Privacy Policy
Last Updated: September 2026
1. Who We Are
IndexGPT is operated by Legendary Index, Lda ("IndexGPT", "we", "us", "our"), a company registered in Portugal with its place of business in São Brás de Alportel, Portugal. This Privacy Policy explains how we collect, use, share and protect personal information through our website (indexgpt.app) and our Shopify application (the "App"). It applies to merchants who install the App, visitors to our website, and people who apply for a job with us.
2. Our Role Under Data Protection Law
For information about our merchants and website visitors, we act as a data controller. For store data we process on a merchant’s behalf through the App, we act as a data processor, and the merchant is the controller. Merchants who require a Data Processing Agreement can review and request one at indexgpt.app/dpa.
3. Contact
For any question about this Policy, your personal data, or to exercise your rights, contact us at hello@indexgpt.app. Postal address: Legendary Index, Lda, São Brás de Alportel, Portugal.
4. Information We Collect
4.1 Merchant and store information
When you install or use the App, we collect and process: the store owner’s name and email address; the store name, domain and general store settings; your Shopify plan, subscription status and billing events; product, page, blog and other online-store content; and your configuration choices inside the App, such as brand descriptions, tracked prompts and competitor URLs you enter. The App requests only the Shopify permissions it needs to work, which do not include access to your customers or orders.
4.2 Data we do not collect
We do not request, receive or store your customers’ personal data. The App does not hold customer names, email addresses, shipping addresses, payment details or order records. Where the App reports on store traffic or sales performance, it does so using aggregated figures, or through a Google Analytics account you choose to connect.
4.3 Technical and usage information
When you use the App or our website, we collect limited technical information such as IP address, browser type, device and operating system, language, and the pages or features you interact with. We use this to operate the service, diagnose faults, prevent abuse and improve the product.
4.4 Connected accounts
If you choose to connect Google Analytics, we store the access and refresh tokens needed to read the metrics you have authorised, together with the property you select. You can disconnect at any time, which revokes our access.
4.5 Support and communications
If you contact us by email, live chat or a scheduled call, we keep the content of that correspondence and the contact details you provide so we can answer you and improve our support.
4.6 Website contact form
If you write to us through the contact form on our website, we receive the name, email address and message you enter. We use them only to answer you, and we keep the correspondence alongside our other support email. The form is delivered to our inbox by Web3Forms, which processes the message on our behalf and is listed on our sub-processors page; the form itself sets no cookies and does not require your consent to work. You can always write to hello@indexgpt.app directly instead.
4.7 Job applicants
If you apply for a role with us, you do so by emailing your application to us directly. We receive whatever you choose to send, typically your name, contact details, CV and a covering message, and we use it only to assess your application and to contact you about it.
5. How We Use Information
We use the information described above to: provide, operate and maintain the App and website; generate the analyses, reports, content and recommendations you request; process subscriptions and billing through Shopify; provide customer support and respond to requests; send service and transactional messages, and, where permitted, occasional product updates you can unsubscribe from; detect, investigate and prevent fraud, abuse or technical faults; and comply with our legal obligations. We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.
6. Artificial Intelligence and Model Training
6.1 We do not train models on your data
We do not use merchant data, store content or any personal data to train, fine-tune or otherwise develop machine learning models, whether our own or anyone else’s.
6.2 How your data reaches AI providers
Several App features work by sending information to third-party AI providers on your instruction. For example, generating an article sends your topic, brand profile and related store content; a sentiment analysis or prompt check sends your brand name, tracked prompts and competitor references. We send only what the requested feature needs, and we do not send customer personal data because we do not hold any.
6.3 Provider commitments
We do not authorise any sub-processor to use merchant data to train models. We access AI providers through their business or API tiers, and we select providers on the basis that those terms exclude training on submitted content. Our current AI sub-processors are listed at indexgpt.app/sub-processors. We review these terms periodically, and if a provider changes its terms in a way that conflicts with this section we will change provider or update this Policy and the sub-processor list before continuing to use it.
6.4 Outputs
AI-generated content is produced at your request and made available to you for review before publication. AI systems can produce inaccurate or unsuitable output, so you remain responsible for reviewing any content before you publish it to your store.
7. Legal Bases for Processing (EEA and UK)
We rely on the following legal bases: performance of a contract, to provide the App and the features you request; legitimate interests, to secure, analyse and improve our products, and to communicate with merchants about the service; consent, where required for marketing communications or non-essential cookies, which you may withdraw at any time; and legal obligations, where the law requires us to retain or disclose information. For job applicants, we process data to take steps at your request prior to entering into a contract.
8. Payments
All subscription payments are processed by Shopify through Shopify Billing. We do not receive or store payment card details. We receive only the subscription status, plan and billing events associated with your store.
