Privacy Policy

1. Scope of This Privacy Policy

This Privacy Policy applies to personal data we process when you:

• visit rankauto.ai or use the Rankauto application;
• create or use a Rankauto account;
• start a trial or purchase a subscription;
• connect a website, content management system, integration, or third-party account;
• generate, edit, audit, or publish content through Rankauto;
• communicate with us or request support; or
• otherwise interact with the Service.

This Privacy Policy does not govern websites, platforms, or services operated independently by third parties. Their own terms and privacy policies apply to their processing activities.

2. Personal Data We Collect

We collect personal data directly from you, automatically through your use of the Service, from websites and services you connect, and from service providers that support our operations.

2.1 Account and contact information

When you create an account or contact us, we may collect:

• your name;
• email address;
• company or business name;
• job title or role, where provided;
• account and workspace identifiers;
• support requests and other communications; and
• information received from Google or another sign-in provider when you choose that sign-in method.

Rankauto may use passwordless authentication, such as magic links, or third-party authentication. Where passwordless authentication is used, we do not ask you to create a Rankauto password.

2.2 Business and website information

When you connect or submit a website, we may collect:

• the website URL and domain;
• the business name, location, market, industry, products, services, and target audience;
• competitor names and URLs that you provide;
• information about your products, services, positioning, and marketing objectives; and
• other information you provide during onboarding or through account settings.

2.3 Information obtained from connected websites

To provide keyword research, audits, content generation, and publishing functions, Rankauto may crawl or read publicly accessible pages on websites you submit or connect. We may extract and retain information such as:

• page text and metadata;
• headings, links, images, and site structure;
• information about products, services, pricing, and business positioning;
• technical SEO information;
• site performance, indexing, and ranking information; and
• summaries or business-context documents generated from this information.

You must have the right to submit or connect a website to the Service. You must not use Rankauto to access private, restricted, or third-party information without authorization.

2.4 Content and brand settings

We collect the information you submit to configure and use Rankauto, including:

• prompts, instructions, keywords, and article topics;
• tone of voice and brand guidelines;
• preferred, required, or prohibited words;
• calls to action, product information, and offers;
• generated articles, images, drafts, edits, and publishing schedules;
• audit settings and results; and
• feedback you provide about generated content.

2.5 Integration and publishing information

When you connect a content management system or another integration, we may process:

• API keys;
• OAuth tokens;
• webhook secrets;
• site identifiers;
• publishing permissions; and
• information returned by the connected platform.

We use these credentials only to provide the requested integration and publishing functions. We apply technical safeguards intended to protect stored credentials, including encryption where appropriate.

2.6 Payment and subscription information

Subscription payments are processed by Stripe or another payment provider identified at checkout. We may receive and store:

• your billing name and billing contact details;
• billing country;
• subscription plan and status;
• payment status and transaction identifiers;
• limited payment-method details, such as card brand and last four digits; and
• invoices, refunds, and payment history.

We do not receive or store complete payment-card numbers or card security codes. Those details are processed by the payment provider under its own privacy policy.

2.7 Usage, device, and log information

When you visit or use the Service, we may automatically collect:

• IP address;
• device and browser type;
• operating system;
• dates and times of access;
• pages and features viewed or used;
• referral URLs;
• actions performed within the Service;
• generation, audit, publishing, and usage records;
• error reports and diagnostic information; and
• security and fraud-prevention signals.

3. How We Use Personal Data

We may use personal data to:

• create, authenticate, secure, and administer your account;
• provide keyword research, website analysis, SEO and GEO audits, content generation, optimization, and publishing;
• learn and apply your brand settings and business context;
• operate connected integrations and publish content at your direction;
• process subscriptions, payments, invoices, refunds, and account changes;
• enforce trial, plan, site, article, and audit limits;
• send transactional messages, including sign-in links, account notifications, publishing updates, billing notices, and security alerts;
• respond to questions, feedback, and support requests;
• monitor, maintain, troubleshoot, and improve the Service;
• understand feature usage and product performance;
• detect, investigate, and prevent fraud, misuse, security incidents, and violations of our Terms and Conditions;
• comply with legal, tax, accounting, and regulatory obligations;
• establish, exercise, or defend legal claims; and
• carry out another purpose disclosed to you when the information is collected.

