Privacy Policy

1. Who we are

Indxel is operated by Yann Lephay, sole proprietor (micro-entreprise) based in Paris, France. Contact: contact@indxel.com.

2. What we collect

We collect the minimum data needed to provide the service:

• Account data — name, email address, and profile picture from your Google account when you sign in.
• Billing data — processed by Stripe. We store your Stripe customer ID and subscription ID. We never see or store your card number.
• Google Search Console data — if you connect GSC, we access your verified properties and URL indexation status via OAuth. We store access and refresh tokens to maintain the connection.
• Usage data — pages checked, projects created, SEO scores. Used to provide the service and improve it.
• Technical data — IP address, browser type, and device info collected automatically for security and debugging.

3. How we use your data

• Provide, maintain, and improve the Indxel service.
• Process payments and manage subscriptions.
• Submit URLs to search engines and check indexation status on your behalf.
• Send transactional emails (account confirmation, billing receipts).
• Respond to support requests.

We do not sell your data. We do not use your data for advertising.

4. Third-party services

We share data with the following providers, strictly to operate the service:

• Vercel — hosting and serverless functions (USA).
• Neon — PostgreSQL database (USA/EU).
• Stripe — payment processing (USA). Stripe Privacy Policy.
• Google APIs — OAuth authentication, Search Console, and Indexing API. Google Privacy Policy.
• Clerk — (if applicable) authentication service.

5. Google API Services — Limited Use Disclosure

Indxel's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use Google data to provide and improve the SEO features you explicitly request (indexation checking, URL submission). We do not use Google data for advertising, and we do not transfer it to third parties except as necessary to provide the service.

6. Data retention

We retain your account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days. Billing records are retained as required by French tax law (10 years). Anonymized, aggregated usage data may be retained indefinitely.

7. Your rights (GDPR)

As an EU resident, you have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Delete your account and data.
• Export your data in a portable format.
• Restrict or object to processing.
• Withdraw consent at any time by disconnecting your Google account or deleting your Indxel account.

To exercise any of these rights, email contact@indxel.com. We respond within 30 days.

8. Cookies

We use strictly necessary cookies for authentication and session management. We do not use tracking cookies or third-party analytics cookies. No cookie banner is required because we only use essential cookies.

9. Security

All data is transmitted over HTTPS. OAuth tokens are stored encrypted in our database. Webhook payloads are verified with cryptographic signatures. We follow industry-standard security practices.

10. Changes to this policy

We may update this policy from time to time. We will notify you of material changes via email or a notice on the dashboard. The “last updated” date at the top reflects the latest revision.

11. Contact

For any privacy-related questions, contact contact@indxel.com.