Privacy policy
Last updated: 26 October 2026
Heritage Services ("we") runs Agent Index. This page explains, in plain English, what personal data we collect and why. We follow India's Digital Personal Data Protection Act, 2023 and its Rules. We do not sell personal data.
Form submissions
When you use the Submit / Claim form, we store the details you enter (product and vendor name, website and source URLs, your email, and your answers) with a timestamp. To block spam we also keep a one-way hash of your IP address and your browser's user agent. We use this only to review the listing and, if needed, to contact you about it. Submissions are stored on Cloudflare's infrastructure. Emails you send us are kept in our mailbox to answer you.
The same store holds other requests you send from the site: auditor matching, demo requests, listing alerts, and “send my request to up to 3 matches”. Those forms collect the fields you fill in (for a match request: selected tools and/or audit firms or a “match me” choice, frameworks, a short description, company size, country or region, timeline, email and company name). We do not email vendors or audit firms from these forms, and we do not forward a request automatically.
Match requests require an explicit consent checkbox: “I agree that Agent Index may share these details with the firms I selected (or matched).” We store the consent text version and the time you agreed. We may later share the request with those firms (or with firms we pick if you chose Match me) only after we have been in touch with you. Without that checkbox, the request is not accepted. You can withdraw consent by emailing us.
Analytics
We use Cloudflare Web Analytics, which is cookieless. It counts page views and performance without cookies and without tracking you across sites.
If you use the public catalog search (/api/search) or the search tools on the Model Context Protocol endpoint (/api/mcp), we may store a short, normalized copy of the search words (lowercased, trimmed, at most 80 characters) plus how many results came back, the day, and a country code. We do this to see which topics people look for on the site. We do not store IP addresses, email addresses, or other identifiers with those terms. Queries that look like an email, phone number, token, or other secret are discarded. Internal test traffic is not logged. These terms are kept for about 90 days.
Newsletter
If you subscribe — including through the sitewide download, print or screenshot gate, the GRC Survival Kit, the footer form, or the shortlist form — we store your email and a first-party preference cookie (ai_subscribed, one year, SameSite=Lax) so we can send the Agent Index Brief and remember that you unlocked downloads and print. Your email is held by our newsletter provider, beehiiv, when that delivery is configured, and in our own store on Cloudflare to record the signup source. Subscribing is opt-in, and every issue has an unsubscribe link.
Payments
Agent Index is 100% free to use through Q1 2027. If optional labelled sponsorships open in Q2 2027 and you buy one, payment is handled by a third-party payment processor. They collect your payment details under their own privacy policy; we don't see or store full card or bank details. We keep the billing records needed for invoices and tax.
Hosting and logs
The site is hosted on Cloudflare Pages. Cloudflare processes request data such as IP addresses to deliver and protect the site.
How long we keep data
Listing submissions are kept while we review them and while the listing exists. Match, demo, alert and auditor-matching requests are kept while we review them and while we may need to contact you about them. Billing records are kept as long as tax law requires. You can ask us to delete other data at any time.
Your rights
Email [email protected] to access, correct or delete your data, or to withdraw consent. We'll reply within a reasonable time.
Contact
[email protected] · GSTIN 27ACQPA3590B1ZS. This policy is governed by the laws of India.