We will obtain consent where applicable law requires consent for a particular processing activity. Where processing is necessary to provide a service you requested, withdrawing consent may prevent us from providing that part of the Service.

4. AI and Automated Processing

Rankauto uses artificial intelligence models and third-party data services to provide research, writing, image generation, optimization, auditing, and related functions.

Depending on the feature you use, relevant portions of your submitted information, business context, prompts, keywords, drafts, or other content may be sent to providers such as:

• Anthropic, for language-model processing, article generation, editing, analysis, or fact-checking assistance;
• OpenAI, for language-model or image-generation functions where enabled;
• DataForSEO, for keyword, search-ranking, search-results, and on-page audit data; and
• Pexels, for stock photography where that image option is selected.

We limit the information sent to these providers to what is reasonably needed to perform the requested function. Their processing is governed by our applicable agreements with them and their own privacy and security commitments.

Rankauto may use automated systems to generate recommendations, drafts, scores, classifications, and audit results. These outputs assist with content and marketing decisions but may be incomplete or inaccurate. You should review important outputs before relying on or publishing them.

We do not use your private content to train a general-purpose Rankauto model unless we first obtain your express permission. We may use aggregated or de-identified usage information to operate, evaluate, and improve the Service, provided that the information does not reasonably identify you or your business.

5. How We Disclose Personal Data

We do not sell your personal data. We may disclose personal data to the following categories of recipients when reasonably necessary:

5.1 Infrastructure and technology providers

Providers such as Vercel, Supabase, and Railway may process information to provide hosting, databases, authentication, storage, networking, and application infrastructure.

5.2 Payment providers

Stripe or another payment provider may process billing and payment information to complete transactions, manage subscriptions, prevent fraud, and comply with financial regulations.

5.3 AI, search, and content-data providers

Providers such as Anthropic, OpenAI, DataForSEO, and Pexels may process information as described in Section 4.

5.4 Communications and operational providers

Providers such as Resend may process contact information to deliver transactional emails. Providers such as Sentry may process diagnostic and error information to identify and resolve technical issues.

5.5 Connected platforms

When you connect WordPress, Shopify, Wix, Webflow, Framer, a webhook, or another platform, we disclose content and related information to that platform as necessary to perform the action you request.

5.6 Professional advisers

We may disclose information to accountants, auditors, insurers, legal advisers, and other professional advisers where reasonably necessary for their services.

5.7 Authorities and legal recipients

We may disclose information when we reasonably believe disclosure is required by law, legal process, court order, or a lawful request from an authority, or when necessary to protect rights, safety, property, and the integrity of the Service.

5.8 Business transfers

If Rankauto is involved in a merger, financing, acquisition, restructuring, sale of assets, or transfer of the business, information may be disclosed to relevant parties as part of that transaction, subject to appropriate confidentiality protections.

6. Team Accounts

An account owner may invite team members to a Rankauto workspace. Depending on their assigned permissions, team members may be able to view and manage websites, keywords, drafts, articles, settings, integrations, audit results, usage information, and the names or email addresses of other members.

The account owner is responsible for deciding who has access, assigning appropriate permissions, and removing access when it is no longer required.

If your account is provided by an employer, client, or another organization, that organization may control the workspace and the information within it. Questions about the organization's use of your information should also be directed to that organization.

7. Cookies and Similar Technologies

We use cookies and similar technologies that are necessary to operate and secure the Service. These may include:

• authentication cookies that keep you signed in;
• security cookies used to prevent abuse and unauthorized access;
• preference cookies that remember selections such as the website or workspace you last viewed; and
• limited analytics technologies used to understand performance and feature usage, where implemented and permitted by law.

