Privacy Policy

Last updated: 2026-09-06

1. Who we are

Inxy.ai ("we", "us", "our") operates the website at https://inxy.ai and the related SaaS application that helps Shopify merchants and SaaS publishers analyze and improve their organic search performance (SEO, AEO, GEO, LLMO).

2. What we collect

2.1 Account information

Email, name, password hash (or Google OAuth profile basics if you sign in with Google), and your subscription status.

2.2 Connected platforms

With your explicit consent during onboarding, we read data from third-party services to power your dashboard:

• Shopify: store domain, products, collections, blogs, orders (for source-revenue attribution).
• Google Search Console (read-only, scope webmasters.readonly): impressions, clicks, position, indexation status of your own properties.
• Google Analytics 4 (read-only): traffic sources, conversions on your own properties.

We never write to your Shopify, Google Search Console, or Google Analytics accounts on your behalf. We never read data from properties you do not own or have not explicitly connected.

2.3 Google user data

Inxy.ai's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access: Google Search Console (webmasters.readonly) and Google Analytics 4 (analytics.readonly), read-only, and only for the properties you select when you connect them.
• Why: to show your own search performance (impressions, clicks, positions) and organic revenue by page in your dashboard, and to decide which of your pages our system optimises next.
• What we do not do: we do not sell this data, do not use it for advertising or to build profiles, do not use it to train AI models, and do not share it with third parties except the infrastructure providers that host Inxy.ai under contract. No human reads it except to debug a problem you report, for security, or as required by law.
• Storage and retention: OAuth tokens are stored encrypted. Search Console and Analytics data is retained while the property stays connected and is deleted within 30 days after you disconnect it or delete your account.
• Revoking access: disconnect at any time from Settings in the app, or remove Inxy.ai at myaccount.google.com/permissions. Revocation takes effect immediately; we stop reading and delete the stored data on the schedule above.

2.4 Usage data

Standard web logs (IP, user agent, pages visited) for security and abuse monitoring; AI usage metrics (tokens consumed, models invoked) for billing transparency.

3. How we use your data

• Provide the product features (dashboards, recommendations, AI content generation)
• Bill you according to your plan
• Send transactional and product emails (you can opt out of non-essential ones)
• Improve the product, including computing anonymized cross-shop benchmarks (see §5)

4. How we share your data

Your raw shop data is never sold. We share narrowly with subprocessors strictly necessary to operate the service: Stripe (payments), Railway (hosting), Postgres (DB), and the AI model providers we route generation through (we anonymize prompts where feasible). A current subprocessor list is available on request from [email protected].

5. Anonymized aggregate data ("cross-shop intelligence")

To improve recommendations for all customers, we may compute cohort-level benchmarks (e.g. "median CTR for jewelry mid-tier stores") from anonymized, bucket-aggregated data with small-cell suppression. We do not expose per-shop deltas. You can opt out at any time in Settings → Privacy; opting out means your data does not contribute to those aggregates, but you still see the cohort medians.

6. Your rights

• Access / portability: export all your data in JSON via Settings → Account.
• Deletion: cancel your subscription and email [email protected]; we delete your account + raw shop data within 30 days.
• Correction: update profile fields in Settings.
• Opt-out of cross-shop aggregation: Settings → Privacy.
• EU/UK residents (GDPR) / California residents (CCPA): you have the same rights granted to all users above; contact [email protected] to exercise them or for any data complaint.

7. Data retention

We retain your data while your subscription is active, plus a 30-day grace window after cancellation in case you reactivate. Anonymized aggregate counts may persist beyond that, but no per-shop data does.

8. Security

Encryption in transit (HTTPS) and at rest. Per-tenant data isolation in Postgres. OAuth tokens are encrypted. We use industry-standard practices but do not claim security is absolute.

9. Children

Inxy.ai is not intended for users under 16.

10. Changes

We will notify you via email of material changes to this policy at least 30 days before they take effect.

11. Contact

Questions or requests: [email protected]