Privacy Policy

This Privacy Policy explains how Indexed AI Co., Ltd. ("Indexed", "we", "us", "our") collects, uses, discloses, transfers, retains, and protects personal data in connection with the Indexed website at beindexed.ai and the Indexed service (collectively, the "Service").

This Policy is part of our Terms of Service and is governed by the PDPA. Where you submit personal data of any individual other than yourself, you warrant that you have lawful basis to do so and that you have informed that individual of the matters covered by this Policy.

1. Who We Are and Data Protection Officer

The data controller (or, under the PDPA, the organisation) responsible for personal data collected under this Policy is Indexed, registered in Australia, with contact details set out in Section 13.

Our Data Protection Officer (DPO) under section 11(3) of the PDPA can be reached at hello@beindexed.ai.

2. Personal Data We Collect

2.1 From the Client at signup and during onboarding

• Identification: name, role/title, business name, business registration number (where provided).
• Contact: email address, phone number, Telegram handle, business postal address.
• Business operations data: business hours, menu or service list, brand assets (logo, photos), business descriptions.
• Account credentials: the email and salted-hashed password used to access the client portal.

2.2 From payment processing

• Payment metadata: Stripe customer ID, billing address, card brand, last 4 digits of card, expiry, transaction status, refund history.
• We do not collect or store full card numbers, CVV codes, or magnetic-stripe data. These are processed and held exclusively by Stripe under its own privacy and security obligations.

2.3 From your use of the Service

• Site usage: pages viewed, actions taken, edit requests submitted, preview confirmations, log-in events, session metadata. For a free scan, we store the website or social links you submit, the email address you give to open your report, and the approximate country and city of your connection provided by Cloudflare. The scan location record contains only country and city, not your IP address or other connection metadata. For scan abuse prevention, we keep one-way hashes of connection identifiers, not your IP address in readable form.
• Communications log: emails, Telegram messages, and support tickets exchanged with Indexed.
• Rumi memory: when you explicitly tell Rumi, our assistant, a preference or goal for your business (for example how you like replies, or what you want to achieve this quarter), Rumi keeps that statement, its date and a reference to the conversation it came from, so it can apply it in later conversations. Only statements you make explicitly are applied; anything Rumi infers is held as an unconfirmed candidate and is not treated as your stated preference. Memory is kept separately for each business and site: owners see their own items, managers see only items shared with the business, and no other account or customer can read them. A remembered preference never authorises spending, publishing or approvals.

2.4 Automatically (analytics)

We count page views on our main public pages without asking you: an anonymous page-view count (which page, the day, the type of site you came from, mobile or desktop, and your country), with no cookies, nothing stored in your browser, no IP address or browser details kept, and nothing personal. Click-level capture and all other analytics below happen only if you choose “Allow analytics”. Reloads and detected automated traffic are excluded. In the same anonymous way we count how often the analytics notice is shown and whether Allow or Decline is chosen (the day, mobile or desktop, and your country, with nothing that identifies you). A Global Privacy Control or Do Not Track signal switches the count off too.

The other analytics on beindexed.ai is optional and off by default. Nothing in the first five items below is collected until you choose “Allow analytics” in our analytics preferences panel, and none of it is collected while your browser sends a Global Privacy Control or Do Not Track signal. All of it is sent only to our own servers at beindexed.ai; no advertising or analytics script from Google, Meta, or any other third party runs on our pages.

