Scope and roles
This policy explains how Index Instrument handles personal information on useagentindex.com, the dashboard, support channels, and related services. Paddle separately processes checkout, payment, tax, fraud, and receipt data as merchant of record under its own privacy notice.
Information we collect
- +Account data from Google or GitHub OAuth, such as provider identifier, verified email, display name, and workspace membership.
- +Scan data, including submitted URLs, public HTTP responses, technical evidence, scores, configurations, timestamps, and reports.
- +Service data, including IP-derived security hashes, user agent, authentication sessions, request logs, error diagnostics, and consent records.
- +First-party traffic data for the public website, including IP address, country derived from hosting headers, referrer or campaign source, pages viewed, and links or calls to action clicked. This data is visible only to platform administrators and is used for security, attribution, and product improvement.
- +Commercial and support data, including plan, Paddle transaction reference, payment status, invoices or refund state, and communications. We do not receive or store full card numbers.
- +Browser storage needed for authentication, theme, and temporary scan continuation. We do not use this storage to sell behavioral advertising profiles.
Why we use information
- +Provide, secure, authenticate, and support the service.
- +Run requested scans, preserve reports, process purchases, and prevent duplicate fulfillment.
- +Detect fraud, abuse, unsafe targets, unauthorized access, and payment disputes.
- +Maintain reliability, debug failures, measure product performance, and improve checks.
- +Meet tax, accounting, legal, sanctions, and regulatory obligations.
Legal bases
Depending on location, processing is based on performing a contract, legitimate interests in security and service improvement, legal obligations, and consent where required. You may withdraw consent for optional processing without affecting prior lawful processing.
Sharing and processors
We disclose information only as needed to service providers such as hosting, infrastructure, authentication providers, error monitoring, email or support systems, and Paddle for billing. We may disclose information to comply with law, protect rights or safety, investigate fraud, or complete a corporate transaction subject to appropriate safeguards.
We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising as those terms are defined by California law.
Retention
Temporary anonymous scans expire automatically, normally within 24 hours, unless claimed and purchased. Account, report, security, tax, consent, and transaction records are retained for the period needed to provide the service, resolve disputes, enforce agreements, and meet legal obligations. Data is deleted or de-identified when no longer reasonably needed.
Security
We use access controls, token hashing, isolated workers, transport encryption, private-network blocking, rate limits, and database controls appropriate to the service. No system is completely secure, and you should not submit secrets or non-public personal data as scan targets.
Your choices and rights
Depending on your location, you may request access, correction, deletion, portability, restriction, objection, or information about disclosures. California residents may request to know, correct, or delete covered personal information and may exercise rights without unlawful discrimination. Because we do not sell or share covered data for behavioral advertising, there is no sale or sharing to opt out of.
Send requests to [email protected]. We may verify identity and authority before acting. Certain records may be retained where legally required or necessary for security, billing, or disputes.
International use and children
The service may be operated and processed in countries other than yours. Where required, we use recognized transfer safeguards. The service is for adults and business users and is not directed to children under 13.
Changes and contact
We may update this policy to reflect service or legal changes. Material changes will be communicated where required. Contact [email protected] for privacy matters and [email protected] for general service matters.