Privacy Policy

This policy covers personal data processed through the IndexZero marketing site at https://indexzero.site, the product at https://app.indexzero.site, the IndexZero blog, and the MCP server and APIs we provide.

Afterlume Labs is the controller of that data. We do not sell personal data, and we do not use it for advertising.

Account data

Your name and email address, a hashed password if you sign up with one, and, if you sign in with Google, the profile information Google returns for that sign-in. We also store the workspace your account belongs to and the answers you give during onboarding.

Workspace and project data

What you put into the product: project domains and market settings, saved keywords and tags, rank trackers and their SERP history, site audits and the pages and issues found in them, backlink snapshots, and your conversations with the in-product AI assistant, including the project memory it keeps between sessions.

Connected Google accounts

If you connect Google Search Console or Google Analytics, we store OAuth tokens for those connections (encrypted at rest) and the metrics we retrieve on your behalf: queries, pages, clicks, impressions, positions, and the Analytics reports you view in the product.

Billing data

Your plan and subscription status, credit balances, and a ledger of what each credit was spent on. Payments are processed by Dodo Payments; card numbers never reach our systems and we do not store them.

Usage and technical data

IP address, user agent, request and error logs, and product analytics events such as page views, feature usage, and which tools were called. API keys for the MCP server are stored hashed, alongside a short prefix so you can recognise them in the UI. Sign-up and password-reset requests pass through Cloudflare Turnstile, which processes technical signals to tell people from bots.

Communications

Emails you send us for support, and delivery metadata for the transactional email we send you (verification, password reset, notifications).

• to provide the Service: run research, audits, trackers, and agent tools, and show you the results;
• to authenticate you, keep accounts secure, and detect abuse and fraud;
• to meter and bill credits, and to run subscriptions and invoicing;
• to send transactional email, and product notifications you have not opted out of;
• to understand how the product is used and improve it;
• to provide support and respond to your requests;
• to comply with legal obligations and enforce our Terms.

We do not use your workspace data to train AI models for anyone else, and we do not share your data with other customers.

Where GDPR or equivalent law applies, we rely on: performance of a contract, for everything needed to deliver the Service you signed up for; legitimate interests, for security, abuse prevention, and product analytics; legal obligation, for tax and accounting records; and consent, where we ask for it, for example when you connect a Google account, which you can disconnect at any time.

Search Console and Analytics connections use read-only Google API scopes. We request them only when you start a connection, and we use them only to show you your own data inside IndexZero and to power features you have asked for, such as Search Console performance reports, URL inspection, striking-distance analysis, and analytics reporting.

IndexZero’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In particular: we do not sell Google user data, we do not use it for advertising, we do not transfer it except as needed to provide or improve user-facing features, to comply with law, or as part of a merger or acquisition, and we do not allow humans to read it except with your explicit consent, for security or legal reasons, or on aggregated and anonymised data used to run the Service. Google user data is never used to train generalised AI or machine-learning models.

You can disconnect a Google account from the integrations page in IndexZero at any time, which deletes the stored tokens, and you can revoke our access directly at myaccount.google.com/permissions.

The in-product assistant and the AI-visibility features send prompts to AI model providers through OpenRouter, which routes requests to the underlying model provider. Those prompts may include your project data, keywords, and page content.

We ask those providers not to use our traffic for model training, and we do not use your workspace data to train models of our own. Prompts and responses are processed on the providers’ infrastructure under their terms. Data retrieved from a connected Google account is not sent to AI model providers for training.

We share personal data with service providers who process it only to deliver the Service to us:

• Cloudflare: hosting, database, storage, CDN, bot protection (Turnstile), and transactional email delivery;
• DataForSEO: the search data provider that fulfils keyword, SERP, backlink, and local search requests;
• Dodo Payments: payments, subscriptions, and invoicing, as merchant of record;
• PostHog: product analytics;
• OpenRouter and the AI model providers it routes to: AI assistant and AI-visibility features;
• Google: sign-in, and Search Console and Analytics data for accounts you connect.

We may also disclose data where the law requires it, to protect our rights or someone’s safety, or to investigate fraud or a security incident. If Afterlume Labs is involved in a merger, acquisition, or sale of assets, data may transfer as part of that transaction, subject to this policy.

Our providers operate globally and data may be processed outside your country, including in the United States. Where the law requires it, transfers rely on Standard Contractual Clauses or another approved safeguard.

We keep account and workspace data while your account is active, and for as long as needed after that to meet legal, tax, and accounting obligations and to resolve disputes. Credit ledger and billing records are retained for the periods those obligations require. Logs and analytics events are kept for a limited period and then discarded or aggregated.

You can delete individual projects, keywords, trackers, audits, and API keys from within the product at any time.

To close your account and have its data deleted, email us from the address on the account. We action verified requests within 30 days; residual copies may persist in encrypted backups for a limited period before being overwritten, and records we are legally required to keep are retained.

• TLS in transit, and encryption at rest for OAuth refresh tokens;
• API keys stored hashed, scoped to the MCP server and nothing else, and rate limited;
• workspace-scoped access control on every request, so one workspace cannot read another’s data;
• captcha on sign-up and password reset;
• least-privilege access to production systems, granted to the people who need it.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities where the law requires it.

We use cookies that are necessary to run the Service, including session and authentication cookies and the security cookies Cloudflare sets. Without them you cannot stay signed in.

We use PostHog for product analytics, to see which features are used and where people get stuck. We do not run advertising or cross-site tracking cookies. You can opt out of analytics with your browser’s Do Not Track or Global Privacy Control signal, or by blocking the analytics script.

Depending on where you live, you may have the right to access your personal data, correct it, delete it, receive a portable copy, object to or restrict processing, and withdraw consent you previously gave. California residents have rights under the CCPA/CPRA, including the right to know and to delete; we do not sell or share personal data as those terms are defined there.

Email us to exercise any of these. We may need to verify your identity first, and we will respond within the time the applicable law allows. If you are in the EEA or UK you may also complain to your local supervisory authority.

IndexZero is a business tool and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

The Service links to sites we do not control, including search results, competitor pages, provider documentation, and pages surfaced in audits and research. Their privacy practices are their own, and this policy does not cover them.

We may update this policy. When we make material changes we will update the date at the top of this page and, where appropriate, notify you by email or in the product. Continuing to use the Service after a change takes effect means the updated policy applies to you.

Questions about this document, or a request about your data, go to Afterlume Labs at support@indexzero.site.