• First-party analytics: the pages you view and a small set of named actions (for example a call, map, or Telegram link click, opening a menu, changing language, or submitting a form — the fact of submission only, never what you typed), together with the referring website, campaign tags in the link you arrived from (utm parameters), device type (mobile or desktop), browser language, and your country as reported by our hosting network. A visit identifier, held for your browser tab session, links the actions of one visit together.
• Heatmaps: on our main public pages, click positions rounded to one thousandth of the page width and height, vertical pixel position, page dimensions, and element selectors made from tag names, IDs, classes and element order. We also record bursts of repeated nearby clicks (rage clicks), scroll-depth buckets and maximum scroll percentage, with your screen size class (mobile, tablet, or desktop), page version and observation time. We also keep click and scroll counts on a coarse 20-by-20 grid. No text, form values, keystrokes, or visitor identifier are recorded, and clicks on form fields are ignored.
• Live visitor count: while a public page is open and visible, your browser sends a short signal about every 45 seconds so we can see how many people are on the site right now. It carries a random identifier for that browser tab, the page path, the referring website’s domain, and device type; our hosting network adds an approximate location (city, region, country, and approximate coordinates) derived from your connection.
• Website experiments: when we test two versions of a page, a random identifier stored in your browser lets us show you the same version on each visit and count which version led to an action. It is generated in your browser and is not linked to your name, email, or account.
• Ad-click identifiers: if you arrive from an advertisement whose link carries a click identifier (such as Google’s gclid, Meta’s fbclid, TikTok’s ttclid, or Microsoft’s msclkid), we record it with the visit so we can tell which campaign brought you to us. We do not send these identifiers back to the advertising platforms.
• Deployed Sites: the same first-party analytics may run on Deployed Sites so that we can report visits and enquiries to the Client. It sends data only to beindexed.ai. On a Deployed Site, nothing is recorded until the visitor has chosen. The site shows a short banner with Decline and Allow, and until the visitor chooses Allow it sends us nothing: no page view, landing page, referrer, campaign tags or ad-click identifiers, and it stores no identifier in the browser. If the visitor chooses Allow, the analytics starts at once on that page and records page views, named actions, campaign tags and ad-click identifiers from that moment. Declining, withdrawing consent, or a Global Privacy Control or Do Not Track signal from the visitor’s browser keeps it off and removes the analytics identifiers it stored in the browser. The choice is remembered in the browser’s local storage on that site for 90 days. It does not use the website-experiment identifier on Deployed Sites. Each Client is responsible for obtaining its own visitors’ consent and for deciding whether its site needs a consent banner.
• Cloudflare: Cloudflare, our hosting provider, also produces aggregated traffic statistics (such as request counts, countries, and browser types) from requests to its network, without third-party tracking cookies.
• Operational logs: server-side request, error, and audit logs necessary to operate and secure the Service.

2.5 From third parties

• Stripe: transaction events, billing status.
• Publicly available information: for onboarding speed, we may augment your submission with publicly available business information (Google Business listings, public Telegram presence, etc.).

2.6 Customer Data on your Deployed Site

Where your Deployed Site includes a contact form, Customer Data (the personal data of your end-customers) flows through that form into our operational systems and is forwarded to you. The roles and responsibilities of Indexed and the Client in respect of Customer Data are addressed in our Data Processing Addendum.

3. Purposes of Collection and Use

We collect, use, and disclose personal data for the following purposes:

(a) To deliver the Service: build, deploy, and maintain your Site; register and operate your domain; run your regular Indexed Live checks of how AI systems describe your business.

(b) To bill, charge, refund, and otherwise administer payment under the Terms.

(c) To communicate with you about your account, the Service, security, billing, and material changes to terms or policies.

(d) To provide customer support and resolve incidents, including letting Rumi apply the preferences and goals you have told it (Section 2.3).

(e) To improve, secure, and operate the Service, including reviewing Agent performance, refining internal prompts, and detecting fraud or abuse. For a free scan, we store your email to send an access code, deliver your report, and create or find your portal account after verification, even if you do not buy a website. We use the approximate country and city to see where scans come from so we can run the service (Section 2.3).

(f) To comply with applicable law, court order, lawful regulatory request, and our legal obligations.

(g) To enforce or defend our legal rights, including in respect of disputes.

(h) To facilitate any actual or proposed merger, acquisition, restructuring, or sale of all or part of our business.

(i) Where you have allowed analytics, to understand how our website is used, to see how many people are visiting at a given moment, to measure which page designs work better, and to learn which campaigns bring visitors to us (Section 2.4).

Personal data will be used only for purposes that the individual would reasonably consider appropriate in the circumstances, in accordance with section 18 of the PDPA.

4. Legal Basis (Consent under the PDPA)

Where required by the PDPA, we collect, use, and disclose personal data with the consent of the individual (deemed or express). For most processing described in this Policy, consent is given by:

(a) Accepting our Terms of Service at signup (a clickwrap action that records the acceptance);

(b) Voluntarily providing information through the client portal or in communications with us;

(c) Continuing to use the Service after being notified of this Policy.

