Privacy Policy

RankThroughAI is the data controller for personal data processed through this service. RankThroughAI is operated as a sole trader — by an individual rather than a registered company — at www.rankthroughai.com.

For anything in this policy — including a request to access, correct or delete your data — contact privacy@rankthroughai.com. We reply to every message, and to rights requests within one month.

For payment data specifically, our reseller Paddle is an independent controller. See section 5.

We do not ask for or want special category data — health, biometric, political or religious information. Please do not put it into documents or knowledge sources.

Where the UK or EU GDPR applies, we rely on the following bases. Elsewhere the same purposes apply under equivalent local law.

• To provide the service — creating your account, running audits and checks, generating and scoring content, publishing to your site. Performance of a contract.
• To bill you and prevent fraud — managing subscriptions, enforcing plan limits, detecting abuse. Contract, and legitimate interests.
• To support you — answering questions, investigating faults. Contract, and legitimate interests.
• To keep the service secure and working — logging, rate limiting, debugging, capacity planning. Legitimate interests.
• To improve the product — understanding which features are used, in aggregate. Legitimate interests.
• To send service messages — renewal reminders, changes to terms, security notices. Contract, and legal obligation.
• To send marketing email, where you have opted in. Consent. You can withdraw it at any time.
• To meet legal and tax obligations. Legal obligation.

Several features send your content to third-party AI models: drafting and rewriting in the editor, extracting terms, suggesting internal links and prompts, summarising business context, writing outreach emails, and checking whether AI assistants mention your brand.

Those requests go through OpenRouter, which forwards them to the model provider serving the request — currently Anthropic or OpenAI. What is sent is the content the feature needs: the document you are editing, the business context in that workspace, and relevant pages from the site connected to it.

Workspaces are isolated from one another. Content and context from one client workspace is never used to answer a request made in a different one.

If you connect Google Search Console, we ask Google for permission to read search analytics and URL inspection data for the property you choose. We use it for one thing: showing whether your pages are indexed and how they perform, in the app, to you.

We store only the refresh token needed to keep the connection alive, encrypted at rest. Access tokens are short-lived and requested per operation rather than stored. Google data is not sold, not used for advertising, and not used to train any model. You can disconnect at any time in the app, or revoke access from your Google account settings — either takes effect immediately.

We share data with the providers below only to the extent needed to run the service. Each is bound by a contract requiring appropriate security and restricting use to our instructions.

We may also disclose data where the law requires it, to establish or defend legal claims, or to a buyer as part of a merger or sale of the business — in which case we will tell you first.

Our providers operate in several countries, including the United States, so your data will be transferred outside your own country and outside the UK and EEA. Where that happens we rely on appropriate safeguards — UK and EU Standard Contractual Clauses, adequacy decisions, or an equivalent lawful mechanism. Contact privacy@rankthroughai.com for detail on the safeguards used for a particular transfer.

• All traffic between you and the service is encrypted in transit with TLS.
• Credentials for connected sites, and your Google Search Console refresh token, are encrypted at rest with a key held separately from the database.
• Passwords are stored only as a one-way hash. We cannot read your password and will never ask you for it.
• Access to production systems is restricted to those who need it, and secrets are held in a managed secret store rather than in code or configuration files.

No system is perfectly secure. If a breach affects your personal data and poses a risk to you, we will notify you and the relevant regulator within the time limits the law sets.

• Account and content data: for as long as your account is open.
• After you close your account: deleted within 30 days, except where we must keep something longer.
• Billing and tax records: retained as long as tax law requires, typically six to seven years. These are held mainly by Paddle as merchant of record.
• Server logs: a short rolling window for security and debugging.
• Marketing consent records: kept while you are subscribed and for a period afterwards to prove consent was given and withdrawn.

Deleting a document, workspace or connected site removes it and the data derived from it, including any search index built from it.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you, and get a copy.
• Correct data that is wrong or incomplete.
• Delete your data, in the circumstances the law allows.
• Restrict or object to processing based on legitimate interests.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time, where we relied on consent.
• Complain to your data protection regulator.

If you are in California, you also have the right to know what personal information is collected and disclosed, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA.

Exercise any of these by emailing privacy@rankthroughai.com. We respond within one month. We may need to verify your identity first, which normally means writing from the address on the account.

We use cookies and similar storage that are strictly necessary to run the service — keeping you signed in, maintaining your session, and security. These do not require consent because the service cannot work without them.

Paddle sets its own cookies during checkout to process your payment and prevent fraud; see Paddle’s privacy notice.

If we later add analytics or advertising cookies, we will ask for your consent first and update this section.

RankThroughAI is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, contact privacy@rankthroughai.com and we will delete it.

We will update this policy as the service changes. The date at the top shows when it last changed materially, and we will notify you by email or in the app before a significant change takes effect.

Privacy questions and rights requests: privacy@rankthroughai.com. General support: support@rankthroughai.com. See also our Terms and Conditions and Refund Policy.