Privacy policy

RankingTop (operator details to be added) decides how the data described here is used. Write to hello@rankingtop.app with any question or request about your data.

• Websites you submit and what we crawl. The domain, its robots.txt, and what we read from its public pages: titles, descriptions, headings, links, structured data, status codes and the issues we find. We need this to produce the proof and run the loop. We read only public pages and never sign in to your site.
• Your email address. When you ask for a proof by email or create an account. If you sign in with Google, Google gives us your name, email address and profile picture. We use it to send the proof, sign-in links, receipts, readouts and a few follow-up emails, which you can stop with one click.
• Account details. Your plan, billing status, settings, the description of your site and the buyer questions you lock.
• Google Search Console, if you connect it. Read-only access tokens, stored encrypted (AES-256-GCM), and the performance data of the properties you choose: queries, pages, clicks, impressions and positions. You can also revoke access from your Google account at any time.
• Publishing connections, if you add one. The token or application password you give us for GitHub, WordPress, Webflow or Shopify, stored encrypted (AES-256-GCM), and the settings that say where to publish. We use it only when you click Publish or Revert on a draft, and you can disconnect it, or revoke it at the provider, at any time.
• Team members and client reports. The email addresses an agency invites to its team, and the client address it chooses for scheduled reports. A client can stop those reports with the unsubscribe link in every one.
• Visits from AI assistants, if you install the snippet. On your site, the snippet sends us only which assistant a visitor came from (ChatGPT, Perplexity and so on), the page they landed on and, if you call it, that a conversion happened. We store daily counts per assistant and page. No cookies, no visitor or session IDs, no IP address, user agent or referring URL are stored, and nothing is sent when the browser signals Global Privacy Control or Do Not Track.
• Payments. Stripe takes your card details. We receive a customer reference, what you bought and your subscription status, never your full card number.
• Telegram, if you connect it. The chat ID we send your readout to.
• Product events. First-party records of steps such as page views, proofs started and checkouts opened, linked to the random ID in the amp_anon cookie or to your account. We use them to understand which steps work. We do not store your IP address with them; it is used briefly to limit abuse.

We email marketing agencies about a free check of their own website. For each agency we keep: the business address its own website publishes and the page we found it on, the company name and city from Google Maps, the check we ran on its public site, the emails we sent and any reply.

• We rely on legitimate interest: a short, relevant message to a business address the company published itself.
• We do not email anyone in the European Union, and we skip sites that ask not to be pitched.
• Every email has a one-click opt-out; a reply of "no" works too. After that we never email that address again.
• If an agency does not reply, we delete what we kept about it 90 days after the last email. We keep only an address that opted out, so we never write to it again.

Most cookies here are our own. Google Analytics runs only if you allow it in the banner; until then its script is not even loaded. There are no advertising trackers. You can change your choice at any time with Cookie settings at the bottom of every page.

We do not sell personal data. These services process data for us, each only for its job:

• Hetzner hosts the server in Germany that runs the site, its database and sign-in (Supabase software we operate ourselves).
• Stripe takes payments and runs the billing portal. Resend delivers our email.
• Google provides Search Console data and Sign in with Google, when you use them. Google Analytics receives the pages you visit, your browser and an approximate location, only if you allow analytics. Telegram delivers readouts, when you connect it.
• GitHub, WordPress, Webflow or Shopify receive the drafted change you choose to publish, on the site you connected.
• Our outreach mailbox provider (such as Google Workspace or Zoho) sends and receives the emails we exchange with agencies.
• AI providers (OpenAI, Anthropic, Perplexity), when enabled, receive the buyer questions we measure and, to draft fixes, text from the public pages we crawled. Search and answer-capture providers (such as Brave Search, Tavily or DataForSEO, which asks ChatGPT, Gemini and Google our buyer questions logged out) receive the buyer questions and the country they are asked from. None of them receives your email address or account details from us.

We may also disclose data when the law requires it.

Data is stored on our server at Hetzner in Falkenstein, Germany. Where data moves between countries, we rely on [transfer safeguards to be confirmed, for example standard contractual clauses].

• Account data: while your account is open, then [period to be confirmed] for backups and records the law requires.
• Emails left for a proof: until you unsubscribe or ask us to delete them, and no longer than [period to be confirmed].
• Crawl data and reports: [period to be confirmed]; you can ask us to delete a report at any time.
• Search Console tokens: until you disconnect, close your account or revoke access in Google.
• Publishing tokens: until you disconnect the site, delete it or close your account.
• Payment records: as long as tax and accounting law requires.

You can download all your data and delete your account yourself, under Account in the dashboard. You can also ask to see, correct, export or delete your personal data, or object to how we use it. Write to hello@rankingtop.app; we answer within a month. Every follow-up email has a one-click unsubscribe link.

If you think we have handled your data wrongly, you can complain to your local data protection authority.

Traffic is encrypted in transit. Search Console tokens are encrypted at rest. Database access is restricted by row-level security, and service keys never leave our servers. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

RankingTop is a business tool and is not meant for anyone under 16.

We will post any change here and update the date above. If a change affects how we use data you already gave us, we will email you first. The terms of service cover the rest of our agreement.