The anonymous visit count (Section 2.4) holds no personal data. Optional analytics on beindexed.ai (Section 2.4) relies only on your express consent, given by choosing “Allow analytics”. It is not a condition of using our website or the Service, and we treat a Global Privacy Control or Do Not Track signal from your browser as a refusal. Analytics on a Deployed Site likewise relies only on the visitor’s choice of Allow in the banner shown on that site, as described in Section 2.4; the Client remains responsible for its own visitors’ consent.

Where consent cannot be relied upon, we rely on other legal bases permitted under the PDPA, including legitimate interests, performance of contract, and compliance with legal obligations.

5. Withdrawal of Consent

You may withdraw your consent to our collection, use, or disclosure of your personal data at any time by emailing hello@beindexed.ai.

For optional analytics, you can also withdraw at any time, without contacting us, using the button below, or by opening Privacy settings in the footer of our main website pages, such as the home page, and choosing “Decline”. Our policy pages do not run analytics and do not show the Privacy settings footer button; from any page you can also withdraw by emailing hello@beindexed.ai. Optional analytics collection stops straight away and the analytics identifiers stored in your browser are removed. The anonymous page-view count continues unless your browser sends a Global Privacy Control or Do Not Track signal; those signals stop both kinds of collection. Withdrawing analytics consent does not affect your use of the website or the Service.

Withdraw analytics consent on this browser

Withdrawal of consent may prevent us from continuing to provide the Service to you and may result in termination of your Subscription under Section 13 of the Terms. We will inform you of the likely consequences of withdrawal within a reasonable period after receiving your request and will give effect to the withdrawal within a reasonable period thereafter.

6. AI Processing

The Service is operated by autonomous AI Agents. Personal data you submit (including Client Content) may be processed by:

We have entered into data processing terms with each AI provider that:

(a) Restrict the use of submitted data to delivering the Service;

(b) Prohibit, where the provider's terms permit such opt-out, the use of submitted data to train the provider's general-purpose models; and

(c) Require appropriate security and confidentiality safeguards.

We do not authorise any AI provider to use your personal data for purposes outside delivering the Service, to the extent we can exclude such use under the provider's terms.

7. How We Share Personal Data

We share personal data only with:

(a) Service providers that operate the Service on our behalf, including Cloudflare (hosting, CDN, registrar, analytics, email routing), Stripe (payment processing), Airtable (operational database), PlanetScale (operational database), Resend and Postmark (email delivery), Apify and Firecrawl (collection of publicly available website and business-listing information for scans and website builds), Google (PageSpeed Insights and Search Console reporting), Telegram (messaging), Meta and TikTok (only if you connect your advertising accounts), and the AI providers listed in Section 6;

(b) Indexed personnel on a strict need-to-know basis for delivering and supporting the Service;

(c) Professional advisors (lawyers, accountants, auditors) under duties of confidentiality;

(d) Government and law enforcement authorities where required by law, court order, or other lawful process;

(e) Acquirers or successors in connection with any merger, acquisition, restructuring, or sale of all or part of our business, subject to ongoing confidentiality and equivalent privacy protections.

Analytics data described in Section 2.4 is sent only to our own servers and is stored with Cloudflare as our hosting provider. We do not share it with advertising networks or analytics companies, and we do not pass ad-click identifiers back to the platforms that issued them.

We do not sell personal data to any third party.

8. Cross-Border Transfers

Personal data collected under this Policy is transferred outside Singapore and stored, processed, or accessed in jurisdictions including but not limited to:

• The United States (Cloudflare, Stripe, Airtable, PlanetScale, Resend, Postmark, Firecrawl, Anthropic, OpenAI, Google, Higgsfield, Meta, TikTok);
• The European Union (some Cloudflare edge locations, some Stripe processing, Apify);
• Other regions where our team, Cloudflare's global edge or our AI providers operate.

In accordance with section 26 of the PDPA and the Personal Data Protection Regulations 2021, before transferring personal data overseas we take reasonable steps to ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection at least comparable to the PDPA, including through:

(a) Written contractual obligations imposing equivalent protections;

(b) Use of providers that have publicly demonstrated compliance with internationally recognised privacy frameworks (e.g. SOC 2, ISO 27001, GDPR-aligned data processing agreements);

(c) Reliance on the provider's own binding corporate rules where applicable.

