Data & Privacy Policy

1. Introduction

At Sitemap.xml, we take your privacy seriously. This policy explains how we collect, use, store, and protect your information when you use our sitemap generation, indexing API, and related developer tools. We are committed to transparency and compliance with applicable data protection regulations, including GDPR, CCPA, and other regional frameworks.

2. Data We Collect

We collect information only when necessary to deliver, secure, and improve our services. This includes:

2.1 Account & Billing Information

• Email address, display name, and timezone
• Payment details processed securely via Stripe (we do not store raw credit card numbers)
• Invoice and subscription history

2.2 Platform & Usage Data

• API keys and webhook endpoints
• Submitted URLs, crawl logs, and indexing status reports
• DNS records and SSL certificate data (used solely for validation)
• Dashboard interactions and feature usage metrics

2.3 Automated & Technical Data

• IP addresses, browser type, device identifiers, and operating system
• Server logs for security, debugging, and performance monitoring
• Clickstream and error reports within our web interface

3. How We Use Your Data

We process your data for the following legitimate business and service purposes:

4. Data Sharing & Third Parties

We do not share, sell, or rent your personal data. We only engage trusted third-party service providers necessary to operate our platform, under strict data processing agreements:

• Cloud Infrastructure: AWS & Cloudflare (hosting, CDN, DDoS protection)
• Payment Processing: Stripe (PCI-DSS compliant billing)
• Analytics & Monitoring: PostHog & Sentry (aggregated, anonymized usage data)
• Search Engine APIs: Google, Bing, Yandex (URL submissions only, no personal data forwarded)

We may disclose data if required by law, court order, or to protect against fraud, abuse, or imminent harm.

5. Security & Data Retention

We implement industry-standard technical and organizational measures to protect your data:

• AES-256 encryption for data at rest, TLS 1.3 for data in transit
• Role-based access controls, MFA for administrative accounts, and regular security audits
• Automated backups with 30-day retention in geographically isolated regions
• Incident response protocols with 72-hour breach notification compliance

Retention: Account and billing data is retained for the duration of your subscription plus 36 months for tax/legal compliance. API logs and crawl data are automatically purged after 12 months unless required for active service delivery. You may request earlier deletion at any time.

6. Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access & Portability: Request a downloadable copy of your data in JSON/CSV format
• Rectification: Update or correct inaccurate account information
• Deletion: Request full account and data removal (subject to legal retention requirements)
• Opt-Out: Disable non-essential analytics and marketing communications via Dashboard → Settings → Privacy
• Restriction & Objection: Limit processing or object to legitimate interest-based activities

Requests are processed within 30 days. Automated self-service tools are available in your account dashboard where applicable.

7. Cookies & Tracking Technologies

We use essential cookies to maintain session state, secure authentication, and prevent CSRF attacks. Optional analytics cookies help us understand platform performance and user flows. You can manage preferences via our cookie banner or browser settings. We do not use third-party advertising trackers or cross-site behavioral profiling.

8. Policy Updates

We may update this policy to reflect changes in our services, legal requirements, or industry standards. Material changes will be communicated via email and dashboard notification at least 14 days before taking effect. Continued use of our services after the effective date constitutes acceptance of the updated policy.

9. Contact Us

If you have questions about this policy, wish to exercise your data rights, or report a privacy concern, please reach out to our Data Protection Officer: