Privacy Policy - indexing

1. Scope

This Policy covers personal data processed through the indexing.com.tr website, the Index Ops panel, APIs, webhooks, support channels, and related services (the “Service”).

By using the Service, you acknowledge that you have read this Policy. If you do not agree, do not use the Service.

2. Data controller

The data controller for your personal data is the business operating the Service under the Indexing brand.

- Web: https://www.indexing.com.tr - Email: [email protected] - Contact: /iletisim

Trade name, registry, tax, and notice address appear in your contract / invoice records.

3. Data we collect

Depending on how you use the Service, we may process:

- Account / identity / contact: name, email, phone, organisation details - Billing: invoice title, tax details, payment status (card data may be held by the payment provider) - Service data: projects / domains, URL lists, quota usage, API / webhook logs, support messages - Technical / security: IP, session, device-browser, security logs - Content you upload or connect: Google Search Console (GSC) connection, access logs, sitemaps, or similar technical files — which may contain third-party personal data - Google OAuth / API credentials: access and refresh tokens and related account / property identifiers when you connect GSC (see Google section below)

We do not seek to collect special-category personal data. Please do not submit such data intentionally.

4. How we use data

- Forming and performing the contract; account access; Index Ops operations - Authentication (email activation; SMS / WhatsApp phone verification) - Billing, collection, payment reminders - Security, abuse prevention, quota / limits - Support and service improvement - Legal obligations - Debugging and aggregated statistics where legitimate interests apply - Product information / marketing where permitted by law (KVKK) - Coverage monitoring, alerts, and operational reporting using connected Search Console data (read-only; not for writing changes to your property)

We do not sell your personal data for marketing.

5. Google Search Console, OAuth, and Google API user data

At your request, Indexing may connect to the Google Search Console API via OAuth 2.0 using your Google account.

Scope requested: `https://www.googleapis.com/auth/webmasters.readonly` — read-only. We do not request write, delete, or property-administration permissions.

Examples of data that may be accessed: Search Console property list; index / coverage summaries and related read-only report signals. Google may change API fields over time; the purpose remains Coverage / Index Ops monitoring.

Purpose: coverage trends, sudden coverage-drop alerts, sitemap / monitoring helpers, and operational visibility in the panel. We do not use Google user data for advertising targeting, sale to data brokers, or unrelated product marketing.

Storage: OAuth access and refresh tokens are stored securely and linked to the relevant organisation (org). Tokens are used only to provide GSC-related features.

Disconnect / deletion: If you remove the Search Console connection in Settings (disconnect), related OAuth tokens are deleted or invalidated. Limited operational logs may be retained only as required by law.

Google API Services User Data Policy — Limited Use: We process Google user data obtained via OAuth / APIs in accordance with Google’s API Services User Data Policy, including Limited Use requirements. We do not use that data to train generalised AI / ML models in a manner prohibited by Limited Use; we do not sell it; we do not transfer it for independent advertising products. We process it only to provide the features you request, to secure the Service, to prevent abuse, and to meet legal obligations.

Note: Google Indexing API service-account credentials are a separate channel (URL notification / submit). GSC OAuth is for coverage — do not confuse the two.

6. Mandatory messages and marketing

Mandatory: activation emails; phone verification (SMS / WhatsApp); invoice and payment reminders; security and critical service notices.

Marketing: Unless you opt out where applicable, we may send product information emails. Where consent is required, we obtain it; you may change preferences at any time. Mandatory service messages are unaffected.

7. Cookies and similar technologies

We may use necessary cookies (session, security, preferences). Analytics, preference, and marketing cookies load only if you accept the relevant category.

Details: Cookie Policy. Manage preferences via Cookie settings in the footer. Browser controls may affect some features.

8. Sharing and processors

Data may be shared only as needed with: hosting / cloud, email and SMS / WhatsApp providers, payments, security / monitoring, support tools, legal / accounting advisers (as needed), and competent authorities.

When you connect Google via OAuth, Google processes authentication and API access under its own policies. We process Google-sourced data under the Limited Use rules above.

International transfers, if any, follow KVKK Art. 9 and applicable Board rules. See KVKK.

9. Retention and security

We retain data for the processing purpose and applicable legal retention periods (e.g. commercial / tax law), then delete, destroy, or anonymise it.

We apply reasonable technical and organisational security measures. Absolute security of internet transmission cannot be guaranteed; you must protect your account credentials.

10. Your responsibilities

You are responsible for:

- Lawfulness of URLs, logs, GSC, and similar data you upload or connect - Having sufficient Search Console property permission when connecting Google - Notices / consents / instructions for any third-party personal data in those materials (you are typically the controller; Indexing may act as processor — see KVKK) - Authority and customer instructions when acting for third-party sites - Search-engine outcomes and on-site SEO — Indexing does not guarantee indexing (Disclaimer)

Indexing is not the administrator or publisher of third-party sites.

11. Children’s privacy

The Service is not directed to individuals under 18. We do not knowingly collect such data. Contact us if you believe it was submitted in error.

12. Your rights

KVKK Art. 11 rights and how to exercise them are described in the KVKK notice (Turkish). Contact: [email protected] (subject: “KVKK”) or /iletisim.

You may disconnect GSC or request account closure via Settings or the same channels.

13. Changes

We may update this Policy. The current version is published on this page; we aim to provide reasonable notice of material changes.