Legal
Privacy Policy
This Privacy Policy explains what information RankHouse collects when you visit our website or use our application, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. Each section answers one question, so you can go straight to the one you care about.
Who we are and what this policy covers
RankHouse (“RankHouse”, “we”, “us”) operates the RankHouse website at https://rankhouse.ai and the RankHouse application (together, the “Service”). RankHouse is an AI-driven SEO platform: it audits websites, researches keywords, plans and generates content, publishes to the websites you connect, monitors visibility in search engines and AI assistants, and produces performance reports.
This policy applies to everyone who visits our website, creates an account or uses the Service, including people who connect third-party services such as Google Search Console, Google Analytics, WordPress or Shopify to it.
For the personal data described here we are the data controller, unless stated otherwise. Where we process data on behalf of a business customer, for example the visitor statistics of a customer’s website that we read from their Google Analytics property, that customer is the controller and we act as their processor under our Terms of Service.
If this policy does not answer your question, our contact details are in the last section.
Information we collect
We collect the following categories of information. Where a category is optional, we say so.
Account and identity
- Your name and email address.
- Your password, stored only as a one-way hash. We cannot read it.
- A profile photo, if you choose to upload one.
- How you sign in (email and password, or Google).
- Language and interface preferences, account status, plan and credit balance.
Brand and website data
- Your domain and website URL.
- The brand name and description, target audience and target keywords you enter or that we suggest.
- Pages, titles and content we crawl from your website in order to audit it.
- Public information about your website gathered from SEO data providers, such as rankings, backlinks and authority metrics, and any competitor or keyword data you ask us to research.
Connected services
When you connect a third-party service, we receive only the data the connection is authorised for:
- Google Search Console: search performance for your property (queries, clicks, impressions, positions) and indexing information.
- Google Analytics: aggregated traffic and audience metrics for your property.
- Google Business Profile, where offered: listing details and reviews.
- WordPress, Shopify and similar platforms: the list of your site’s pages, categories and products, and the ability to publish and update content.
- The email address of the account you connected with, and the credentials (OAuth tokens or API keys) needed to keep the connection working.
Content and AI inputs
- Briefs, prompts, keywords, instructions and edits you provide.
- Content generated for you, including drafts, metadata and images.
- Content you publish through the Service.
Payment information
Payments are processed by Stripe. We receive and store your Stripe customer reference, plan, transaction status and invoice details and, so you can see which card is on file, the card brand and last four digits. We never receive or store full card numbers or security codes.
Usage and technical data
- IP address and the approximate location derived from it, browser and device type, operating system and language.
- Pages visited, features used, jobs run and their timestamps.
- Error reports and diagnostic logs produced when something goes wrong.
Communications
- Messages you send us, including support requests, feedback and the reason you give when cancelling.
- Delivery information about the emails we send you, such as whether an email bounced.
How we collect information
- Directly from you when you create an account, complete the brand wizard, edit content, change settings or contact us.
- Automatically through the cookies and local storage described below, our server logs and our error-monitoring tools.
- From connected services that you authorise, such as Google or your CMS. You can disconnect them at any time from your account page.
- From data providers and the public web when we crawl your website or request ranking, backlink and keyword data about it.
- From Stripe about the status of your payments and subscription.
How we use information
We use the information we collect to:
- Provide and operate the Service: run audits, build content plans, generate and publish content, track visibility and produce reports.
- Create and secure your account, authenticate you and keep you signed in.
- Process payments, manage plans and credits, and issue invoices.
- Send transactional emails: verification, password reset, reports and notices about your account and jobs.
- Respond to support requests and other communications.
- Monitor, debug and improve the reliability, performance and security of the Service.
- Understand how the Service is used, in aggregated or de-identified form, so we can improve it and develop new features.
- Prevent abuse, fraud and unauthorised access, and enforce our Terms of Service.
- Comply with legal obligations and respond to lawful requests.
We do not sell personal data, we do not use it to show you third-party advertising, and we do not use your content or connected-service data to train AI models of our own.
Legal bases for processing
If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases under the GDPR and equivalent laws:
| Purpose | Legal basis |
|---|---|
| Providing the Service and your account | Performance of a contract (Art. 6(1)(b)) |
| Payments, invoicing and accounting records | Performance of a contract; legal obligation (Art. 6(1)(c)) |
| Security, fraud prevention and debugging | Legitimate interests (Art. 6(1)(f)) in keeping the Service secure and working |
| Product analytics and improvement | Legitimate interests; consent where the law requires it |
| Connected services (Google, CMS platforms) | Consent, given when you authorise the connection and withdrawable by disconnecting |
| Product news and marketing emails, where we send them | Consent (Art. 6(1)(a)); withdrawable at any time |
| Responding to legal requests | Legal obligation |
Where we rely on legitimate interests, we have balanced them against your rights and freedoms. You can object to that processing as described in the section on your rights.
Google user data
When you connect Google Search Console, Google Analytics or a Google Business Profile, the Service requests only read-only scopes for that product together with your basic profile (name and email address). We use the data solely to show you the performance of your own website, to inform the audits, content plans, insights and reports we produce for it, and to keep the connection working.
