Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, and password (hashed). If you subscribe to a paid plan, billing information is collected and processed by Stripe.

WordPress Credentials

When you connect a WordPress site, we collect and store your site URL and application password. Application passwords are encrypted using AES-256-GCM encryption before storage. We never store your WordPress login password.

Usage Data

We collect information about how you use the platform, including features accessed, content generated, keywords researched, and actions taken. This data helps us improve the service and provide usage analytics.

Analytics Data

If you connect Google Search Console or Google Analytics, we access performance data (clicks, impressions, positions) for the sites you authorize. This data is used solely to provide insights within the platform.

2. How We Use Information

• Provide, maintain, and improve the RankThat platform and its features.
• Process your subscription payments and manage billing.
• Generate AI content, keyword research, and SEO analysis on your behalf.
• Publish content to your WordPress sites as directed by you.
• Send transactional emails related to your account and service updates.
• Monitor and prevent abuse, fraud, and security threats.
• Analyze usage patterns to improve the platform experience.

3. Third-Party Services

RankThat integrates with the following third-party services to deliver its functionality:

• Stripe — Payment processing and subscription management. Stripe collects and processes payment information under their own privacy policy.
• DataForSEO — Keyword research data, SERP analysis, and rank tracking. We send search queries and keywords to DataForSEO to retrieve SEO data.
• OpenAI — AI content generation (GPT models) and image generation (DALL-E). Content prompts and context are sent to OpenAI to generate articles and images.
• Google APIs — Google Search Console and Google Analytics integration via OAuth. We access search performance data and analytics for your authorized properties.

Each third-party service has its own privacy policy governing how they handle data. We encourage you to review their respective policies.

4. Data Storage & Security

• All data is stored in a PostgreSQL database hosted on secured infrastructure.
• Sensitive credentials (WordPress application passwords) are encrypted at rest using AES-256-GCM.
• User passwords are hashed using bcrypt and never stored in plaintext.
• All data transmission uses HTTPS/TLS encryption.
• Access to production systems is restricted and monitored.

5. WordPress Data

When you connect a WordPress site to RankThat, we store your site URL and an encrypted application password. We use this information exclusively to interact with your WordPress REST API for publishing content, uploading media, and managing SEO metadata as directed by you.

• We never store your WordPress user login password.
• Application passwords are encrypted with AES-256-GCM before storage.
• You can revoke access at any time by removing the application password from WordPress.
• We do not access or modify your WordPress site outside of actions you initiate through the platform.

6. AI-Generated Content

Content is generated using the OpenAI API. When you request content generation, we send relevant context (topic, keywords, outline, brand voice settings) to OpenAI for processing.

• Your data sent to OpenAI is processed under their API data usage policy and is not used to train their models.
• Generated content is stored in your account and is owned by you.
• We do not share your generated content with other users or third parties.

7. Cookies & Tracking

RankThat uses minimal cookies necessary for the operation of the platform:

• Authentication cookies — httpOnly cookies used to maintain your login session securely.
• Refresh tokens — Stored securely to maintain session continuity.

We do not use third-party tracking cookies, advertising cookies, or behavioral tracking technologies.

8. Data Retention

• Account data is retained while your account is active.
• Upon account closure, your data will be permanently deleted within 30 days.
• Billing records may be retained as required by applicable tax and financial regulations.
• Anonymized, aggregated usage data may be retained for analytics purposes.

9. Your Rights

You have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you.
• Export — Download your content, keywords, and project data.
• Correction — Request correction of inaccurate personal data.
• Deletion — Request permanent deletion of your account and associated data.

To exercise any of these rights, contact us at support@rankthat.io .

10. Children's Privacy

RankThat is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us with personal information, we will take steps to delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the platform with at least 30 days' notice. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of the platform after changes take effect constitutes acceptance of the updated policy.

12. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at support@rankthat.io .

You may also review our Terms of Service and Refund Policy for additional information.