This policy explains what personal data Rankdar ("we") processes, why, and the rights you have.
1. Data we collect
- Account data: your email address, your password (stored only as a secure hash by our authentication provider), workspace name, role and sign-in times.
- Google sign-in data: if you choose "Continue with Google", Google shares your name, email address and profile picture with us.
- Google Search Console data: if you connect Search Console, read-only access to the search performance (clicks, impressions, click-through rate, average position, queries, pages and countries) of the properties you choose, the email address of the Google account you connect, and a refresh token that lets us read that data.
- Google Analytics data: if you connect Google Analytics, read-only access to the visit statistics of the Google Analytics 4 properties you choose: sessions, engagement, key events, revenue, landing pages, traffic channels and countries. We do not receive information about individual visitors.
- Google Business Profile data: if you connect Business Profile, the list of business locations you manage (name, address and website) and, for the location you choose, its performance (profile views, calls, website clicks, direction requests, messages and bookings), the searches that showed it, and its reviews and rating.
- Usage data: the reports you run (keywords, domains and countries), projects, tracked keywords, keyword lists, Site Health audits, credit usage, and technical logs (IP address, browser and errors) kept for security and troubleshooting.
- Browser extension data: if you install the Rankdar extension for Chrome, it searches your tracked keywords on google.com from your browser and sends us the organic results it read (addresses and titles), whether the page had an AI Overview and the pages it linked, and the location line Google printed under the results (for example a city and "from your IP address"). When you click «Check this site», it also sends us the address of the tab you are on, to show that site's strength and spam; it reads that address only then. It reads no other page, tab, history or search of yours. We use this data only to show your positions and those results in your Rankdar account; we never sell it, never use it for advertising, and never pass it to others except the service providers listed below. The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
- Transfer payments (Egypt): if you pay by InstaPay or Vodafone Cash, the transaction number, the amount, the plan, and the screenshot you send, which may show your name, phone number or InstaPay address. We keep them with our payment records and use them only to confirm the payment and handle questions about it.
- Launch list: if you leave your email on the "coming soon" page, your email address, the page's language and, if you played the page's game, your score. We use it only to tell you once when Rankdar opens, and delete it on request.
- Billing data: handled by Lemon Squeezy as Merchant of Record. We receive your plan, subscription status, country and order references, but never your full card details.
- Cookies: only strictly necessary cookies, for sign-in and your language preference. We do not use advertising or analytics cookies.
2. Why we use it
- To provide the Service and your account (performance of a contract).
- To bill you and to prevent fraud and abuse of credits and limits (contract; legitimate interests).
- To keep the Service secure and fix problems (legitimate interests).
- To send service emails such as account confirmation, password reset, receipts and important changes (contract). We send marketing emails only with your consent, and you can unsubscribe at any time.
- To meet our legal obligations.
3. Google user data
We use the data we receive from Google (name, email address and profile picture) only to create your account and sign you in.
If you connect Google Search Console, we request read-only access (the "webmasters.readonly" permission). We use it only to show the search performance of the properties you choose inside your Rankdar workspace, and to let you start tracking the queries you pick. We never change anything in your Search Console. The refresh token is stored encrypted; Search Console figures are kept for a few hours to load your pages faster. You can disconnect at any time from the project page, which deletes the token and asks Google to revoke our access; you can also remove access in your Google account settings.
If you connect Google Analytics, we request read-only access (the "analytics.readonly" permission) and use it only to show, for the property you choose, how visitors from Google's organic results use your site. We never change anything in your Analytics account.
If you connect Google Business Profile, Google only offers one permission for its business APIs (the "business.manage" permission), which also allows changes. We use it to read the data listed above for the location you choose, and to publish what a member of your workspace asks for: a reply to a review, or a post (with its text, button and picture), when they press Publish or at the time they scheduled. Rankdar never replies or posts by itself and never edits your profile's details (name, address, hours, photos). To show the reviews and alert your team to new ones, we keep the latest 50 reviews of the location (the reviewer's display name, rating, text and your reply), each new review's alert for 30 days, and the posts you schedule or publish with their pictures; all of them are deleted when you disconnect Business Profile, choose another location or delete the site. A review alert also stays in your team's notifications like any other notification. A suggested reply sends the review's text and rating, the reviewer's first name and the business name to the AI model that writes it (see section 4).
For all three, the refresh token is the same encrypted token, figures are kept for a few hours only, and disconnecting the Google account removes our access to all of them. Site Health can also ask Search Console whether the pages of an audit are indexed (URL Inspection); the answers are stored with that audit.
We do not use Google user data for advertising, we do not sell it, we do not use it to train AI models, and we do not share it with anyone except the providers listed below that host and operate the Service. People at Rankdar do not read it unless you ask us to for support, or when it is needed for security or required by law. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. Who we share data with
We use the following providers to run the Service. They process data on our behalf:
- Supabase: database, authentication and sign-in emails.
- Railway: application hosting.
- Resend: delivery of service emails.
- DataForSEO: receives the keywords, domains and countries you research, in order to return data. It does not receive your email address. With the AI answers add-on, it also receives the project's questions, which it asks ChatGPT and Google AI Mode, and, to write those questions, the project's domain, place and tracked keywords, which it passes to an OpenAI model. For a content brief, the keyword and the searches Google relates to it are passed to an OpenAI model in the same way to suggest an outline. Drafts you write in the Content Writer stay in Rankdar.
- Lemon Squeezy: payments, invoices and taxes.
- Anthropic: the AI model that writes the help assistant's answers, reads transfer screenshots to compare the amount, the receiver and the date with the payment, and writes suggested replies to Business Profile reviews (when these features are on). It receives the question, the screenshot or the review, not your account details, and under its commercial terms does not use them to train its models. When it is not available, a suggested reply is written by an OpenAI model through DataForSEO instead.
- Google: sign-in, Search Console, Analytics and Business Profile (if you use them), the favicon service that shows site icons in reports, and public Google data about websites (Chrome UX Report and Knowledge Graph), which receives only the domain names you check.
- flagcdn: country flags in reports.
- OpenStreetMap: the map images of the local rank grid, loaded by your browser.
- Sentry: error reports when something fails in the app (the page, the error and technical details such as the browser). We do not send passwords or form contents.
When you view reports, your browser loads site icons and flags directly from Google and flagcdn, so they receive the domain names shown and your IP address. We do not sell personal data.
5. International transfers
Some providers process data outside your country, including in the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.
6. How long we keep data
- Account data: while your account is open. We delete it within 30 days after you close your account, except what we must keep for legal, tax or dispute reasons.
- Report cache and technical logs: up to 90 days.
- Credit and billing records: as long as needed for accounting, tax and dispute purposes.
- Site Health results: until you delete them or close your account.
7. Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, restrict or object to its processing, and withdraw your consent. Write to support@rankdar.com and we will reply within 30 days. You can also complain to your data protection authority.
8. Security
Data is encrypted in transit. Access is restricted per workspace in the database, and secret keys are kept on the server only.
9. Children
The Service is not intended for anyone under 18.
10. Changes
We will notify you of material changes by email or in the app before they take effect.
11. Contact
Privacy questions and requests: support@rankdar.com