion at any time by emailing support@indexgraph.ai. We will acknowledge your request within 3 business days and complete deletion within 30 calendar days, except where retention is required by law (for example, tax or financial records).
6. Your rights
Depending on your jurisdiction, you may have rights to:
- Access the personal information we hold about you
- Correct inaccurate or incomplete information
- Request deletion of your information
- Object to or restrict certain processing
- Receive your data in a portable format
- Withdraw consent at any time
To exercise these rights, email support@indexgraph.ai.
7. Security
We implement industry-standard security measures including encryption in transit (TLS 1.2+), encryption at rest, password hashing with bcrypt (12 rounds), CAPTCHA-protected authentication (Cloudflare Turnstile), rate limiting, two-factor authentication available for administrative accounts, and SSRF-hardened external fetching. No method of transmission over the Internet is 100% secure.
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected users within 72 hours of becoming aware of the breach, in line with GDPR Article 34 and equivalent regulatory requirements. Suspected vulnerabilities can be reported in confidence to support@indexgraph.ai.
8. Cookies
We use cookies and similar technologies in the following categories:
- Strictly necessary: authentication session cookies (NextAuth), CSRF protection tokens, and the Cloudflare Turnstile CAPTCHA challenge. These cannot be disabled without breaking core functionality.
- Functional: theme preference (dark / light mode), recent website selection, and audit cache keys. These improve usability but are not strictly required.
- Analytics: aggregated, privacy-preserving analytics about feature usage and error rates. We do not use third-party advertising trackers.
- Marketing: we do not currently set marketing or advertising cookies. If this changes, this Policy and the cookie consent banner will be updated in advance.
You can control cookies through your browser settings. Disabling strictly-necessary cookies will prevent you from signing in or completing protected actions.
9. Children's privacy
The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us.
10. International transfers
Your information may be transferred to and processed in countries other than your own, including India, the United States, and the European Union. We ensure appropriate safeguards are in place.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance.
12. Contact us
For questions about this Privacy Policy or our data practices, contact us at:
Email: support@indexgraph.ai
Company: Adexorb Technologies Private Limited
Website: indexgraph.ai