This policy covers rankwrite.io, the customer portal, the content audit, sample articles and the emails we send. It does not cover a customer’s own website or the third-party platforms they connect.
Who we are
Rankwrite (“Rankwrite”, “we”, “us”) operates rankwrite.io. We are the controller of account, billing and lead data. For the content and site data a customer gives us to produce articles, we act as a processor on that customer’s instructions. You can reach us at [email protected].
What we collect
- Account and billing details: name, company, email address, billing contact, plan and billing address. Card details are handled by Stripe; we do not store full card numbers.
- Site and publishing data: site URL, CMS type, CMS credentials and, if you connect it, Search Console authorisation. CMS and Search Console credentials are encrypted at rest.
- Content materials: voice documents, strategies, briefs, research notes, drafts, editor notes, sources, expert answers, reports and published URLs.
- Lead and audit data: email address, site URL, audit results, verification status, the IP address used for rate limiting and any correspondence about the audit or a sample.
- Email: messages you send to our reply addresses, including the body, headers and attachments, so we can answer them and keep a record of the conversation.
- Technical and security data: IP address, browser or user-agent information, request logs, session logs and cost or usage records.
Why we use it
- to provide the service, produce articles, publish to your CMS and operate the portal;
- to sign you in, secure accounts and prevent abuse;
- to send transactional email such as verification links, sign-in links, audits, samples and reports;
- to bill you, collect payment, prevent fraud and meet tax or accounting obligations;
- to answer support, privacy and legal requests;
- to improve quality, security and cost efficiency.
Where data protection law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in operating and securing the service, compliance with legal obligations, and consent where we ask for it. We do not currently send marketing email without consent.
Cookies and similar technology
We use a strictly necessary session cookie when you sign in to the customer portal. We do not use advertising cookies or cross-site tracking cookies. Our hosting and CDN providers process request metadata to deliver and protect the site.
On the public marketing site we use first-party, cookieless analytics. A visitor is identified for one UTC day by a salted hash of their IP address and browser user agent; the raw IP address is not stored in the analytics database and the daily salt is deleted after 48 hours. We record pageviews, referring site, campaign parameters, device/browser category, country, engaged time, scroll depth and Core Web Vitals. Analytics events are kept for up to 400 days. You can opt out with ?analytics_ignore=true, which sets a local browser preference.
Who we share it with
We do not sell personal data. We share only what is needed with:
- our hosting provider and Cloudflare, for delivery, security and backups;
- Stripe, for payments and tax when billing is enabled;
- Resend, for transactional email;
- DataForSEO, for keyword and search-result data;
- AI model providers used to run the service (currently DeepSeek through Haimaker; Anthropic where a Claude model or its search tool is enabled), to research, write and edit content;
- Google, for Search Console data, only when a customer connects it;
- Pexels, for stock-image search, only when it is enabled;
- Backblaze B2, for database backups;
- the customer’s CMS (WordPress, Webflow, Ghost, HubSpot or Shopify), to publish their articles;
- professional advisers or authorities when the law requires it or we need to establish or defend a legal claim.
Some providers process data outside the EEA or UK. Where required, we use appropriate safeguards for those transfers. The customer’s own CMS and any third-party service they connect are governed by that provider’s terms and privacy policy.
How long we keep it
- Account, site and content data: for the life of the account. After a deletion request we delete or anonymise it, except records we must keep for tax, accounting or legal reasons.
- Leads and audits: normally no longer than 12 months after the last contact, then deleted or anonymised.
- Operational and security logs: only as long as needed to run and protect the service; our target retention is 90 days.
- Backups: 30 days, after which they rotate out.
- Payment records: retained by Stripe as required by tax and accounting law.
Your rights
Depending on where you live, you may have the right to access, correct, delete, export, restrict or object to our use of your personal data, and to withdraw consent. You can use the portal’s export and deletion tools, or email [email protected]. We may need to verify your identity before acting. You can also complain to your local data protection authority.
Deleting your account does not delete articles already published on your own CMS; those posts belong to you and remain under your control.
Security
We use encryption in transit, encrypted CMS and Search Console credentials, access controls, backups and least-privilege access. No system is perfectly secure. If you believe an account or message has been compromised, contact us at [email protected].
Children
The service is for businesses and is not directed to children under 16. We do not knowingly collect personal data from children.
Changes
We may update this policy as the service changes. We will post the new version here with a new date; material changes will be communicated to account holders.
Contact
Privacy questions and requests: [email protected]. See also our terms and AI disclosure.