Privacy policy

Last updated 25 September 2026

Who we are

IndexedMe is run by Burfield Digital Limited, trading as SEOBurf, a company registered in England and Wales with number 05980969. Our registered office is c/o King Watkins Ltd, The Island House, Midsomer Norton, Bath, BA3 2DZ. We’re the data controller for the information described here.

Questions about this policy or your data go to hello@seoburf.com.

The short version

• We ask Google for read-only access to your Search Console, and nothing else.
• We use it only to run the scans you ask for and show you the results.
• We don’t sell it, advertise with it, or use it to train AI models.
• Disconnecting deletes your access grant and your scans straight away.
• No analytics, no advertising cookies, no tracking.

What we get from Google

When you connect Search Console, Google asks you to give IndexedMe one permission: to view your Search Console data (the webmasters.readonly scope). It can’t change anything in Search Console, and it doesn’t include your name, email address or any other Google service.

With that permission we read:

• the list of Search Console properties your account can see, so you can pick one;
• the sitemaps you’ve submitted for the property you choose, and when Google last downloaded them;
• Google’s URL Inspection result for each page in those sitemaps: whether it’s indexed, the reason Google gives if not, when Google last crawled it, the canonical URL Google chose, and some of the pages Google found linking to it.

We don’t read your search performance data (clicks, impressions or search queries).

Google also gives us a token that lets IndexedMe keep reading with your permission until you disconnect. We store it so scans can run in the background and carry on the next day when Google’s daily allowance runs out.

What else we handle

• Your sitemaps and page addresses. We download the sitemap files from your site, which are public, to list the pages to check.
• Two cookies. One keeps you connected between visits; the other protects the sign-in with Google from being forged and expires after 10 minutes. Both are strictly necessary for the service to work, so we don’t ask for consent to them.
• Server logs. Our hosting provider records requests, including IP addresses, to run and secure the service.

We don’t use analytics, advertising or tracking cookies on IndexedMe.

How we use Google user data

IndexedMe’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice that means:

• We use your Search Console data only to provide the scans and reports you see in IndexedMe.
• We don’t transfer it to anyone else, except the service providers listed below who run IndexedMe for us, or where the law requires it.
• We never use it for advertising, and we never sell it.
• We don’t use it to develop, improve or train AI or machine learning models.
• No person reads it, unless you ask us to help with a problem, it’s needed to investigate abuse or a security issue, or the law requires it.

Who processes it for us

These providers run parts of IndexedMe under contract and only on our instructions:

• Google, which supplies the Search Console data through its API.
• Vercel, which hosts the website and the app.
• Supabase, which hosts the database that stores your access token and scans, in London.
• Inngest, which schedules scans in the background. It receives only random scan identifiers, never your Search Console data or your site’s address.

Vercel is based in the United States and is certified under the UK Extension to the EU-US Data Privacy Framework. Supabase protects any transfer outside the UK with the European Commission’s standard contractual clauses and the Information Commissioner’s UK addendum to them.

How long we keep it

• Your access token: until you disconnect. If you don’t use IndexedMe for 6 months, we delete it and ask Google to cancel it.
• Scans and results: 90 days after the scan finishes, or straight away when you disconnect.
• Server logs: our hosting provider keeps request logs available to us for up to a day.

To delete everything now, use Disconnect in the app. It cancels the permission with Google and deletes your token and scans. You can also remove IndexedMe’s access from your Google account at myaccount.google.com/permissions.

How we protect it

Everything travels over encrypted connections. Access tokens are encrypted before they reach our database, and only IndexedMe’s own servers hold the key to read them. The database account the app uses can reach IndexedMe’s own tables and nothing else.

Our legal basis

We use your data to provide the service you’ve asked for, which is our basis under UK data protection law for the Search Console data and cookies. We keep server logs because we have a legitimate interest in keeping the service secure.

Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct or delete it, object to or restrict how we use it, or ask for it in a portable format. Email hello@seoburf.com. We don’t ask for your name or email address to use IndexedMe, so tell us which Search Console property you connected, and we’ll reply within a month.

If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Children

IndexedMe is for people who run websites. It isn’t meant for anyone under 18.

Changes to this policy

If we change how we use your data, we’ll update this page and the date at the top. If the change is significant, we’ll show a notice in the app before it takes effect.