Privacy and Cookie Policy
Effective from 2026-09-30
Document in preparation: the controller's details will be completed before the service is opened to further users.
1. Who is responsible for your data
The controller of personal data is [NAZWA FIRMY], [ADRES SIEDZIBY], Poland, tax ID (NIP) [NIP]. For any personal data matter, write to [email protected].
2. What data we process and why
| Situation | Data | Purpose and legal basis | How long |
|---|---|---|---|
| Signing up for the beta list | email address, sign-up date, language version of the site | contact about the beta – your consent (Article 6(1)(a) GDPR) | until the beta ends or consent is withdrawn |
| Dashboard account | email address, password (as a hash), display name, time zone, dashboard and notification settings, date of acceptance of the Terms | providing the service – performance of a contract (Article 6(1)(b) GDPR) | for the duration of the agreement and up to 30 days after the account is deleted |
| Service messages | email address, content of notifications about events in your projects | invitation, password setup, notifications – performance of a contract (Article 6(1)(b) GDPR) | as account data |
| Login security | IP address, time and result of a login attempt, browser identifier | protecting accounts against unauthorised access – our legitimate interest (Article 6(1)(f) GDPR) | up to 12 months |
| Use of the dashboard | chosen dashboard layout and number of pages opened per day; who approved a baseline or requested a check, and when | developing the tool and accountability of actions in a project – our legitimate interest (Article 6(1)(f) GDPR) | as account data |
| Visit statistics | cookie identifiers, truncated IP address, information about the device and pages visited | statistics (Google Analytics) – only with your consent (Article 6(1)(a) GDPR) | up to 14 months |
| Correspondence | email address and message content | answering your enquiry – our legitimate interest (Article 6(1)(f) GDPR) | for the time needed to handle the matter, and then for the limitation period for claims |
| Claims | account data and history of use of the service | establishment, exercise or defence of claims – our legitimate interest (Article 6(1)(f) GDPR) | until the limitation period expires |
Providing an email address is voluntary, but without it we cannot create an account or send an invitation. We do not make decisions based solely on automated processing, including profiling.
3. Data from monitored pages
IndexRise fetches publicly available pages indicated by the user and stores their technical elements: response code, title, description, H1 heading, canonical URL, robots directives and the contents of sitemap files. This data is not used to identify individuals. If such an element contains personal data (for example a surname in a page title), we process it solely as content of the monitored page, on behalf of the user who indicated it.
4. Who we entrust data to
We use providers that process data on our behalf under data processing agreements:
| Provider | Purpose | Where |
|---|---|---|
| Supabase | database | European Union (Ireland) |
| Cloudflare | intermediary network, abuse protection, domain handling | global network; company based in the USA |
| Resend | sending email | USA |
| visit statistics – only with your consent | European Union and USA |
The application servers are located in the European Union. Without your consent to statistics, the site and the dashboard do not connect to any external provider other than the Cloudflare network through which the service runs.
5. Transfers outside the European Economic Area
Cloudflare, Resend and Google may process data in the United States. Transfers take place on the basis of the European Commission's adequacy decision (the EU–US Data Privacy Framework) for entities participating in that programme, and otherwise on the basis of standard contractual clauses.
6. Your rights
- access to your data and a copy of it,
- rectification,
- erasure,
- restriction of processing,
- data portability,
- objection to processing based on our legitimate interest,
- withdrawal of consent at any time – without affecting the lawfulness of processing before withdrawal.
To exercise these rights, write to [email protected]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (ul. Stawki 2, 00-193 Warszawa) or with the supervisory authority in your country.
7. Cookies
Cookies are small pieces of information stored in your browser. We use two kinds:
| Name | Type | Purpose | How long |
|---|---|---|---|
sessionid | essential | keeps you signed in to the dashboard | 2 weeks |
csrftoken | essential | protects forms against forged requests | 1 year |
django_language | essential | remembers your chosen language | up to 1 year |
ir_zgoda | essential | remembers your decision about statistics | 12 months |
| Cloudflare cookie | essential | protecting the service against abuse | up to 1 year |
_ga, _ga_* | statistics | Google Analytics – recognises returning visits | up to 2 years |
Essential cookies are always active, because the service cannot work without them. We enable statistics cookies only once you agree – until then we do not connect to Google Analytics. The dashboard also stores your appearance preferences (theme, collapsed help card) in your browser's storage; these never reach our server.
In the choice window you can accept or decline statistics with one click, or choose the kinds of cookies yourself. Your decision is valid for 12 months – after that we will ask again. You can change it at any time: the “Cookie settings” link in the page footer reopens the choice. You can also delete or block cookies in your browser settings.
8. Changes to this policy
When we change how we process data, we will update this document and its version date. We will inform users of significant changes by email or in the dashboard.