Privacy Policy

Introduction

This privacy policy explains how we collect, use, and protect your personal data when you use RankingIQ. It applies to anyone who visits the site, creates an account, or subscribes to a paid plan.

Who we are

RankingIQ is operated by Aptflow Ltd, a company registered in England and Wales (company number 17236387), with registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.

We are the data controller for the personal data described in this policy. We are registered with the Information Commissioner’s Office under registration number ZC154360.

Data we collect

Account information

• Email address
• Name (if provided)
• Payment information (processed securely via Stripe; we do not store card details)
• Marketing consent preference (if given at signup)

Your website and searches

• The website address you add, and the content of its publicly reachable pages, which we read to generate advice
• The searches you choose to track, and the competitor domains you name
• Search positions we observe for those searches over time
• Changes you record having made, and the dates you record them

Usage data

• Login times, IP address, and activity logs
• Browser type and device information
• Pages visited and interactions with the platform

Lawful basis for processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:

• Contract performance: processing required to provide the service you have signed up for, including reading your website, checking positions, generating advice, and processing payments
• Legitimate interests: security, fraud prevention, service improvement, and protecting our business interests, balanced against your rights
• Consent: marketing emails, where you have opted in
• Legal obligation: retaining payment records for tax and accounting purposes

How we use your data

• To check where your website appears in search results and keep the record of it
• To read your pages and generate advice about what to change
• To send service emails, including alerts you have turned on
• To process payments and manage subscriptions
• To improve our platform and user experience
• To send marketing emails where you have consented
• To comply with legal obligations

Personal data on your website

To generate advice, we read the publicly reachable pages of the website you add. Those pages may contain personal data that you or others have published there, such as names, job titles, or contact details on an about or team page.

We process that content because it is the service: the advice is generated from what your pages say. By adding a website, you confirm you are authorised to manage it and to have its public content processed in this way. We do not use your website’s content for any purpose beyond providing the service to you.

Competitor domains you name are observed only as they appear in public search results: their positions, titles, and descriptions. We do not crawl or read competitor websites.

AI processing

Advice is generated using an AI model provided by Anthropic. To produce it, we send the model your tracked searches, observed positions, public search results for those searches, and the content of your website’s pages, which may include personal data published on them as described above.

We do not send your account data (your name, email address, or payment information) to AI providers.

Marketing emails

We send marketing emails only to users who have actively opted in at signup or through their account settings. You can withdraw consent at any time by:

• Clicking the unsubscribe link in any marketing email
• Toggling marketing preferences on your account page
• Emailing support@ranking-iq.co.uk

Withdrawing marketing consent does not affect transactional emails (account notifications, payment receipts, alerts you have turned on), which we send as part of providing the service.

Cookies and analytics

We use the following cookies and similar technologies:

Strictly necessary

• Authentication and session management
• Security and fraud prevention

These cookies are required for the service to function and cannot be disabled.

Analytics

We use Google Analytics to understand how visitors use the platform so we can improve it. Google Analytics sets cookies that track page views, session duration, and traffic sources. Analytics cookies are loaded only after you accept them via our cookie banner. You can withdraw consent at any time by clearing your cookies or using the cookie controls on the site.

We do not use advertising cookies or sell data to advertisers.

Data sharing

We do not sell your personal data. We share data only with the following processors:

• Stripe: payment processing and subscription management
• Supabase: database hosting and authentication
• Resend: transactional and marketing email delivery
• Anthropic: AI advice generation via the Claude API, as described in AI processing above
• DataForSEO: retrieval of public Google search results for the searches you track (your searches are sent; your account data is not)
• Firecrawl: reading the publicly reachable pages of the website you add
• Google Analytics: usage analytics (with your consent)
• Vercel: hosting and infrastructure

All third-party processors are bound by data processing agreements and handle data in accordance with UK GDPR requirements.

International transfers

Some of our processors are based outside the UK. In particular, Anthropic processes data in the United States, and DataForSEO, Google, and Vercel may process data in multiple regions including the US.

Where personal data is transferred outside the UK, we rely on appropriate safeguards including UK Standard Contractual Clauses (the UK International Data Transfer Agreement or Addendum) and the adequacy decisions made under UK GDPR. Copies of these safeguards are available on request.

Data retention

We retain your data as follows:

• Account data: until account deletion, then purged within 30 days
• Site content, rankings and advice history, where a free trial ended without a subscription: 30 days from the end of the trial, then deleted automatically
• Site content, rankings and advice history, for all other accounts: 24 months after last account activity
• Payment records: 7 years (statutory requirement)
• Marketing consent records: until withdrawn, plus 12 months for evidence

The deletion that follows an expired trial happens on its own and needs no request from you. Your sign in survives it, so you can come back and start again, but the searches we were watching, the positions we recorded and the record of what you changed are removed and cannot be restored.

Your rights under UK GDPR

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request data deletion (right to erasure)
• Export your data (data portability)
• Object to data processing
• Restrict processing in certain circumstances
• Withdraw consent at any time (for processing based on consent)
• Lodge a complaint with the Information Commissioner’s Office (ico.org.uk)

To exercise any of these rights, contact us at support@ranking-iq.co.uk. We will respond within 30 days.

To delete your account, email support and we will purge your data within 30 days. Payment records are retained for 7 years regardless, as required by UK financial regulations.

Automated decision-making

RankingIQ uses automated processing to check search positions, score websites, and generate advice. These outputs are about your website, not about you as a person.

We do not make automated decisions about you that produce legal or similarly significant effects on you. Your interactions with the service do not result in automated decisions about your access, pricing, or treatment.

Security

We use industry-standard security measures including encryption at rest and in transit, row-level access controls, and secure authentication. No internet transmission is 100% secure, but we take all reasonable steps to protect your data.

Data breach notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of the breach, and notify affected users without undue delay where the risk is high.

Changes to this policy

We may update this privacy policy periodically. Changes will be posted on this page with an updated revision date. Material changes will be communicated via email.

Contact us

Questions about this privacy policy or how we handle your data?
Email: support@ranking-iq.co.uk