Privacy Policy

Last updated: June 2026

1. Who we are

IndexedAI (indexedai.tech) is operated by a solo founder based in Italy. For any privacy-related enquiries, contact privacy@indexedai.tech.

2. What we collect

Account data

  • Email address — required to create an account
  • Name — optional, set during registration
  • Password — stored as a bcrypt hash; we never store the plain-text password
  • Subscription plan — Free, Pro, or Agency
  • Stripe customer ID and subscription ID — references to your billing account in Stripe; we do not store card numbers or bank details

Scan data

  • The URL submitted for analysis
  • The Agent Readiness Score and 5-axis breakdown
  • The generated llms.txt and llms-full.txt content
  • Crawled page content (temporarily, for processing only)
  • Scan timestamp and status

MCP hosting data (Pro and Agency plans)

  • The domain and URL of each site registered for MCP hosting
  • Per-request MCP event logs: tool called, timestamp, user-agent, IP country (not full IP), and query text submitted by the AI agent

Usage data

  • Anonymised analytics via Google Analytics 4 (post-consent)
  • Ad measurement data via Meta Pixel (post-consent)

3. Why we collect it

  • Service delivery — to run the analysis pipeline, generate llms.txt files, and host your MCP endpoint. Legal basis: contract performance.
  • Billing and subscription management — to process payments, manage plan changes, and communicate about your subscription via Stripe. Legal basis: contract performance.
  • MCP analytics — to provide you with usage statistics for your hosted MCP endpoint (which AI agents are calling it, what tools they use). Legal basis: contract performance / legitimate interest.
  • Product communications — to inform you about updates, new features, and improvements. Legal basis: legitimate interest / consent. You can opt out at any time by emailing privacy@indexedai.tech.

4. How long we keep your data

Account data — kept for the lifetime of your account and deleted within 30 days of account deletion upon request.

Scan records — retained for 12 months from the date of the scan, then permanently deleted. Free-plan scans may expire sooner (see Terms of Service).

MCP event logs — retained for 90 days on a rolling basis.

Billing references (Stripe IDs) — kept for the duration required by applicable accounting and tax law (typically 7 years in Italy).

5. Third-party processors

We share data with the following sub-processors to operate the service:

ResendTransactional email delivery (verification emails, scan reports)
TursoDatabase hosting (accounts, scan records, sites, MCP event logs)
NetlifyWeb hosting and serverless functions
StripePayment processing and subscription billing — handles card data directly, under Stripe's PCI-DSS compliance
AnthropicAI processing via Claude API — generates llms.txt content from crawled site data
Google GeminiAI processing (alternative pipeline for llms.txt generation)
Google LLCAnalytics (GA4) — anonymised usage data, post-consent only
Meta Platforms Inc.Advertising (Meta Pixel) — ad measurement, post-consent only

We do not sell your personal data to any third party. Payment card data is handled exclusively by Stripe and never transmitted to or stored on our servers. Data is stored in the EU where processor infrastructure allows it.

6. Cookies and tracking

IndexedAI uses the following technologies that may store data on your device:

Session cookie essential

A secure, HTTP-only JWT session cookie used to keep you logged in. Contains no sensitive personal data. Expires when you sign out or after the session timeout.

Consent cookie essential

A first-party cookie (cookie_consent) that stores your tracking preference. Expires after 12 months. Contains no personal data.

Google Analytics 4 analytics, non-essential

Provided by Google LLC. Collects anonymised data about how visitors use the site (pages visited, session duration, device type). IP anonymisation is enabled. Only loaded after consent (EU/EEA) or if not opted out (other regions).

Google's privacy policy: policies.google.com/privacy

Meta Pixel marketing, non-essential

A tracking pixel provided by Meta Platforms Inc. used to measure the effectiveness of our advertising. It may collect your IP address, browser information, and actions taken on this site. Only loaded after you give consent (EU/EEA users) or if you have not opted out (other regions).

Meta's privacy policy: facebook.com/privacy/policy

You can withdraw or change your consent at any time using the cookie banner or by emailing privacy@indexedai.tech.

7. Your rights (GDPR)

If you are located in the European Economic Area, you have the following rights regarding your personal data:

  • Access — request a copy of the data we hold about you
  • Rectification — request correction of inaccurate data
  • Erasure — request deletion of your data at any time
  • Objection — object to processing for marketing purposes
  • Portability — request your data in a machine-readable format
  • Restriction — request that we limit processing of your data while a dispute is resolved

To exercise any of these rights, email privacy@indexedai.tech. We will respond within 30 days. Note that deleting your account does not automatically cancel an active Stripe subscription — cancel the subscription first via the billing portal, then request account deletion.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date above. Continued use of the service after changes constitutes acceptance of the updated policy.