Cookie Policy

What this policy covers

This Cookie Policy explains how ALIM LTD, trading as RankX AI, uses cookies and similar technologies on the marketing site at rankxai.com and in the application at app.rankxai.com. It sits alongside the Privacy Policy, which covers everything else we do with personal data.

It is deliberately specific. A cookie policy that describes cookies in general, rather than the ones the site actually sets, tells a reader nothing they can act on, so every entry below names a real cookie you can find in your browser’s developer tools.

What cookies and similar technologies are

A cookie is a small text file a website asks your browser to store and send back on later requests. It lets a site recognise the same browser between page loads, which is how you stay signed in.

Similar technologies do a comparable job by other means, and the law treats them the same way. The ones relevant here are local storage, which holds data in the browser until it is cleared, and session storage, which is discarded when the tab closes. Where this policy says “cookies” it means all three.

First-party means set by the site you are looking at. Third-party means set by a different domain whose code the page loads. Session cookies expire when you close the browser; persistent cookies last for a stated period.

The short version

• No advertising cookies anywhere. Not on the marketing site, not in the application. We run no retargeting, no ad pixels and no social media trackers.
• Google Tag Manager on the marketing site, only if you allow it. The public site can load a Google Tag Manager container, which is a loader: it runs measurement tags that set their own cookies, typically Google Analytics. It is not loaded until you permit a category on the consent banner, so refusing means no request to Google is ever made. Section 8 explains the choices and how to change them. [TODO: confirm with counsel which tags are enabled in the container and name them here.]
• Security cookies on both, set by Cloudflare. These are strictly necessary and are how a free tool survives being pointed at by a botnet.
• In the application: one sign-in cookie and one analytics cookie. The sign-in cookie is strictly necessary. The analytics cookie is not, and section 8 is honest about the consent control we have not built for it yet.

Cookies on rankxai.com

The marketing site sets no cookie of its own. The entries below are set by Cloudflare, which serves the site and protects it, and every one of them is strictly necessary within the meaning of PECR regulation 6(4), so none requires consent.

The free tools themselves store nothing in your browser. A tool result is cached on our servers for a day against a hash of the website address you submitted, which is a fact about a public website and not about you. That is described in section 9 of the Privacy Policy.

Cookies in the application at app.rankxai.com

The application is behind a sign-in, so it necessarily stores more. The Cloudflare entries in section 4 apply here too and are not repeated.

What RankX AI does not use

Stating the absences is more useful than describing categories we do not have. We do not use:

• advertising, retargeting or conversion-tracking cookies of any kind, including Google Ads, Meta, LinkedIn and X pixels;
• social media sharing widgets that set cookies, and there are no embedded social feeds on either property;
• cross-site tracking, device fingerprinting for advertising, or data brokers;
• session recording, heat mapping or mouse tracking;
• data brokers, and any sale or sharing of what these cookies record.

How to control cookies in your browser

Every browser lets you see stored cookies, delete them, block them from specific sites, or block them entirely. Blocking strictly necessary cookies will sign you out of the application and may cause the security layer to challenge you repeatedly; blocking the analytics cookie has no effect on anything you can see.

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge

To block the product analytics cookie specifically while leaving sign-in working, block the domain eu.i.posthog.com in your browser settings or in a content blocker. Most content blockers already do this by default.

Consent, and how to change your mind

Under the Privacy and Electronic Communications Regulations, storing information on your device requires your consent unless it is strictly necessary to deliver a service you asked for. Consent must be a positive action, must not be inferred from inactivity or a pre-ticked box, and must be as easy to withdraw as it was to give.

On the marketing site we ask before anything non-essential loads. A banner appears on your first visit with three choices: accept everything, reject everything, or open the preferences and decide category by category. Accept and reject sit side by side, at the same size, and both are one click away on the first screen. Nothing is pre-ticked, and closing the page without choosing is not treated as agreement.

Refusing genuinely stops it. Google Tag Manager is not loaded at all until you permit a category, so if you reject, or simply never answer, your browser makes no request to Google from this site. Strictly necessary security cookies still apply, because those are exempt and the site cannot run without them.

To change your answer at any time, use the Cookie settings link at the foot of every page. It reopens the same panel showing what you chose last time, and withdrawing is exactly as easy as granting was. Your choice is stored in your browser rather than in a cookie, so clearing site data resets it and you will be asked again.

Third-party pages you may be sent to

Two flows hand you over to another company’s page. Their cookies are set on their domain, under their policy, and we cannot read them.

• Stripe Checkout and the billing portal. When you pay or manage a subscription, you are on a Stripe page. Stripe sets its own cookies for fraud prevention and session management. See the Stripe privacy policy.
• Google’s consent screen. When you connect Search Console or Analytics, the permission screen is Google’s own page and Google sets its own cookies there. See the Google privacy policy.

Links from our blog or documentation to other websites are ordinary links. Following one takes you outside our control, and the site you land on has its own cookie practices.

Do Not Track and Global Privacy Control

Do Not Track never became a standard, browsers have largely removed it, and there is no agreed meaning for a site to honour. We do not respond to it, and no site that tells you it does can explain what it is responding to.

Global Privacy Control is a different matter: it is a legally recognised opt-out signal in several jurisdictions, and it means “do not sell or share my personal information”. We do not sell or share personal information for advertising in any case, as set out in section 17 of the Privacy Policy, so there is nothing for the signal to switch off. It changes nothing about what we do because there was nothing to change.

Changes to this policy, and how to ask us about it

We update this policy whenever a cookie is added, removed or changes purpose, and when the consent control described in section 8 ships. The date at the top of this page is the date of the current version.

If you find a cookie on either property that is not listed here, we want to know, because it means either a provider changed something or this page has fallen out of date. Email [email protected] and we will check it and correct the page.