Privacy Policy

IndexGlow (indexglow.com) is operated by Max Bryselbout, acting as an individual, at 82 avenue de Bretagne, 59000 Lille, France. He is responsible for the personal data processed to operate the service.

For privacy questions or requests concerning your data, write to .

We process the information needed to operate your account, read the search data you authorise and answer requests from you or your connected assistants.

• Account information: name, email address and whether it is confirmed, optional profile picture, account identifiers and creation dates. If you use password sign-in, the password is stored as a hash, not as plain text.
• Authentication information: sessions, expiry dates, IP address and browser information, Google account identifiers, granted permissions and OAuth tokens. Google access and refresh tokens are encrypted in the database. Personal API keys are stored as hashes.
• Search Console data: properties and access levels; queries, page URLs, clicks, impressions, click-through rates, average positions, countries, devices and search appearances; sitemap information and URL inspection results.
• Bing Webmaster Tools data, when connected: site URLs and their verification status; traffic, top query and page records, clicks, impressions and available positions; sitemaps and feeds; crawl statistics and crawl issues; crawl information for the URLs you check; and the remaining URL submission quota. If you allow management, the sitemaps and URLs you submit or remove. Bing access and refresh tokens are encrypted in the database, with the permission level you granted. Temporary OAuth state secures the connection process.
• Assistant connections: registered client details, permissions, authorisations and tokens needed to authenticate their requests.
• Activity history: assistant name when available, tool name, arguments such as website URLs or search filters, time, duration, success status and error messages. These arguments can contain personal information. Full assistant conversations are not collected by IndexGlow. We also count the usage units spent each day, to apply the daily usage limit.
• Web app activity: the days you use the IndexGlow web application while signed in, with the time of your latest visit on each of those days. The pages you view, your clicks and your search data are not recorded this way.
• Saved URL inspections: inspected URL, property, search engine, date, index or crawl status and the condensed result. Operational logs also record request outcomes and errors for troubleshooting.
• Support and account management records: when we act on your account, at your request or to protect the service, we record the action, its date, the administrator who took it and a few counts, such as the number of sessions ended. These actions are restoring your daily usage budget, resending a confirmation email, sending a password reset link, ending your web sessions, disconnecting your assistants, and suspending, reactivating or deleting your account. A suspension also records its date and, optionally, the reason. These records never contain passwords, tokens or search data.
• If you allow audience analytics, OpenPanel receives views of public and application pages, plus related browser, device, referrer and approximate location information. Site identifiers and URL query values are removed from tracked page paths. It does not receive your connected Google or Bing tokens or search reports through this website tracking.

We use account and connected-source data to provide the service you request: signing you in, displaying reports, comparing search performance, inspecting URLs, submitting sitemaps or URLs when you ask and responding to authorised assistant calls. The legal basis is performance of the service contract or steps taken at your request before entering it.

We use authentication records and operational logs to protect accounts, limit abuse and diagnose failures. We keep support and account management records to answer your requests, handle abuse and be able to show which action was taken on an account, when and by whom. The legal basis is our legitimate interest in operating a secure and reliable service. We may also process data where a legal obligation requires it.

When an account is suspended under the Terms of Use, signing in and assistant requests are refused until it is reactivated. Its data and connections are kept in the meantime.

We record the days you use the web application, as we do for assistant activity, to measure how the service is used and improve it. The legal basis is our legitimate interest in understanding and improving the service. This measurement relies only on your sign-in session: it sets no additional cookie and does not depend on your audience analytics choice.

With your consent, we use OpenPanel audience analytics to understand visits and improve the website and application. You may decline or change your choice at any time in this policy.

Connecting Google, Bing or an assistant is optional. You decide which connections to authorise and can revoke them. Without a connection, live reports for that search engine are unavailable; a clearly labelled demonstration may be offered instead.

IndexGlow does not sell your Google or Bing data, use it for targeted advertising or train general-purpose AI models on it. Google API data is used for the visible features you request, subject to Google's restrictions on use and onward sharing, including its Limited Use requirements.

Google provides the identity and Search Console services you connect. IndexGlow requests read-only Search Console access by default. You can separately enable the permission needed to submit or delete sitemaps.

Microsoft provides Bing Webmaster Tools when you connect Bing. IndexGlow requests read-only access by default. You can separately allow management, which lets you and your authorised assistants submit or remove sitemaps and submit URLs to Bing for your verified sites. Your authorised assistants can query all verified sites available through this connection. Bing tokens are not sent to assistants. You can disconnect Bing in Settings → Connections; this removes its stored tokens from IndexGlow.