9. Sharing and Sub-Processors
We share information with service providers who process personal data on our behalf so that we can deliver the service. These include hosting and database providers, AI providers, product analytics, email delivery and support tools. Each is bound by a written contract that limits their use of the data to our instructions, requires confidentiality, and imposes appropriate security obligations. A current list of these sub-processors, the purpose of each and the region in which it operates, is published at indexgpt.app/sub-processors. We also use technical service providers that receive only store domains, public page URLs and similar business identifiers in order to measure and audit publicly available pages. These do not receive personal data and are therefore not listed as sub-processors; we can identify them to merchants on request. We may also disclose information where required by law or a valid legal request, to protect our rights or the safety of others, or in connection with a merger, acquisition or sale of assets, in which case we will notify affected merchants.
10. International Transfers
We are established in Portugal and our primary infrastructure is operated in the European Union. Some of our sub-processors, in particular AI providers, are established in the United States or process data there. Where personal data is transferred outside the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses, together with additional technical and organisational measures where appropriate. The region applicable to each sub-processor is identified at indexgpt.app/sub-processors. You may request a copy of the relevant transfer safeguards by writing to hello@indexgpt.app.
11. Data Retention
11.1 Merchant and store data
We retain merchant and store data for as long as the App is installed and your account is active. When you uninstall the App, or when you ask us to delete your data, we delete or anonymise it within 30 days.
11.2 Backups
Copies of deleted data may persist in encrypted backups for a limited period. Backups are rotated so that deleted data is removed from them within 90 days.
11.3 Marketing and lifecycle email
Where we hold a merchant’s email address in our email platform, it is removed within 30 days of uninstall, other than any suppression record we must keep to honour an unsubscribe request.
11.4 Billing and legal records
Invoices, subscription records and other information we are required to keep for tax, accounting or legal purposes are retained for the period required by Portuguese and EU law, currently up to 10 years.
11.5 Support correspondence
We keep support correspondence for up to 24 months after the matter is closed.
11.6 Job applicants
We keep application emails and materials for up to 12 months after a decision, so that we can consider you for similar roles, unless you ask us to delete them sooner.
12. Security
We apply technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls and authentication for administrative access, the principle of least privilege for staff access, separation of production and development environments, and monitoring and logging of system activity. Access tokens and credentials are stored in access-controlled systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that affects merchant data, we will notify affected merchants and, where required, the competent supervisory authority without undue delay.
13. Shopify Compliance
As a Shopify app, we comply with Shopify’s API Terms and Protected Customer Data requirements, and we support the mandatory privacy webhooks: customers/data_request, customers/redact and shop/redact. Because the App does not request access to customer or order data, we hold no customer personal data to return or erase in response to a customer request. On a shop redaction request, we delete the store’s data from our systems.
14. Your Rights
Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time. Residents of California and certain other US states may also have the right to know what personal information is collected and to opt out of its sale or sharing; as noted above, we do not sell or share personal information. To exercise any right, write to hello@indexgpt.app. We will respond within the period required by applicable law, and may need to verify your identity first. If you are in the EEA or the UK and are not satisfied with our response, you may lodge a complaint with your local supervisory authority; in Portugal this is the Comissão Nacional de Proteção de Dados (CNPD).
15. Cookies and Similar Technologies
We use cookies and similar technologies on our website and in the App. On the website, the only storage used by default is what is needed to make the site work and to remember the cookie choice you make. Analytics and marketing cookies are optional, and nothing is written to your device for those purposes until you tell us we may.
15.1 Cookies on our website
Necessary storage keeps the site working and records your cookie choice, so that we do not ask again on every page. With your consent we also use analytics cookies, set through Google Analytics, which tell us which pages are read, how visitors arrive and which links are followed; and marketing cookies, set through the Meta Pixel, which let us measure how our advertising performs and show it to people who are likely to find IndexGPT useful. Both are operated by third-party providers, and their use of the data they receive is also governed by their own privacy policies.
15.2 Your choices
When you first visit the site, a cookie banner lets you accept all cookies, reject all optional cookies, or choose analytics and marketing separately. Until you make a choice, optional cookies stay switched off. You can change or withdraw your choice at any time through the "Cookie Settings" link in the footer of any page. Withdrawing consent stops further collection, but does not affect processing that has already taken place. Most browsers also let you block or delete cookies directly, although blocking necessary storage may stop parts of the site from working.
15.3 Cookies in the App
Inside the App, we and Shopify use cookies and similar technologies that are necessary for authentication, session management and security, together with limited product analytics that help us understand how features are used. Where consent is required for non-essential cookies, we will ask for it and you may withdraw it at any time.
16. Children’s Privacy
Our website and App are intended for businesses and are not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
17. Links to Other Sites
Our website and App contain links to services we do not operate, including the Shopify App Store and third-party documentation. We are not responsible for the privacy practices or content of those services.
18. Changes to This Policy
We may update this Policy from time to time. The current version is always available at indexgpt.app/privacy, with the date it last changed shown at the top of the page. Where a change materially affects how we handle your personal data, we will notify merchants by email or through an in-app notice before it takes effect.
19. Governing Law
This Policy is governed by the laws of Portugal and of the European Union. The courts of Portugal have exclusive jurisdiction over any dispute arising from it, without prejudice to any mandatory right you may have to bring proceedings in the country where you live.