By using the Service, you consent to these cross-border transfers.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected or as required by law. Free scan report-contact copies of your email expire 90 days after the latest verification email request; a bounded hourly cleanup deletes expired copies when report audit retention is enabled. The email held in your scan portal account and the approximate scan country and city are not deleted automatically after 90 days; neither has an automatic expiry. These free scan records are exceptions to the account and operational-log periods below.

After the applicable retention period, we will delete, anonymise, or return the personal data, except where retention is required by law or to defend a legal claim.

10. Security

We implement reasonable security arrangements to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal, and similar risks, including:

(a) HTTPS / TLS encryption in transit;

(b) Cloudflare edge security including WAF and DDoS protection;

(c) Encrypted storage for sensitive fields and secrets;

(d) Access control, role-based permissions, and audit logging for operational systems;

(e) Salted, hashed password storage with industry-standard algorithms;

(f) Regular security review of the Agent and Worker systems.

No system is perfectly secure. If we become aware of a data breach that has or is likely to have a significant impact on individuals or that affects 500 or more individuals, we will notify the Personal Data Protection Commission of Singapore and the affected individuals as soon as practicable and within the timeframes required by sections 26C–26E of the PDPA.

11. Your Rights

Subject to limitations under the PDPA, you have the right to:

You can review what Rumi remembers about your business in the Rumi panel of your client portal (“What Rumi remembers”), and correct or forget any item there yourself. A forgotten item stops being used by Rumi and disappears from your portal immediately. A corrected item is replaced in the same way. We keep a record of the original statement, the change and when it was made, for audit and security, under the retention periods in Section 9. Forgetting an item in the portal is not erasure. Stored preferences and goals are not deleted automatically when your subscription ends. To have it erased, email hello@beindexed.ai; we will erase it within 30 days of a verifiable request. Erasure removes the remembered statement itself. We keep a minimal record of each erased item: its identifiers, type, dates, a reference to the conversation it came from and a one-way fingerprint of the statement. The fingerprint is used only so that the same statement cannot be re-created from the original message, and the record is kept while your account exists.

To exercise any of these rights, email hello@beindexed.ai. We will respond within 30 days of receiving a verifiable request. We may charge a reasonable fee for access requests in accordance with the PDPA.

12. Children

The Service is not directed to, and we do not knowingly collect personal data from, individuals under the age of 18. If we become aware that we have collected personal data from a person under 18, we will delete it as soon as practicable. If you believe a minor has provided us with personal data, contact us at hello@beindexed.ai.

13. Contact

For any matter relating to this Policy or the personal data we hold about you, including access, correction, withdrawal of consent, or complaints:

• Data Protection Officer and general: hello@beindexed.ai

If you are not satisfied with our response, you may make a complaint to the Personal Data Protection Commission of Singapore at pdpc.gov.sg.

14. Cookies and Similar Technologies

We use only the following categories of cookies and similar technologies:

(a) Strictly necessary cookies — required for session management in the client portal and for Cloudflare's security and CDN functions;

(b) Functional cookies — to remember your language preference and other display settings;

(c) First-party analytics — on beindexed.ai, the anonymous visit count uses no cookies and no browser storage. Beyond that count, only if you choose “Allow analytics”, our own scripts use your browser’s local storage and session storage (rather than cookies) to hold a random experiment identifier, an identifier for the current visit, and a random identifier for the live visitor count, as described in Section 2.4. Declining, or sending a Global Privacy Control or Do Not Track signal, removes them. Your analytics choice itself is remembered in local storage for 90 days. On a Deployed Site, nothing is stored or sent until the visitor chooses Allow in the site’s banner; after that, the identifier for the current visit is held in session storage (Section 2.4). Cloudflare’s own traffic statistics do not use third-party tracking cookies.

We do not use third-party advertising cookies, cross-site tracking, or browser fingerprinting.

You can configure your browser to refuse cookies, but parts of the Service (including the client portal) may not function correctly without them.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in law, our Service, or our practices. The "Last updated" date at the top reflects the most recent change.

Where changes are material, we will notify you by email or through the client portal at least 14 days before the change takes effect.

16. Language

This Policy is made in English, which is the controlling language. Any translation is provided for convenience only.