This is a draft prepared from how the product handles data. It has not been reviewed by a lawyer and does not take effect until the owner publishes it. The same privacy defaults apply to every customer, wherever they live.
Who is responsible
For account, billing and usage data, the provider named in the terms is the controller. For the reports and analytics data you connect, you are the controller and we are your processor; the data processing agreement applies.
What we collect
- Account data: name, email address and Google account identifier from sign-in.
- Connected data: Search Console, GA4, AdSense and similar reports you authorise, and the results of crawls you run on your own sites.
- Workspace content: properties, goals, annotations, tasks and reports you create.
- Billing data: held by Lemon Squeezy as merchant of record. We receive subscription status and invoice references, not card numbers.
- Technical data: request identifiers and error traces, with request bodies, cookies and query strings excluded from error monitoring.
Google user data
RankPilot's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
We ask for the narrowest permissions first and more only when you use a feature that needs them. Google data is used to provide the features you see. It is not used for advertising and is not sold.
No model training
We do not use your data to train language models. When you use a language-model feature, personal data is scrubbed from the request before it is sent, and with your own key the request goes to the provider you chose.
Where data is stored
Hosting region: Pending owner decision (named hosting region, for the lawyer review)
Data from all customers is stored in the same database. Each row belongs to one workspace and row-level security prevents one workspace reading another's rows.
How long we keep it
Workspace data is kept while the workspace exists. When you delete an account or workspace, it is scheduled for removal and can be restored during a 30-day grace period; after that it is purged. Search Console history is kept in tiers: site totals are kept, detailed rows are kept for a window set by your plan. Audit records are kept for the period set by your plan.
Your rights
You can export your data and delete your account from the account settings. For other requests, including access, correction, restriction and objection, write to the support address in the footer. We will respond within the time the law requires.
Cookies
We use essential cookies for sign-in and security. Product analytics stays off unless you accept it. The full list is on the cookie policy page.
Transfers and subprocessors
The companies that process data for us are listed on the subprocessors page. Transfer mechanisms are listed there and are pending owner confirmation in this draft.
Changes
We will publish a new version with an effective date and list it in the changelog.