This policy explains what personal data Rankdar ("we") processes, why, and the rights you have.
1. Data we collect
- Account data: your email address, your password (stored only as a secure hash by our authentication provider), workspace name, role and sign-in times.
- Google sign-in data: if you choose "Continue with Google", Google shares your name, email address and profile picture with us.
- Usage data: the reports you run (keywords, domains and countries), projects, tracked keywords, keyword lists, Site Health audits, credit usage, and technical logs (IP address, browser and errors) kept for security and troubleshooting.
- Billing data: handled by Lemon Squeezy as Merchant of Record. We receive your plan, subscription status, country and order references, but never your full card details.
- Cookies: only strictly necessary cookies, for sign-in and your language preference. We do not use advertising or analytics cookies.
2. Why we use it
- To provide the Service and your account (performance of a contract).
- To bill you and to prevent fraud and abuse of credits and limits (contract; legitimate interests).
- To keep the Service secure and fix problems (legitimate interests).
- To send service emails such as account confirmation, password reset, receipts and important changes (contract). We send marketing emails only with your consent, and you can unsubscribe at any time.
- To meet our legal obligations.
3. Google user data
We use the data we receive from Google (name, email address and profile picture) only to create your account and sign you in. We do not use it for advertising, we do not sell it, and we do not share it with anyone except the providers listed below that host and operate the Service. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. Who we share data with
We use the following providers to run the Service. They process data on our behalf:
- Supabase: database, authentication and sign-in emails.
- Railway: application hosting.
- Resend: delivery of service emails.
- DataForSEO: receives the keywords, domains and countries you research, in order to return data. It does not receive your email address.
- Lemon Squeezy: payments, invoices and taxes.
- Google: sign-in (if you use it), and the favicon service that shows site icons in reports.
- flagcdn: country flags in reports.
When you view reports, your browser loads site icons and flags directly from Google and flagcdn, so they receive the domain names shown and your IP address. We do not sell personal data.
5. International transfers
Some providers process data outside your country, including in the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.
6. How long we keep data
- Account data: while your account is open. We delete it within 30 days after you close your account, except what we must keep for legal, tax or dispute reasons.
- Report cache and technical logs: up to 90 days.
- Credit and billing records: as long as needed for accounting, tax and dispute purposes.
- Site Health results: until you delete them or close your account.
7. Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, restrict or object to its processing, and withdraw your consent. Write to support@rankdar.com and we will reply within 30 days. You can also complain to your data protection authority.
8. Security
Data is encrypted in transit. Access is restricted per workspace in the database, and secret keys are kept on the server only.
9. Children
The Service is not intended for anyone under 18.
10. Changes
We will notify you of material changes by email or in the app before they take effect.
11. Contact
Privacy questions and requests: support@rankdar.com