Privacy
Policy

Who We Are

IndxQ (“IndxQ”, “we”, “us”, “our”) is a technical SEO publication and consultancy operating at indxq.com. We produce in-depth guides on WordPress SEO, local SEO, affiliate site growth, technical audits, and related topics, and we offer free SEO audit services to site owners.

For the purposes of UK and EU data protection law, IndxQ is the data controller — meaning we determine how and why personal data is processed. Our full contact details are in Section 12.

This policy applies to all personal data collected through indxq.com, our email communications, and any audit or consultation services we provide. It does not apply to third-party websites we link to — please review their privacy policies separately.

What We Collect

We only collect data that serves a specific, documented purpose. Here is everything we collect and how it arrives:

We do not collect: payment card information (we use no paid services on-site), government identification numbers, sensitive personal data (health, ethnicity, political views, biometrics), or data from children under 16 knowingly.

How We Use It

We use the data we collect for the following purposes only:

• Delivering audit services. When you submit an audit request form, we use your name, email, website URL, and any details you provide to run your SEO, speed, or local audit and send you the results.
• Responding to enquiries. Contact form submissions and email replies are used solely to respond to your message.
• Newsletter delivery. If you subscribe to our newsletter, we use your email to send you SEO guides and update notifications. You can unsubscribe at any time via the link in every email.
• Site analytics. Aggregated, anonymised analytics data (via Google Analytics 4) helps us understand which content is useful and how to improve the site. We do not use this data to identify individuals.
• Security and fraud prevention. Server logs including IP addresses are retained for a short period to detect and block abusive traffic, spam submissions, and security threats.
• Legal compliance. In certain circumstances we may be required to process or retain data to comply with a legal obligation.

Legal Basis for
Processing

Under UK GDPR and EU GDPR, we must have a valid legal basis for each type of processing. Here is our basis for each:

Where we rely on legitimate interests, we have carried out a balancing test and concluded that our interests do not override your fundamental rights and freedoms. If you would like to see our legitimate interests assessment for any specific processing activity, please contact us.

Cookies &
Tracking

A cookie is a small text file placed on your device by a website. We use a minimal set of cookies — only those that serve a documented purpose. You can control cookies in your browser settings or via our cookie consent banner.

We do not use advertising cookies, Facebook Pixel, Google Ads remarketing tags, or any third-party tracking pixels. We do not use session recording tools (Hotjar, FullStory, etc.).

To opt out of Google Analytics across all websites, you can install the Google Analytics Opt-Out Browser Add-On. To manage all cookies, use your browser’s settings: Chrome, Firefox, Safari.

Third-Party
Services

We use a small number of third-party services to operate the site. Each is listed below with the data they receive and a link to their privacy policy.

We do not share your personal data with any other third parties. We do not sell data to data brokers, advertising networks, or marketing platforms. If we ever add a new third-party service that processes personal data, we will update this policy and, where required, seek your consent.

Data Retention

We keep personal data only as long as necessary for the purpose it was collected, or as required by law. Specific retention periods:

• Audit request form data — retained for 12 months from the date of submission, then deleted. This allows us to follow up if the audit was not completed and to improve our audit process.
• General contact form enquiries — retained for 6 months from the date of last correspondence, then deleted from our email and WordPress database.
• Newsletter subscriber data — retained until you unsubscribe, at which point your email is removed from our mailing list within 7 days. Suppression records (to prevent re-adding you) may be retained for longer.
• Google Analytics data — retained for 14 months within Google Analytics, after which it is automatically deleted by Google. Our GA4 property is configured with the minimum retention window.
• Server / access logs — retained for 30 days for security purposes, then automatically deleted by our hosting provider.
• Financial and tax records — retained for 7 years as required by UK tax law (HMRC), even if your account is deleted. This applies only if a paid transaction occurred.

When retention periods expire, data is securely deleted or anonymised so it can no longer be attributed to an individual. You may request early deletion at any time under your rights in Section 8.

Your Rights

Under UK GDPR and EU GDPR you have the following rights regarding your personal data. These are real rights — not buried in a process designed to discourage you from using them. To exercise any of them, email us at privacy@indxq.com. We will respond within 30 days.

International Data Transfers

IndxQ is based in the United Kingdom. Our website is hosted on servers located in the European Economic Area (EEA). Most of your data never leaves the UK/EEA.

However, some of the third-party services we use may transfer data outside the UK/EEA, most notably Google (Analytics) and Cloudflare. Both operate under the UK-US Data Bridge and EU-US Data Privacy Framework respectively, which provide an adequate level of protection under UK and EU law.

Where data is transferred to countries without an adequacy decision, we ensure appropriate safeguards are in place — typically Standard Contractual Clauses (SCCs) as approved by the UK ICO and the European Commission.

If you would like details of the safeguards in place for any specific transfer, please contact us at privacy@indxq.com.

Children’s Privacy

IndxQ is a professional SEO resource intended for adults. Our services are not directed at, and we do not knowingly collect personal data from, children under the age of 16.

If you are a parent or guardian and believe your child under 16 has submitted personal data to us, please contact us immediately at privacy@indxq.com. We will delete the data promptly upon verification.

Policy Changes

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will always update the “Last updated” date at the top of this page.

For significant changes — such as a new purpose for processing, a new third-party data recipient, or changes to how we handle consent — we will notify newsletter subscribers by email and display a prominent notice on the site for 30 days.

We recommend bookmarking this page and reviewing it periodically. Your continued use of the site after a policy change constitutes acceptance of the updated terms, subject to any changes that require fresh consent.

Previous versions of this policy are available on request by emailing privacy@indxq.com.

Contact Us

If you have any questions about this policy, want to exercise your rights, or have a concern about how we handle your data, please get in touch. We aim to respond to all privacy enquiries within 5 working days and all formal rights requests within 30 days.