Privacy policy

1. Scope

This policy explains how Rank.ai collects, uses, shares, and protects information about: (a) customers and users of the Service; (b) data you connect for research and publishing; (c) visitors to our websites, including rank.ai and app.rank.ai, and people who use our free tools, such as the AI grader and free audits; and (d) people at businesses we contact about our services. It does not cover third-party websites or services you link to.

2. Information we collect

• Account & Auth: name (optional), email, password hash or OAuth identifier.
• Connected Properties: domains, sitemaps, feeds, and CMS/project IDs you link.
• Operational Content: prompts/briefs, drafts and outputs we generate for you, publish logs, rollback snapshots.
• Technical Logs: device/browser type, IP address, timestamps, event logs (for security and diagnostics).
• Billing: handled by our payment processor; we do not store full card numbers.
• Support: messages you send us (e.g., email, chat) and related metadata.
• Website and ad interaction data: when you visit our websites, we and our advertising and analytics partners collect information through cookies, pixels, and similar tags, such as the Meta Pixel and Google tags. This includes a first-party visitor ID, the pages you view, the actions you take (such as running the AI grader, starting a free audit, or signing up), the site that referred you, UTM campaign parameters, ad click IDs (such as Google's gclid and Meta's fbclid), your IP address and approximate location, and device and browser details.
• Data from tools you use: what you submit to our free tools, such as the AI grader and free audits: the website or business you enter, your email address, and the report we produce.
• Business information from public sources: for B2B outreach, information about businesses and the people who work there, such as business name, website, address, phone number, work email, and job title, plus what a business publishes about itself, such as its website, listings, and reviews.

Your own site visitors: we do not place pixels or scripts on the websites you connect to collect your visitors' personal data for our own use. If you install our optional conversion pixel, it records the ad click ID and the conversion on your behalf and sends them to your connected Google Ads account.

3. How we collect

• Directly from you when you create an account, connect a site, configure settings, use our free tools, or contact support.
• Automatically through cookies, local storage, pixels, and similar tags, for login and sessions, analytics, and advertising (see section 5).
• From integrated services when you explicitly connect them (e.g., CMS APIs).
• From advertising platforms, which report how our ads performed and which ads led to visits or signups.
• From public websites, directories, and maps, and from business data providers, for B2B outreach.

4. How we use information

• Operate, secure, and maintain the Service (authentication, publishing, rollback, logs).
• Research topics and produce drafts with citations and media at your request.
• Communicate about your account, feature changes, and important updates.
• Troubleshoot, prevent abuse, and improve reliability and performance.
• Process billing and detect fraud.
• Respect your settings for scheduling, localization, and publishing.

We also use information for advertising and marketing:

• Showing you Rank.ai ads on other websites and platforms, such as Facebook, Instagram, and Google, including ads to people who visited our websites or used our tools (retargeting).
• Building advertising audiences. This includes uploading hashed contact details (email address, and where we have them, phone number, name and country) to Meta and Google so they can show our ads to you, find people similar to you (lookalike or similar audiences), or stop showing you ads you no longer need, for example once you are a customer.
• Measuring ad performance: which ads lead to visits, grader runs, signups, and purchases (conversion measurement).
• Contacting businesses about our services (B2B outreach) by email and other channels. This can include building a preview website, sample report, or AI grade for a business from publicly available information about it, to show what Rank.ai would do for that business.
• Sending marketing email about Rank.ai, such as product news and offers. You can opt out at any time (see section 10).

We do not use your prompts, drafts, or outputs to train public models unless you opt in. We may use anonymized, aggregated telemetry to improve features.

5. Cookies & similar technologies

• Essential cookies for login, sessions, and security.
• Analytics to count visits and see which pages and tools people use.
• Advertising tags, such as the Meta Pixel and Google tags, which let us and those platforms measure our ads, build audiences, and show you Rank.ai ads on other sites. The platforms may also use this data under their own privacy policies.
• A first-party attribution cookie that remembers how you first reached us (campaign parameters, ad click IDs, referring site, and landing page) for 90 days, so we can see which channels bring signups.

You can block or delete cookies in your browser, turn on Global Privacy Control, or use the options in your privacy choices. You can also manage ads in your Meta ad preferences and Google My Ad Center, or opt out of interest-based ads from many companies at optout.aboutads.info (US) and youronlinechoices.eu (EU and UK).

6. Sharing & disclosures

We share information with these categories of recipients:

• Advertising platforms, such as Meta (Facebook and Instagram), Google, and Reddit. They receive website and ad interaction data through their tags on our sites, conversion events we send from our servers, and hashed contact details when we build audiences.
• Email and outreach providers that send our product, marketing, and outreach email and handle replies and opt-outs.
• Hosting, infrastructure, and CDN providers, such as Vercel, Cloudflare, and our cloud hosting and database providers.
• Analytics providers that help us measure how our websites and product are used.
• AI model providers that research and write the content you ask for.
• Payment processors that handle billing.
• Business data providers that help us find and check business contact details for B2B outreach.
• Business Transfers: if we undergo a merger, acquisition, or asset sale, your information may transfer under this policy.
• Legal: when required to comply with law or protect rights and safety.

Our service providers act on our instructions and are bound by confidentiality and security obligations.

Hashing for audiences: before we upload contact details to build an audience (your email address, and where we have them your phone number, name and country), we hash each one with SHA-256 on our side. The platform receives only those one-way codes and matches them against its own users. We never send plain contact details for an audience upload.

