Privacy Policy

Get Indexed is an Answer Engine Optimization platform at getindexed.ai, operated by Lunoa Labs Inc. ("we", "us", or "our"), a company based in Ontario, Canada. This policy covers our marketing site, the app, and the optional tracking snippet you can install on your own website.

• Account data. When you sign up we use Clerk to handle authentication. Through Clerk we receive your name, email address, and organization. We don't store passwords; Clerk does.
• Billing data. Payments run through Stripe. Stripe handles your card details; we never see or store full card numbers. For a subscription we store your Stripe customer and subscription identifiers and your plan status. For a one-off audit bought through a payment link we store the purchaser's email address, the amount and currency paid, the Stripe payment reference, and the website you enter at checkout, so we can deliver the audit.
• Product data you give us. The domains you add, the brand and competitor names and queries you track, your business locations (name, address, and phone), and the content you submit to the optimizer.
• Product data we generate. Pages we crawl from your site, audit scores, and the AI-engine responses we collect when checking your citations (including a snapshot of each response).
• Attribution data (only if you install the snippet). Our snippet records when one of your site's visitors arrived from an AI engine. It keeps the engine, the referring page, the landing page, and a random session ID in a first-party cookie that lasts 30 days, and sends them to us with the UTM source and any conversion events you choose to report (value, currency, and order ID). See "The tracking snippet" below.
• Email opt-outs. When you unsubscribe from one of our emails, or from all of them, we record your email address and which emails you opted out of, so we can keep honoring it. The unsubscribe page for every link we send today offers the all-emails option; an older workspace-wide report link instead stops that workspace's reports.
• Operational data. Standard server logs and, on the public attribution and audit endpoints, the sender's IP address, used only to rate-limit abuse, not to profile anyone.

To run the service: crawl and score your site, check your citations, generate optimizations, attribute revenue, send the reports and alerts you ask for, bill you, and keep the platform secure. We do not sell your data, and we do not use it for advertising.

We use a small set of sub-processors to run the service. They receive only what they need:

• Clerk: authentication and user accounts.
• Stripe: payments and subscriptions.
• Resend: sending report and notification emails.
• Google Cloud: hosting and database.
• AI engine providers (OpenAI, Anthropic, Google, Perplexity). To check your citations we send your tracked queries to these providers. To suggest queries, optimize content, and build your implementation kit we send your brand and competitor names, your website address, and the text of pages you submit or we crawl. We don't send them your account or billing data.
• DataForSEO: search-demand data for content plans. We send it the queries and keywords you track, to look up search volume and related questions.

We also use public third-party services that are not our processors. To check your directory listings for your implementation kit, we send your business name and address to Google Maps Platform, Yelp, and Yellow Pages. The optimizer preview loads the site's icon from Google, which receives that domain. Our pages load web fonts from Google Fonts and Fontshare, which receive your browser's IP address.

We may also disclose data if required by law or to protect the service and its users.

If you install our snippet on your website, it collects information about your visitors so we can attribute their conversions to AI citations. For that data, you are the controller and we act as your processor. You are responsible for disclosing the snippet in your own privacy notice and for obtaining any consent the law requires where your visitors are. The snippet sets a first-party cookie, does not fingerprint devices, and is not used for cross-site advertising. It is entirely optional and the rest of Get Indexed works without it.

We use cookies that are necessary to run the service: a session cookie for staying signed in (via Clerk), and (only where you install the snippet) the 30-day first-party attribution cookie described above. We don't use third-party advertising cookies.

We keep your data for as long as your account is active. Citation results are retained as a time series so your trends stay meaningful. When we delete your workspace at your request (see "Your choices"), we keep its data for 90 days, during which we can restore it, and then permanently delete it. Some records outlast that: your sign-in account at Clerk until you ask us to remove it, billing history we must keep to meet legal obligations, security audit logs, and backups until they expire on their normal schedule. Records of one-off audit purchases are kept as long as needed to deliver the audit and for our accounting records.

Email opt-outs are kept indefinitely: the record of your email address and which emails you opted out of is what stops us sending them. Deleting your account or data doesn't remove it, because removing it would start those emails again.

You can access, correct, export, or delete your data (except the opt-out record described under Retention): email privacy@getindexed.ai and we'll act on it. As a Canadian company we handle personal information under PIPEDA, and depending on where you live (for example under GDPR or CCPA) you may have additional rights, including the right to object to processing or to lodge a complaint with a regulator. We don't sell personal information.

We protect data in transit and at rest and limit access to what's needed to operate the service. Our providers may process data outside Canada, including in the United States; by using the service you understand your data may be handled there.

Get Indexed is a business tool and isn't directed at anyone under 18. We don't knowingly collect data from children.

If we make a material change we'll update the date above and, for significant changes, notify you. Questions or requests: privacy@getindexed.ai. See also our Terms of Service.

By mail: Lunoa Labs Inc., 234 Ellis Ave, Toronto, ON M6S 2X2, Canada.