Privacy policy

1. Controller and contact

The controller of personal data in Rankovio (https://rankovio.com) is TradeFlux Labs LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States.

For data protection matters write to [email protected]. We answer in English and Polish.

Our representative in the European Union (Art. 27 GDPR): [TO BE COMPLETED: name, address, e-mail]. You may contact them instead of us on any data protection matter.

2. What data we process

We process only the data needed for the features you use.

Giving account data is voluntary, but you cannot create an account without it. We do not make decisions about you based solely on automated processing that produce legal effects.

3. Google Search Console and Google Analytics 4 data

Rankovio connects to Google in read-only mode and only when you connect a project yourself on Google's consent screen. We never change anything in your Google accounts.

Google data are aggregated statistics about your website. We do not receive data about individual visitors of your website from Google.

Who sees this data. Only members of your workspace who have access to the project, and people you share a report with by link.

AI models. When you prepare a brief or a draft, we may send the AI model provider (section 5) the Search Console queries of the page the text is about, so the brief covers the keywords the page already shows for. We do not send Google Analytics 4 data. We use only providers that do not train models on data sent through their API.

Limited Use. Rankovio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy). In particular:

• we use Google data only for features you see in Rankovio;
• we do not sell it or use it for advertising, including personalised advertising, or for credit decisions;
• we do not use it to train generalised AI models, ours or anyone else's;
• we transfer it to others only as needed to provide those features, at your direction, when the law requires it, or as part of a merger, acquisition or sale of the company under the same rules;
• our staff do not read it unless you agree (e.g. when you report a bug), it is needed for security, or the law requires it.

4. Purposes and legal bases

We process Google Search Console and Google Analytics 4 data only for the purpose in the first row. We never use it for marketing.

5. Recipients and processors

We do not sell data. We share it only with providers a feature cannot work without. Each gets only the data that feature needs and acts under a data processing agreement or its own data processing terms.

Data also reaches people you give access to yourself: members of your workspace, recipients of a report shared by link, and AI clients connected through MCP or an API key. An MCP client sees only the data it was given access to, and only until you revoke it.

We may also disclose data to public authorities where the law requires it.

6. Transfers outside the EEA

The app and its database run on a server in Poland. Data leaves the European Economic Area in three cases: to us as a US company, to the providers in section 5 based outside the EEA, and to Google when you use its services.

Transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) where the recipient is certified under it, and otherwise on the standard contractual clauses approved by the Commission (Art. 46(2)(c) GDPR). [TO BE COMPLETED: basis for each provider.] You can get a copy of the safeguards by writing to [email protected].

Waitlist data stays on our server in Poland and is not shared with providers outside the EEA.

7. How long we keep data

After an account is deleted we may keep data needed for billing, complaints and defending legal claims, at most until the limitation period ends.

8. Security

We use these safeguards:

• connections to the service and to Google are encrypted (HTTPS); the return from Google's consent screen works only on our domain;
• Google access tokens are stored encrypted with AES-256-GCM, with the key kept outside the database; an encrypted token works only in the project it was granted for;
• passwords are stored only as hashes; you can turn on two-step verification;
• the server filters every data request by the workspace and projects you have access to;
• only authorised people have administrative access, and only with two-step verification;
• credentials for external services are kept in server environment variables, never in code or logs;
• test environments use synthetic data only.

If a personal data breach is likely to result in a high risk to you, we will tell you without undue delay.

9. Disconnecting Google and deleting data

Disconnecting in the app. You can disconnect Google Search Console or Google Analytics 4 in the project settings at any time. Then:

1. we revoke the grant at Google and delete the access tokens; if Google does not confirm the revocation, we delete nothing and show an error so you can try again;
2. we stop fetching new data;
3. after you disconnect GA4 we immediately delete all of the project's GA4 data;
4. after you disconnect Search Console the data fetched before stays in the project, so you keep the history if you reconnect; we delete it within 14 days at your request.

Revoking access at Google. You can also revoke access at https://myaccount.google.com/permissions. We then stop fetching data and ask you to reconnect.

Deleting your account and data. Write to [email protected] from the address of your account. Within 14 days we delete the account, the workspaces you own, their projects, the Google tokens and all data fetched from Google, and confirm by e-mail. You can also ask us to delete only the Google data and keep the account.

10. Your rights

You have the right to:

• access your data and get a copy;
• rectify your data;
• erase your data;
• restrict processing;
• receive the data you gave us in a machine-readable format; you can export part of it to CSV yourself;
• object to processing based on our legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

Send requests to [email protected]. We answer within one month; for complex requests this may be extended by two months, and we will tell you if so. We may ask you to confirm your identity.

You may lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa) or the authority in the country where you live or work.

11. Cookies

We use only cookies the service needs to work. We do not use analytics or marketing cookies, so we do not ask for cookie consent.

If we ever add analytics or marketing cookies, we will ask for your consent before setting them.

12. Changes

We update this policy when the service, our providers or the law change. The date of the last change is at the top of the page.

We will e-mail you about material changes, especially those about Google data, at least 14 days in advance. If we want to use Google data in a new way, we will ask for your consent first.