Privacy Policy

1. Who We Are and Scope

RankControl (“rctrl.com”, “RankControl”, “we”, “us”, or “our”) is an AI SEO and content platform operated by RankControl, LLC, a Delaware limited liability company. This Privacy Policy explains how we handle personal data in connection with our website, dashboard, and services. It applies to our customers, to visitors of rctrl.com, and, in the limited role described below, to visitors of the websites where our customers publish content and embed our analytics tools.

2. The Two Roles We Play

We handle personal data in two distinct roles, and your rights depend on which one applies:

• As a controller. When we process data about our customers and the people who visit rctrl.com (account details, billing, usage, and support), we decide how and why that data is processed. This Policy governs that processing.
• As a processor. When our customers publish content to their own websites and embed our analytics tools, those tools collect data about the customer's website visitors. For that data, our customer is the controller and we act as a processor, handling the data on the customer's behalf and under their instructions. If you are such a visitor and want to exercise your rights, please contact the website operator (our customer) whose site you visited; we will assist them as required. This processing is governed by the Data Processing Addendum between us and the customer.

3. Information We Collect

Information you provide

• Account information: name, email address, company name, website URL
• Billing information: payment details processed by Stripe (we do not store card numbers)
• Brand data: website content, logos, color palettes, and tone preferences you provide or we detect from your website
• Content: topics, keywords, and generated content associated with your account

Information collected automatically

• Usage data: pages visited, features used, session duration
• Device information: browser type, operating system, IP address
• Analytics: page views, crawl events, keyword rankings, and AI citation data
• Session recordings: a replay of how our own website and dashboard were used, so we can reproduce faults and answer support requests. Form fields are masked, and we do not record the billing and API settings screens. You can ask us to stop recording your sessions or to delete your recordings at any time.

4. How We Use Your Information

• To provide, maintain, and improve our services
• To generate content that matches your brand identity
• To track AI citations and visibility across platforms
• To measure and attribute visits from AI and Google search
• To send you notifications, reports, and service updates
• To process payments and manage subscriptions
• To respond to support requests
• To secure the service, prevent abuse, and comply with our legal obligations

5. Legal Bases for Processing

Where the EU or UK GDPR applies to our processing as a controller, we rely on the following legal bases:

• Performance of a contract — to create your account, deliver features, and bill you
• Legitimate interests — to secure, maintain, and improve the service and prevent abuse, balanced against your rights
• Consent — where required, for example for certain marketing communications and non-essential cookies; you may withdraw consent at any time
• Legal obligation — to comply with law and with tax and accounting requirements

When we act as a processor for visitor data, the legal basis for that processing is determined by our customer as the controller.

6. Data Sharing and Sub-processors

We do not sell your personal information. We share data with:

• Sub-processors: service providers who process data on our behalf under contract, only as needed to run the service, including infrastructure, payments, search and social data, AI content generation, and, where you connect them, your publishing and analytics tools. A current list, with each provider's purpose, is maintained on our Sub-processors page.
• AI providers: Anthropic (Claude) and OpenAI (GPT) for content generation. We send brand context and topic data, never the personal data of your account or your visitors, and these providers do not use it to train their models under their API terms.
• Legal and corporate: when required by law, subpoena, or valid government request, and in connection with a merger, acquisition, or sale of assets (with notice where required).

7. Cookies and Tracking

We and our published-content embeds use cookies and similar technologies as described in our Cookie Policy. Where consent is required (for example, for non-essential cookies under the GDPR/ePrivacy rules or India's DPDP Act), we (for rctrl.com) or the customer (for cookies set on the customer's own site) are responsible for obtaining it.

8. Data Storage, Security, and Breach Notification

Your data is stored on Convex (database) and Hetzner (application hosting), with file and image storage on Cloudflare R2. We implement industry-standard safeguards, including encryption in transit (TLS) and at rest and role-based access controls; see our Securitypage for details. No system is perfectly secure, but if we become aware of a personal-data breach affecting you, we will notify you and the relevant authorities as required by applicable law, including within the timeframes set by the GDPR and India's DPDP Act.

9. International Data Transfers

RankControl, LLC is a United States (Delaware) company with team operations in India, and we use service providers located in the United States, the European Union, and elsewhere. When we transfer personal data across borders, including from the EEA or UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs) with the UK Addendum where applicable, or another lawful transfer mechanism (including the EU-U.S. Data Privacy Framework, if and when we certify to it).

10. Data Retention

We retain your account data for the duration of your subscription and as needed to meet legal, tax, and accounting obligations. Upon account deletion, we remove your personal data within 30 days, except where retention is required by law. Data we handle as a processor is retained and deleted according to our customer's instructions and the Data Processing Addendum. We may keep aggregated or anonymized data, which no longer identifies you, for service improvement.

11. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights over your personal data:

• Access or obtain a copy of your personal data
• Correct inaccurate data
• Delete or erase your data
• Export your data in a portable format
• Restrict or object to certain processing
• Withdraw consent and opt out of marketing communications
• Lodge a complaint with a supervisory authority

EEA/UK (GDPR): you have the rights above, including the right to complain to your local data-protection authority. India (DPDP Act, 2023): as a Data Principal, you have the right to access, correct, and erase your data, to grievance redressal, and to nominate another person to exercise your rights; contact our Grievance Officer below. California (CCPA/CPRA): you have the right to know, delete, and correct your data, to opt out of the sale or sharing of personal information (we do not sell it), and not to be discriminated against for exercising your rights.

To exercise any right, use our contact form. We will verify your request and respond within the time required by applicable law. If your request concerns data we process on behalf of a customer (visitor data), we will refer you to, or act on the instructions of, that customer as the controller.

12. Visitor Data

When visitors interact with articles our customers publish to their own websites, our embedded analytics tools collect visitor data, including referral source (Google, ChatGPT, Perplexity, Claude, and others), pages viewed, and engagement metrics, and make it available to the customer through the RankControl dashboard. For this data, the customer is the controller and we are the processor. If you are a customer, you are responsible for your own compliance regarding the visitors you collect data from, including maintaining your own privacy policy, providing notice, and obtaining any consent required by law (such as cookie consent under the GDPR/ePrivacy rules or DPDP). Our obligations to you for this processing are set out in our Data Processing Addendum.

13. Children's Privacy

Our services are not directed at individuals under 18, and India's DPDP Act treats anyone under 18 as a child. We do not knowingly collect or process personal information from children. If you believe a child has provided us personal data, contact us and we will delete it.

14. Grievance Officer and Contact

For privacy questions or to exercise your rights, use our contact form. In accordance with India's Digital Personal Data Protection Act, 2023, you may reach our Grievance Officer through the same form for concerns about how your personal data is handled; we will acknowledge and address grievances within the timeframes prescribed by law.

15. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or through the platform, and we will update the “Last updated” date above.