Privacy Policy
European GDPR Standard

Effective date:

Version: 1.0

This Policy explains how Smart Indexes (“we”, “Smart Indexes”) processes personal data of users of the website, the GeoAnalytics product and the Smart Indexes API (collectively, the “Services”), and describes data subject rights under the EU General Data Protection Regulation (GDPR).

1. Who we are and how to contact us

Data Controller: Smart Indexes LLC.

Registered address: Russia, Saint Petersburg, Victory Square, 1, Cosmos Pulkovo Hotel, 1st floor.

Email for data requests: support@smartindexes.com.

EU Representative (Art. 27 GDPR): Smart Indexes.

2. Scope

This Policy applies to site visitors, registered GeoAnalytics users, API clients and any individuals whose personal data we receive in connection with the Services. If you are in the EEA/UK/Switzerland, GDPR/UK GDPR/FDPA applies to your processing.

3. Categories of data we process

3.1. Account & access data

  • Email required for user authentication.
  • First and last name required for identity linkage to email/company, handling legal requests and client-oriented communications.
  • Unique identifier/token (demo or commercial, with validity period and plan limits).

3.2. Service usage data

  • Usage events: UI actions, timestamps, API requests, error codes.
  • Session technical data: device/browser type, OS, language, referrer.
  • IP address and approximate city-level location for the site and web app (see “Cookies & analytics”).
  • We do not collect or store API clients’ IP addresses in our application systems; at the network layer IP may be processed briefly for routing and protection, but we do not deliberately log it.

3.3. Billing & accounting data

  • Payment fact, plan, amount, transaction date/time, payment status.
  • Bank card details are processed by the payment provider; we do not have access to them.

3.4. Communications & support

Support messages, feedback, survey results (if you participate).

3.5. Sources of data

  • Directly from you
  • Automatically when you use the Services
  • From the payment provider/bank (payment fact, status)

4. Purposes and lawful bases

If we mark some data as “required”, not providing it may prevent access to the Service.

Processing purposes and lawful bases under Article 6 GDPR
Purpose Examples Lawful basis
Provide access and perform the contract Account creation, token issuance, authentication Contract (Art. 6(1)(b) GDPR)
Billing, accounting, abuse prevention API request counting, invoicing, limit enforcement, fraud prevention Contract and legitimate interests (Art. 6(1)(b),(f)), legal obligation (Art. 6(1)(c))
Product improvement & analytics Conversion and UX metrics Consent (Art. 6(1)(a)) via the cookie banner for analytics cookies
Support & communications Responding to requests Contract and/or legitimate interests
Marketing emails Product updates (optional) Consent; you may withdraw at any time
Security & resilience Logging, incident investigation Legitimate interests

5. Cookies and analytics

We use cookies and similar technologies only to the extent necessary for the Service to function, and analytics technologies only after your consent via the cookie banner.

Analytics: we use Yandex.Metrica to analyse behaviour in the site and GeoAnalytics web UI (conversions, bounce, performance).

For EEA/UK/Swiss users, analytics loads only after consent.

We enable data-limiting features, mask/truncate IP where possible and apply minimal retention.

You can change your choice in the cookie banner at any time.

Important for the EEA: transfers of analytics data to third countries require appropriate safeguards (see Section 8). If such safeguards cannot be ensured, analytics will not load for affected regions.

6. Retention

  • Account data and tokens — for the life of your account and up to 24 months after closure.
  • Billing/accounting records — up to 6 years.
  • Security and event logs — up to 12 months.
  • Analytics data — up to 13 months.

Actual periods may vary due to legal requirements and protection of our rights.

7. Recipients and processors

We do not sell your personal data. We share it only with:

  • Processors (under a data processing agreement) helping us provide the Services:
    • Hosting/cloud infrastructure: Timeweb Cloud.
    • Email/SMTP service: support@smartindexes.com.
    • Payment provider/bank: —
    • Analytics: Yandex.Metrica.
  • Competent authorities — when required by law.

We sign a DPA with each processor and require appropriate security measures.

8. International data transfers

Where data is transferred outside the EEA/Switzerland/UK, we apply appropriate safeguards (Art. 46 GDPR), such as Standard Contractual Clauses (SCCs), and, where necessary, additional technical and organizational measures.

Regarding Yandex.Metrica: if transfers of personal data to a non-adequate jurisdiction cannot be reliably safeguarded, we will not load analytics for affected users or will proxy/anonymize so that no personal data is transferred to third countries.

9. Your rights under GDPR

  • access and obtain a copy of your data;
  • rectify inaccurate data;
  • erasure (“right to be forgotten”);
  • restriction of processing;
  • data portability (in a machine-readable format);
  • object to processing based on legitimate interests;
  • withdraw consent at any time (without affecting prior lawful processing);
  • not to be subject to decisions based solely on automated processing producing legal effects (we do not take such decisions).

To exercise your rights, contact us at support@smartindexes.com. We will respond within 30 days (extendable up to 60 days in complex cases). We may ask you to verify your identity.

You also have the right to lodge a complaint with your local supervisory authority in the EEA/UK/Switzerland.

10. Security

We implement technical and organizational measures to protect data: encryption in transit (TLS), need-to-know access controls, activity logging, backups and monitoring. Token access is restricted; keep your tokens confidential.

11. Children

The Services are not intended for individuals under 16. We do not knowingly collect children’s data. If you believe a child has provided data to us, please contact us and we will delete it.

12. Smart Indexes API specifics

  • Access is provided via a unique token.
  • Rate limits and billing are tied to the user’s token.
  • For analytics, abuse detection and performance monitoring, we process request metadata tied to the token (e.g., time, endpoint, volume, error codes).
  • We do not collect or store API clients’ IP addresses in our application systems; at the network layer IP may be processed briefly for routing and protection, but we do not deliberately log it.
  • We do not use this data for profiling that affects your rights.

13. Changes to this Policy

  • We may update this Policy. Material changes will be announced in the product interface and/or by email at least 7 days before they take effect.
  • The current version is always available on the site.

14. Contacts

For questions about data processing and exercising your rights, email: support@smartindexes.com.

Appendix A. Cookie overview (example)

Fill in after CMP (consent banner) setup.

Cookie categories and retention
Category Example cookie Purpose Retention Provider
Strictly necessary session_id Login session support Session Smart Indexes
Analytics (consent) _ym_uid, _ym_d Visit analytics up to 13 months Yandex.Metrica

Appendix B. Article 13 GDPR — summary

  • Controller: Smart Indexes.
  • Contacts: support@smartindexes.com.
  • Purposes/bases: see Section 4.
  • Recipients: see Section 7.
  • Transfers abroad: see Section 8.
  • Retention: see Section 6.
  • Data subject rights: see Section 9.
  • Data necessity: email and token are required for access; other fields as indicated in forms.
  • Automated decisions/profiling: none.