Written by engineers as a starting point for an attorney, not by an attorney. It reflects how the product actually works, which is the useful half of the job — but it has not been reviewed for enforceability, jurisdiction, or consumer-protection law anywhere. Do not launch against it.
Last updated 21 August 2026
Account data — email, name, and an avatar if your identity provider supplies one.
Search Console and Bing Webmaster data — for properties you explicitly connect: queries, clicks, impressions, average position and page URLs. This is the substance of the product.
Product data — keywords you track, articles you generate, marketplace orders, credit ledger entries.
Technical data — server logs and error reports. Signup IP addresses are stored hashed with a secret salt, never in the clear: we need to correlate suspicious signups, and that does not require the ability to reconstruct where you were.
RankVault’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Concretely, we request webmasters.readonly — read-only access to Search Console properties you already own and have verified with Google. We use it to display your own performance data back to you, and to compute the decay, cannibalization and AI-visibility analyses that are the product.
We do not sell this data, transfer it to third parties except the subprocessors below acting on our instructions, use it for advertising, or use it to train generalised AI models. Human access is limited to what you explicitly authorise for support, which is time-boxed to 30 minutes and recorded in an append-only audit log.
Disconnecting a property from Settings deletes the stored OAuth tokens immediately. You can also revoke access at myaccount.google.com/permissions.
OAuth tokens, WordPress application passwords and two-factor secrets are encrypted with AES-256-GCM before they reach the database, and the encrypted columns are additionally unreadable by the application role. Every table enforces row-level security, so one customer’s query cannot return another’s rows even if the application asks for them.
Product data is kept while your account is open. Detailed query-level snapshots are pruned after 90 days; uptime checks after 30. Ledger entries are kept indefinitely — they are financial records, and an account closing does not make its history disposable.
On deletion we soft-delete immediately and hard-delete after 30 days. That window is a recovery period for deletions requested in error or maliciously. Ledger entries survive in anonymised form because the books must still balance.
Under GDPR and CCPA you can access, correct, export or delete your data, and object to processing. Export and deletion are self-service in Settings; there is no wait for a support queue.
For a Data Processing Agreement, email privacy@rankvault.io.
| Processor | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Database, authentication, file storage | All account and product data | EU / US (project region) |
| Railway | Application and worker hosting | Transient request data, logs | US |
| Stripe | Card payments and publisher payouts | Billing details, payment methods | US / global |
| Anthropic | Content research and drafting | Prompts you submit, article drafts | US |
| DataForSEO | SERP, keyword volume and backlink data | Keywords and domains you track | EU / US |
| Moz | Domain authority and spam score | Domains submitted for lookup | US |
| Resend | Transactional and lifecycle email | Email address, message content | US / EU |
| Sentry | Error monitoring | Stack traces, user id only | US / EU |
We set one cookie: your authentication session. It is strictly necessary to keep you signed in, so there is no consent banner — because there is nothing to consent to. We run no advertising or third-party analytics trackers.
If that ever changes — if a marketing pixel or product analytics tool is added — a consent banner becomes mandatory in the EU and this section must be rewritten first. Adding the tracker first and the banner later is the common and expensive mistake.
privacy@rankvault.io. EU/UK representative details and the identity of the data controller must be added here before launch — both are required disclosures.