When you authorise an assistant, IndexGlow sends the results of its tool requests to that client. An authorised client can access all readable properties on your connected Google and Bing accounts, not only the property selected in an example question. Depending on the OAuth permissions granted, the client can also receive basic account identity information. Google and Bing tokens are not sent to assistants.

An assistant provider may process the returned data in its own infrastructure, including outside the European Economic Area. Its privacy policy, retention rules and account settings apply to its processing. Review them before connecting. Revoking a connection stops future access but does not erase results the provider has already received.

Brevo (Sendinblue SAS, France) sends the account emails: address confirmation, password reset and the notice sent when someone tries to sign up with an address that already has an account. It receives your name, your email address and the content of these emails, and keeps delivery logs under its own retention rules. These emails do not contain your search data.

When you accept audience analytics, your browser sends usage data to the OpenPanel instance at tools-openpanel.superposed.io. The tracking script is loaded from openpanel.dev. Declining prevents the script from loading.

The production hosting provider is OVH SAS, 2 rue Kellermann, 59100 Roubaix, France (telephone: +33 (0)9 72 10 10 07). Hosting supports the website and database. Authorised technical personnel may access data only where necessary to operate the service, address a support request, investigate a security issue or comply with the law.

A request may involve processing by Google, Microsoft or the assistant you choose outside the EEA. The safeguards applicable to those providers, including any contractual transfer mechanisms, are described in their privacy documentation. IndexGlow does not promise that all data remains in the EU once it is sent to an external provider.

Retention depends on the kind of data and the purpose for which it is kept.

• Account details, linked-account records, assistant authorisations and saved URL inspections are kept while your account exists, unless removed earlier through the available controls or a valid erasure request. Activity history is deleted automatically after 90 days, web app activity days after 90 days, and daily usage counts after 90 days.
• Search performance responses are fetched on demand and are not saved as a reporting warehouse. A bounded, server-memory cache reuses them for a limited time that follows how often each report changes: approximately 2 to 15 minutes for Google, and 5 minutes to 6 hours for Bing, whose query and page reports change weekly. Expiry stops reuse; entries are removed as the cache is replaced, when you disconnect the source or when the server restarts.
• Sessions and temporary authorisation records have expiry dates. Expiry prevents their use, and expired records are deleted automatically: sessions and temporary records within a few days, assistant tokens 30 days after they expire (the first and latest authorisation of each assistant are kept while your account exists), and assistant registrations never used within 7 days.
• Support and account management records are deleted automatically after 365 days, and with your account. A suspension record is removed when the account is reactivated or deleted.
• Deleting your account removes its account records, linked Google and Bing connections, sessions, assistant grants, API keys, tool-call history, web app activity, usage counts, saved inspections and support records from the application database. The same applies when we delete an account at your request or under the Terms of Use. In that case we keep a record of the deletion, with the account's email address, the date and the administrator who carried it out, for 365 days, to show that the deletion was performed and to answer questions about it. Deletion does not remove data held independently by Google, Microsoft or your assistant provider.
• Infrastructure logs and any recovery backups follow the hosting configuration and are retained only as needed for security, recovery or applicable legal obligations. Contact us for details of the retention applicable to a particular request. Account deletion is not a promise of immediate erasure from every infrastructure log or backup.

IndexGlow uses cookies needed to sign you in, maintain your session and secure authentication redirects. It also remembers your sidebar preference in a cookie and your theme preference in local browser storage.

The application does not include advertising cookies. OpenPanel audience analytics runs only after you accept it; your choice is saved in local browser storage. You can change your choice below. Clearing browser data removes local preferences and may sign you out. Google, Microsoft and assistant websites apply their own cookie policies when you visit them.

You can manage Google and Bing access in Settings → Connections, revoke assistant access or API keys in Assistant → Activity, and edit your profile or delete your account in Settings → Account. Google access can also be revoked from your Google Account.

Subject to applicable conditions, you can request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

Send requests to , preferably from the email linked to your account. We may ask for information reasonably needed to verify your identity. We normally respond within one month; if a lawful extension is needed, we will explain it.

You may lodge a complaint with your local data protection authority. In France, this is the CNIL.

We update this page when the service or its data processing changes. The date above identifies this version. Material changes to data use will be communicated before they take effect, and additional authorisation will be requested where required.