No sale for money: we do not sell personal information for money. Some US state laws define "sale" and "sharing" broadly enough to include advertising tags and audience uploads, so we treat those as selling or sharing personal information for cross-context behavioral advertising (targeted advertising). You can opt out at any time in your privacy choices.

7. International data transfers

When information is transferred across borders, we use recognized safeguards (e.g., EU Standard Contractual Clauses) and require similar protections from our vendors.

8. Retention

• Account data: retained while your account is active; deleted or anonymized within 90 days after closure.
• Content and logs: retained per your workspace settings (default 180 days) or until you delete them.
• Billing records: kept as required by law (often 7 years).
• Website and ad interaction data: raw visit and event records are kept for up to 13 months, then aggregated or deleted so they no longer identify you. The first-party attribution cookie expires after 90 days.
• Advertising audiences: we refresh the lists we upload to ad platforms. When you opt out, we remove you from them within 15 business days.
• Free tool submissions and marketing and outreach records: kept for up to 24 months after our last interaction with you. If you become a customer, the account data rule above applies.
• Opt-out records: we keep a minimal record of opt-outs (such as your email address or its hash) for as long as we need it to honor your choice.
• Backups: time-limited and automatically purged.

9. Security

We use industry-standard safeguards (encryption in transit, access controls, auditing). No system is perfectly secure. You are responsible for protecting credentials and any API keys you provide.

10. Your rights & choices

Depending on your location, you may have rights to:

• Access, correct, or delete personal data;
• Receive a copy (portability);
• Object to or restrict certain processing;
• Withdraw consent where processing relies on consent;
• Opt out of the sale or sharing of your personal information and of targeted advertising;
• Opt out of marketing email at any time.

Requests: privacy@rank.ai We may verify your identity before fulfilling a request to access, correct, or delete data. We will not treat you differently for using your rights.

Your privacy choices (do not sell or share my personal information)

You can opt out of the sale or sharing of your personal information and of targeted advertising in any of these ways:

• Email us at privacy@rank.ai with the subject "Do not sell or share" and the email address you use with us. We will stop using your information for targeted advertising and remove you from the audience lists we upload to advertising platforms within 15 business days.
• Turn on Global Privacy Control (GPC). We treat a GPC signal from your browser as a valid request to opt out of sale, sharing, and targeted advertising for that browser, and for your account or email address when we can link them to it.
• Control cookies in your browser, or use the ad settings listed in section 5.

You do not need an account to opt out, and we will not ask you to prove your identity for an opt-out. An authorized agent can make the request for you.

Marketing email

Every marketing and outreach email we send includes a way to opt out. You can also reply "stop" to any of our emails, or email privacy@rank.ai. We will stop sending marketing email to that address and keep a minimal record so we do not contact you again. While you have an account, we will still send service messages, such as receipts and security notices.

Outreach to businesses

If we contacted your business and you do not want to hear from us, reply "stop" or email privacy@rank.ai. If we built a preview website or sample report for your business, ask us and we will take it down.

California and other US state notices

• Sale and sharing: in the past 12 months we have shared, and under some state definitions sold, identifiers (such as hashed email addresses, cookie and device IDs, and IP addresses) and internet activity (such as pages viewed, actions on our sites, and ad interactions) with advertising platforms such as Meta and Google, for cross-context behavioral advertising and targeted advertising. We do not sell personal information for money. To opt out, see your privacy choices.
• Categories we collect: identifiers; commercial information (plan and billing history); internet or other electronic network activity; approximate location from your IP address; professional information (business contact details and job titles); and the content you give us. We collect them from the sources in section 3, use them for the purposes in section 4, and disclose them to the recipients in section 6.
• Under 16: we do not knowingly sell or share the personal information of anyone under 16.
• Sensitive Data: We do not use sensitive personal information for purposes other than those permitted by law.
• Other states: if you live in a US state with a similar privacy law (such as Colorado, Connecticut, Virginia, Texas, or Oregon), you have the rights above, including the right to opt out of targeted advertising and sale. If we decline your request, you can appeal by replying to our decision or by emailing privacy@rank.ai with the subject "Appeal".

EEA and UK (GDPR and UK GDPR) legal bases

• Contract: to provide the Service you request.
• Legitimate interests: security, diagnostics, and product improvement; B2B marketing and outreach to business contacts; and analytics and advertising where the law allows them without consent. We balance these interests against your rights and keep the data we use to a minimum.
• Consent: where the law requires it, such as for non-essential cookies and advertising tags, and for marketing email where consent is required. You can withdraw consent at any time.
• Legal obligation: tax and compliance recordkeeping.

Your right to object to direct marketing: you can object at any time to our use of your personal data for direct marketing, including profiling related to it. When you object, we stop. Email privacy@rank.ai or reply "stop" to any of our emails. You can also object to processing based on legitimate interests, and you can complain to your local data protection authority.

11. Children

The Service is not directed to children under 16 (or the age required in your region). We do not knowingly collect data from children.

12. Third-party sites & integrations

Links and integrations are provided for convenience. Their privacy practices are their own; review their policies before enabling integrations or following links.

13. Changes to this policy

We will post updates here and revise the Effective Date. If changes materially affect your rights, we will provide an in-app notice or email where appropriate.

14. Contact us

Questions or requests about privacy:

Email: privacy@rank.ai

Mailing Address: 131 Continental Dr, Suite 305, Newark DE 19713, United States