Limited use disclosure
RankHouse’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We do not use Google user data for advertising, and we do not sell it.
- People at RankHouse do not read Google user data except with your consent, to provide support you asked for, for security or abuse investigations, or where the law requires it.
- We transfer Google user data only to the sub-processors needed to provide the feature you are using, such as our hosting provider and, where a feature generates recommendations from your data, the AI model providers listed in the section on AI processing.
- You can disconnect a Google service at any time from your account page, or revoke access from your Google account’s permissions settings. We then delete the stored tokens and stop collecting data from that service.
AI processing
Much of the Service is powered by large language models and other machine-learning systems. The features that use them include brand analysis, keyword and topic research, content plans, content and metadata generation, visibility scans across AI assistants, and the insights in your reports.
To produce these results we send the relevant inputs to the model: your brand details and keywords, content from your website, performance data where the feature depends on it, and your instructions and edits. We send what the feature needs and no more.
We access models from the providers listed under sub-processors (currently OpenAI, Anthropic, Google, Microsoft Azure OpenAI Service and Perplexity) through their business APIs, whose terms prohibit using our requests to train their models. We do not train models of our own on your data.
Generated content may be inaccurate or incomplete and should be reviewed before you publish it. Our Terms of Service describe your responsibilities for content you publish.
International transfers
We and our sub-processors may process personal data in countries other than the one you live in, including the United States. Those countries may have data protection laws that differ from yours.
Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on adequacy decisions, the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum, and, where a provider is certified, the EU-US Data Privacy Framework. You can request a copy of the relevant safeguards by contacting us.
How long we keep information
We keep personal data for as long as we need it for the purposes described in this policy, and then delete or anonymise it. The main periods are:
| Data | How long we keep it |
|---|---|
| Account and profile | For as long as your account exists, then deleted within 30 days of account deletion |
| Brand, website and performance data | For as long as your account exists; superseded crawl and ranking snapshots are pruned periodically |
| Generated and published content | For as long as your account exists, or until you delete the content |
| Connected-service credentials (OAuth tokens, API keys) | Until you disconnect the service or delete your account, then deleted immediately |
| Billing records and invoices | 7 years after the transaction, as required by accounting and tax law |
| Server, job and error logs | Up to 90 days |
| Support communications | 2 years after the conversation is closed |
| Backups | Overwritten within 30 days of deletion from live systems |
When you delete your account from the Danger zone on your account page, we delete your profile, brands, integrations, generated content, jobs and reports from our live systems. Copies in backups are overwritten within the backup period. We may keep limited records where the law requires it, to resolve disputes, or to prevent fraud and abuse.
How we protect information
- All traffic between your browser, our servers and our providers is encrypted in transit with TLS.
- Passwords are stored as salted one-way hashes (bcrypt); sessions use httpOnly, same-site cookies that page scripts cannot read.
- Connected-service credentials are kept in access-controlled systems and used only by the jobs that need them.
- Access to production systems is restricted to staff who need it, and is logged.
- We use providers with recognised security certifications and monitor our systems for errors and unusual activity.
No method of transmission or storage is completely secure. If you believe your account has been compromised, contact us immediately. Where a personal data breach affects you, we will notify you and the relevant authority as the law requires.
Your rights and choices
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and receive a copy.
- Correct data that is inaccurate or incomplete.
- Delete your data, subject to legal retention obligations.
- Restrict or object to certain processing, including processing based on legitimate interests.
- Port data you provided to us in a machine-readable format.
- Withdraw consent at any time where processing is based on consent, without affecting processing before the withdrawal.
- Complain to your data protection authority. In the EEA this is the authority in your country; in the UK it is the Information Commissioner’s Office.
How to exercise your rights
You can do most of this yourself from your account page:
- Update your name, email address, photo and password under Profile.
- Disconnect Google and CMS integrations under Integrations.
- Manage your plan and download invoices under Plan and billing.
- Permanently delete your account and its data under Danger zone.
For anything else, email rankhouse.ai@gmail.com. We may ask you to verify your identity. We respond within one month, or sooner where the law requires, and we will not treat you differently for exercising your rights.
Transactional emails about your account cannot be switched off while your account exists. Any marketing email we send includes an unsubscribe link.
Additional information for California residents
We do not sell personal information or share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes other than providing the Service. You have the rights to know, delete and correct described above, which you can exercise using the same contact details.
Children
The Service is built for businesses and professionals and is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
Third-party websites and services
The Service links to and integrates with websites and services we do not operate, including the platforms you connect and the search engines and AI assistants we monitor. This policy does not cover them. Please read their privacy policies to understand how they handle your data.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. If a change materially affects how we use your personal data, we will notify you by email or with a notice in the app at least 14 days before it takes effect. Continued use of the Service after that date means you accept the updated policy.
Contact us
For questions about this policy or to exercise your rights, contact us at the details below. Put “Privacy request” in the subject line so it reaches the right people quickly.