If we introduce non-essential advertising, cross-site tracking, or similar technologies, we will update this Privacy Policy and request consent where required.

Disabling necessary cookies may prevent you from signing in or using parts of the Service.

8. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Service, maintaining security, resolving disputes, and meeting legal, tax, accounting, and reporting obligations.

Our expected retention periods include:

• account information is generally retained while your account is active and for a reasonable period after closure;
• when you remove a website from your account, related data may be retained for up to six months to support restoration, after which it will be deleted or de-identified unless longer retention is legally required;
• deleted article drafts may be retained for up to seven days to support recovery, after which they will be deleted from active systems;
• billing, transaction, tax, and accounting records may be retained for the period required by applicable law; and
• backups, security logs, and fraud-prevention records may remain for a limited period according to our backup and security cycles.

Deletion from backup systems may not occur immediately. Information retained in backups will remain protected and will not be restored except where necessary for disaster recovery, security, or legal compliance.

9. Security

We use reasonable administrative, organizational, and technical safeguards designed to protect personal data, including access controls, encryption in transit, encryption or equivalent protection for appropriate stored data, credential protection, logging, and restricted administrative access.

No system or transmission method is completely secure. We therefore cannot guarantee absolute security. You are responsible for protecting access to your email account, Google account, devices, integrations, and any credentials used with Rankauto.

If a personal data breach occurs, we will investigate and provide notifications to affected individuals and relevant authorities where required by applicable law.

10. Your Rights and Choices

Subject to applicable law and any permitted exceptions, you may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• withdraw consent where processing is based on consent;
• object to or request that we stop certain processing;
• request deletion of personal data where applicable;
• request a portable copy of personal data where the right to data portability applies;
• opt out of marketing communications; and
• lodge a complaint with the Personal Data Protection Commissioner of Malaysia or another competent authority.

You may update certain information through your account settings. To exercise another right, contact us at support@rankauto.ai. We may ask you to verify your identity and authority before completing a request.

Some requests may be limited or refused where permitted by law, including where information must be retained for security, fraud prevention, contractual, legal, tax, or accounting reasons. If you withdraw consent that is necessary for a requested feature, we may be unable to continue providing that feature.

11. International Data Transfers

We are registered in Malaysia, and our service providers may operate or store information in Malaysia, the United States, and other countries. As a result, personal data may be transferred to and processed outside Malaysia or outside the country where you live.

Where personal data is transferred outside Malaysia, we take reasonable steps to comply with Section 129 of the PDPA and other applicable requirements. Depending on the circumstances, these steps may include contractual protections, security assessments, obtaining consent where appropriate, or relying on another legally recognized condition for the transfer.

Countries receiving personal data may have different data-protection laws from your country. Regardless of processing location, we require service providers to protect information in accordance with their contractual obligations and applicable law.

12. Children's Privacy

Rankauto is intended for businesses and individuals who are at least 18 years old. The Service is not directed to children, and we do not knowingly collect personal data from anyone under 18.

If you believe a child has submitted personal data to Rankauto, contact us at support@rankauto.ai so that we can investigate and take appropriate action.

13. Third-Party Links and Services

The Service may contain links to third-party websites or allow you to connect third-party platforms. We do not control those third parties and are not responsible for their privacy, security, or content. Review their privacy policies before providing information or connecting an account.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Service, our processing practices, or applicable law. When we update it, we will revise the "Last updated" date at the top.

If a change materially affects how we use personal data, we will provide additional notice where appropriate, such as through the Service or by email. Where applicable law requires consent for a new processing purpose, we will request that consent.

15. Contact Us

Questions, concerns, complaints, and requests relating to this Privacy Policy or your personal data may be sent to:

Rankauto
Email: support@rankauto.ai

Rankauto is operated by OutSpace Studio (Business Registration No. 202603250620 (AS0522077-D)).