Privacy Policy

1. Who is responsible

Rankizo is operated by Ha Duy Huy, a sole trader registered in the Czech Republic under business ID 07876823, at Bartáková 36, 140 00 Praha. For the purposes of the EU General Data Protection Regulation, that person is the controller of the personal data described here. Full contact details are at the foot of this page.

Where you use Rankizo to process personal data belonging to other people — for example, if a report you export contains someone's contact details — you are the controller of that data and we act as your processor. Ask us for a data processing agreement and we will provide one.

2. What we collect and why

We collect four kinds of data, and nothing beyond them.

Account data

Your email address, your name if you provide one, and a password that is stored only as a cryptographic hash — we cannot read it. If you sign in with Google instead, we receive your name, email address and Google account identifier from Google, and no password exists. We use this to create your account, sign you in, and contact you about the service.

Billing data

Your plan, your credit balance, your usage counters and the identifiers our billing provider assigns you. We never receive your card details. Those go directly from your browser to Stripe, which processes the payment; we see only whether it succeeded and what you are subscribed to.

The data you put into the product

The domains, URLs, keywords and competitors you enter, the projects you create, the audits you run, and the results we fetch and cache for you. If you connect Google Search Console, we read the performance data for the property you authorise, using a token you can revoke at any time from your Google account. If you use the Sam assistant or the onboarding assistant, we store your conversations so you can come back to them.

Technical data

Our infrastructure provider records your IP address, browser user agent and the requests you make, as any web server does. We use this to keep the service running, to apply rate limits, and to investigate abuse or faults.

We do not run advertising, behavioural profiling, or any cross-site tracking. We do not build marketing profiles, we do not enrich your record with data bought from third parties, and we never sell personal data.

3. Our legal grounds

Under the GDPR, we rely on the following:

What	Ground
Creating your account, running the service, taking payment	Performance of our contract with you (Art. 6(1)(b))
Keeping the service secure, rate limiting, preventing abuse	Our legitimate interests (Art. 6(1)(f))
Connecting your Google Search Console property	Your consent, given in Google's own permission screen (Art. 6(1)(a))
Keeping accounting records	Our legal obligations under Czech law (Art. 6(1)(c))

Where we rely on consent you may withdraw it at any time, and where we rely on legitimate interests you may object — see section 8.

4. Who else processes your data

These are every third party that receives data as part of running Rankizo. Each acts on our instructions under a contract that obliges them to protect it. We keep this list accurate; if we add a processor we will update this page.

Processor	What it does	What it receives	Where
Cloudflare, Inc.	Hosting, application database (D1), file storage (R2), key-value cache, and network security	Everything you store in Rankizo, plus request metadata such as IP address	United States and its global network
DataForSEO LLC	The search-data provider behind keyword, SERP, backlink and competitor lookups	The domains, URLs and keywords you look up. No account or contact details	United States
Autumn (Recall Technologies, Inc.) and Stripe, Inc.	Subscriptions, checkout and payment processing	Email address, organisation identifier, plan and usage counters. Card details go to Stripe directly and are never seen by us	United States
Google Ireland Ltd. / Google LLC	Optional sign-in with Google, and the Search Console API when you connect a property	For sign-in: your name, email address and Google account identifier. For Search Console: a read-only token and the queries we read on your behalf	European Union and United States
OpenRouter, Inc.	Routes prompts to the language model behind Sam and the onboarding assistant	The messages you send those assistants, and the project data they quote back to you	United States
Loops (Loops Marketing, Inc.)	Transactional email — address verification and password resets only	Email address and the contents of those messages	United States

Not currently used. Rankizo's codebase can be configured to use product analytics (PostHog), a bot-protection widget (Cloudflare Turnstile) and an advertising pixel. None of them are switched on in the live service, so none of them receive anything today. If we turn any of them on we will update this page first, and we will ask for your consent before setting any non-essential cookie.

We may also disclose data where the law requires it — to a court, a regulator or a tax authority — and to a buyer or successor if the business is ever sold, in which case this policy continues to apply until we tell you otherwise.

5. Sending prompts to a language model

This deserves its own section because it is the disclosure most services bury. Rankizo includes two AI assistants: Sam, the in-app agent, and the onboarding assistant.

When you send either of them a message, that message — together with the project context it needs to answer, which can include your domains, keywords, ranking data and Search Console figures — is sent to OpenRouter, which forwards it to the language model provider that serves the request. Your conversations are stored on our infrastructure so you can return to them.

Two practical consequences worth stating plainly. First, do not put anything into a chat that you would not want leaving our infrastructure — passwords, payment details, or other people's personal data have no reason to be there. Second, model output can be wrong; treat it as a suggestion and not as advice you can rely on without checking.

6. Sending data outside the EU

Several of the processors above are in the United States, so your data is transferred outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses, and, where the provider is certified, on the EU–US Data Privacy Framework. You can ask us for a copy of the clauses covering any specific transfer.

7. How long we keep it

We keep your account and its contents for as long as your account exists. If you ask us to delete your account we remove it and its data within 30 days, except where we are required to keep something longer — invoices and accounting records must be retained under Czech law, generally for ten years. Cached search results expire on their own within hours to days.

We should be straight with you about one thing: there is no self-service delete button yet. Until there is, account deletion is handled by emailing us and we do it by hand. That is a gap we intend to close, and in the meantime the 30-day commitment above applies exactly as written.

8. Your rights in the EU and UK

If the GDPR or UK GDPR applies to you, you have the right to ask us for a copy of your data, to correct it, to delete it, to receive it in a portable format, to restrict what we do with it, and to object to processing based on our legitimate interests. Where we rely on consent, you can withdraw it without affecting what we did before.

Write to support@rankizo.com and we will respond within one month. We do not charge for this and we will not make you justify the request.

If you think we have handled your data badly, please tell us first — but you are entitled to complain directly to a supervisory authority. Ours is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz), and you may also complain to the authority where you live or work.

9. Your rights in the United States

If you are a resident of California, or of another state with comparable law, you may request access to the categories and specific pieces of personal information we hold, request correction or deletion, and request details of any disclosures. Use the same address above; we will not discriminate against you for asking.

We do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are defined by the California Consumer Privacy Act. There is nothing to opt out of, because we do not do it. We do not knowingly process sensitive personal information beyond what an account requires.

10. Cookies and similar technology

The application sets a session cookie when you sign in. That cookie is what keeps you signed in; the service cannot work without it, so it is strictly necessary and does not require consent. Your browser may also hold small amounts of local data to remember interface preferences.

We set no analytics, advertising or tracking cookies, on either this website or the application, which is why you have not been shown a cookie banner. If that ever changes we will ask before setting anything non-essential.

11. Security

Traffic is encrypted in transit. Passwords are stored only as hashes. Access to production systems is limited to those who need it. Search Console tokens are held encrypted and are only ever used to read the property you authorised.

No service can promise it will never be breached, and we are not going to pretend otherwise. If a breach affects your personal data and is likely to put you at risk, we will notify the supervisory authority within 72 hours as the GDPR requires, and we will tell you.

12. Children

Rankizo is a business tool and is not intended for anyone under 16. We do not knowingly collect their data; if you believe a child has created an account, tell us and we will remove it.

13. Changes to this policy

If we change this policy we will update the date at the top. For changes that materially affect your rights — a new processor receiving your content, or a new purpose — we will email account holders before the change takes effect.

14. How to reach us

Email support@rankizo.com for anything in this policy, including data subject requests. We have not appointed a Data Protection Officer; our size does not require one, and requests are handled by the controller directly. Postal and official-mailbox details are below.