Privacy policy

What we collect

Your account

• Your email address, and your name and profile picture if you sign in with Google.
• Each sign-in session, with the IP address and browser it started from.
• A security log of sign-ins, connections, publishing and billing changes. Sign-in entries include the IP address.
• Your email settings and time zone.

Your website

• The public pages we read from your site: text, titles, links, structured data and image addresses.
• The business profile you confirm, the list of jobs we build for you, the pages we write, your edits, and a history of what was published.
• A copy of each page as it was before we changed it, so you can undo the change.

Services you connect

• Google Search Console: the searches, pages, clicks, impressions and positions Google reports for your site.
• Shopify or WordPress: the pages, posts, products and collections we read or update for you, and your store’s name and address.
• Bing Webmaster Tools or DataStated, if you add a key: the searches Bing reports, or revenue by page.
• The access tokens and keys for these services. They are encrypted, and they never reach your browser.

AI answers

The questions you track, and what ChatGPT, Gemini, Perplexity and Google’s AI Mode answered each time we checked, including which sites they named.

Billing

Payments go through Stripe. We store your Stripe customer and subscription IDs, your plan, its status and the billing period. We never see or store your card number.

What we don’t collect

• Nothing about the visitors to your website. We don’t put a tracking tag on your site.
• No customer or order data from your store. The Shopify permissions we ask for cover content and products only.
• No advertising or analytics trackers, in the app or on this site.

How we use it

• To run the service: read your site, build your weekly list, write pages, publish what you approve, check AI answers and measure results.
• To email you: sign-in links, the weekly or monthly emails you choose in Account, and notices about your plan or the service. Every scheduled email has a one-click unsubscribe.
• To keep the service safe and fair: rate limits, limits on free audits, spending limits on the research and writing we do for each account, and fixing errors.

We don’t sell your data, we don’t share it for advertising, and we don’t use it to train AI models.

AI models and research providers

Building your list and writing pages means sending some of your data to outside providers. We send:

• To AI model providers: your site’s content and business profile, the searches we’re judging (including Search Console searches), and research for each page. They use it to judge which searches fit your business and to write and check drafts.
• To search-data providers: your domain, the searches we’re researching and the questions you track. They return search volumes, Google results and AI assistants’ answers. The questions are asked to ChatGPT, Gemini, Perplexity and Google’s AI Mode without your account details.

We send each provider only what its task needs. We use providers whose terms don’t allow them to train their models on the data we send.

Data from Google

When you connect Search Console, we ask Google for read-only access (the webmasters.readonly scope). We read the searches, pages, clicks, impressions and average positions Google reports for the property you choose. We can’t change anything in your Google account.

We use this data only to provide features you see: finding pages to fix, judging which searches fit your business, writing pages, and checking results after a page goes live. Search terms are sent to AI model providers only for those tasks, as described above.

We don’t sell Google data, use it for advertising, or use it to train general AI or machine-learning models. People don’t read it unless you ask us to, unless it’s needed for security, or unless the law requires it.

If you sign in with Google, we receive your name, email address and profile picture, and use them only for your account.

Disconnecting Search Console revokes our access with Google and deletes our stored token. Deleting your account deletes the data we imported.

Rank It For Me’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Shopify and WordPress

We read and change only the content you approve: pages, blog posts, collections and product SEO fields. Nothing is published until you approve it, and drafts stay drafts until you choose to publish.

Shopify access is a short-lived token that we refresh. WordPress access is an application password you create. Both are stored encrypted. Uninstalling our Shopify app deletes its tokens. Disconnecting either service from Connections revokes our access there and deletes our copy. We respond to Shopify’s privacy requests; we hold no customer data to return or erase.

Who else handles your data

These service providers process data for us, only to run Rank It For Me:

• Hosting and database, in the United States
• Network security and DNS, in front of the app
• Email delivery, for sign-in links and the emails you choose
• Payments, through Stripe
• AI model providers and search-data providers, as described above
• Error monitoring, which receives error details with no page content, cookies or personal details

Email hello@rankitforme.com for the current list of providers.

Services you connect (Google, Shopify, WordPress, Bing, DataStated) get only the requests needed to do what you asked. We disclose data otherwise only when the law requires it. If KAMKR LLC sells or reorganizes the business, this policy goes with the data.

Cookies and browser storage

We use only the cookies needed to sign you in and connect services. There are no analytics or advertising cookies.

Cloudflare, which protects the app, can set a short-lived security cookie of its own when it checks a request. We don’t read it.

How we protect it

• Everything travels over HTTPS, and browsers are told to refuse unencrypted connections.
• Access tokens and keys are encrypted with AES-256-GCM. The key is kept apart from the database, so a copy of the database alone doesn’t reveal them.
• Sign-in links work once, expire in 15 minutes and are stored only as hashes. There are no passwords to leak.
• Every request checks that the site belongs to your account. Sign-in, audits and other costly actions are rate limited.
• The few people who operate Rank It For Me look at account data only when running the service or helping you requires it.

How long we keep it

• Your account, sites, drafts and history: until you delete them or your account.
• Expired sign-in sessions: deleted 7 days after they expire.
• The security log: 365 days.
• Ranking history for the searches you track: 400 days.
• Records of which sites had free audits: 60 days. These hold the site’s address, not who asked, and they stay after an account is deleted so the free limit can’t be reset.
• Our cost ledger: kept for our accounts. It holds an account ID and dollar amounts, and nothing about you.
• Stripe keeps its own billing records as the law requires.

When you delete your account, we remove your data from the live database straight away. Copies in encrypted backups are removed when those backups expire, within 30 days. Pages already published on your site stay there.

Your choices and rights

• Delete your account from Account. It disconnects your services, cancels your plan and deletes your data.
• Choose your emails in Account, or use the unsubscribe link in any scheduled email.
• Disconnect a service from Connections at any time.
• Get a copy or a correction of your data by emailing hello@rankitforme.com.

Depending on where you live, you may have the right to know what we hold about you, and to correct it, delete it, take a copy, or object to how it’s used. California residents have these rights under the CCPA. We don’t sell personal information or share it for cross-context behavioral advertising, and we won’t treat you differently for using your rights. Email hello@rankitforme.com and we’ll respond within 30 days.

Rank It For Me runs in the United States. If you use it from elsewhere, your data is transferred to and stored in the United States.

Children

Rank It For Me is a business tool for people 18 and older. It isn’t directed at children, and we don’t knowingly collect data from anyone under 13.

Changes to this policy

When this policy changes, the date at the top changes. If a change affects what we collect or who we share it with, we’ll email account owners before it takes effect.