Privacy Policy

Who we are and how to reach us

RankX AI is a search and AI-answer visibility platform operated by ALIM LTD, a company registered in England and Wales with company number 14528810 and based in Leeds, United Kingdom. This policy covers the marketing site at rankxai.com, the application at app.rankxai.com, the free tools, the API and the Model Context Protocol server.

Data controller

ALIM LTD, trading as RankX AI

Registered office

[TODO: registered office address]

Privacy contact

[email protected]

ICO registration

[TODO: ICO registration number]

We are not required to appoint a Data Protection Officer under UK GDPR Article 37 and have not appointed one. Privacy questions, data subject requests and complaints all go to the address above and are handled by the company’s directors.

The two roles RankX AI plays, and why the difference matters

Read this section before any other. Which rules apply to a given piece of personal data depends entirely on which of two roles we are in when we handle it.

• We are the controller of your relationship with us. Your name, work email, company, billing records, support correspondence, and how you use the platform. We decide why and how that data is processed, and the rest of this policy describes it.
• We are a processor of the data you put into the platform. When you add a client, connect a website, sync Google Search Console or generate content, any personal data inside that material is processed on your instruction and for your purposes. You are the controller. Our obligations to you are the Data Processing Agreement, which applies automatically and needs no signature.

The practical consequence: if an individual whose personal data appears inside a customer’s workspace asks us to delete it, we will not act unilaterally. We refer them to that customer, who is the controller, and we assist that customer in responding. If you are that individual and you do not know who the controller is, write to [email protected] and we will pass your request on.

What personal data we collect

We collect the following, and nothing beyond it. Where a category is marked as optional, the platform works without it.

We do not deliberately collect special category data (health, beliefs, biometrics and the rest of the Article 9 list) or criminal offence data, and the platform has no feature that asks for it. Please do not put it into a workspace.

Why we use it, and our lawful basis for each purpose

Where we rely on legitimate interests we have balanced those interests against your rights and concluded that the processing is necessary, proportionate and within what you would reasonably expect. You can object to any of it at any time, and we will stop unless we have compelling grounds that override your objection. Write to [email protected].

Google Search Console and Google Analytics

RankX AI connects to Google Search Console and Google Analytics 4 so that your own search and traffic data appears alongside the AI visibility and ranking data the platform collects. The connection is optional, read-only, made through Google OAuth 2.0, and scoped to the single property you choose per project. This section is the complete account of what we access, why, where it goes and how to get rid of it.

What Google user data we access

We request the narrowest scopes that support the features we ship. We do not request any read and write scope, and we do not request any scope for a product the platform does not use.

Google Analytics report data is aggregated by Google before we receive it. We do not request, receive or store user-level identifiers, client IDs, user IDs or advertising identifiers from Google Analytics.

How we use it

Google user data is used only to provide and improve the user-facing features listed above, all of which are prominent in the RankX AI interface. Concretely, that means we:

• display your search and traffic figures in the dashboards of the project the property is connected to;
• combine them with data the platform collects itself (rankings, AI Overview presence, AI assistant citations, audit findings) so that one page can show what changed and what it coincided with;
• derive the recommendations, opportunities and tasks the platform surfaces to you, such as pages losing clicks or queries where you rank on the second page;
• include the figures in reports you generate or export.

We do not: use Google user data for advertising or for targeting; sell it or transfer it to a data broker, an advertising platform or an information reseller; use it to determine credit-worthiness or for lending purposes; or use it to develop, train, retrain or fine-tune any generalised artificial intelligence or machine learning model. Google user data is never included in the material sent to the AI model providers described in section 11.

Humans do not read your Google user data. Our staff can access it only where you have given specific permission (for example when you ask us to investigate a problem in your account), where it is necessary for security purposes or to comply with the law, or where the data has been aggregated and anonymised for internal operations. That access is limited to the smallest number of people who need it and is logged.

How we store and protect it

• Credentials. The OAuth refresh token is encrypted with AES-256-GCM before it is written, and stored in a table that is reachable only by the server using a privileged database role. Row level security is enabled on that table with no policies at all, so the application’s ordinary authenticated and anonymous roles have no path to it. Tokens are never sent to the browser and never appear in logs. Access tokens are short-lived and held in memory for the request that needs them.
• Synced report data. Stored in our primary database in the European Union, encrypted at rest and in transit, partitioned by project and protected by row level security so that one customer cannot reach another’s rows.
• Transport. All traffic between us and Google APIs, and between you and us, is over TLS.
• Authorisation. The OAuth flow runs entirely server side. The connection is scoped to one project, and only members of your account with the right role can connect, disconnect or change the selected property.

Who we share it with

We do not sell Google user data, and we do not transfer it to anyone except as needed to provide or improve the features you are using. In practice the only third parties that touch it are the infrastructure providers that host and store the platform itself: our cloud host and our database provider, both listed on the sub-processor page. They process it under contract, on our instructions, and for no purpose of their own. We may also disclose it where the law requires it, or where it is necessary to protect against fraud, abuse or a security threat. If our business is ever sold or merged, any transfer of Google user data will be made only with your explicit prior consent.

How long we keep it, and what happens when you disconnect

Disconnecting deletes the data, not just the link. You can disconnect either integration at any time from project settings in the platform. When you do, in a single operation we: revoke the token with Google, delete the stored credential, clear the selected property, mark the integration disconnected, and purge every row of Search Console or Google Analytics data we had synced for it. The same teardown runs automatically on a lapsed connection and when an account is closed.

You can also revoke our access directly with Google at any time, at myaccount.google.com/permissions. Doing so stops any further access immediately; to have the data we already hold deleted as well, disconnect in the platform or email [email protected] and we will action it within 30 days.

Google API Services User Data Policy and Limited Use

Our use of Google user data is limited to the practices disclosed in this policy. If we ever want to use it for a purpose not described here, we will update this policy and ask for your consent first.

The WordPress integration

Connecting a WordPress site lets RankX AI read what is published there and, where you ask it to, write to it. Unlike the Google integrations this one is read and write, so it is worth understanding exactly what it can reach.

How the connection is made. You create a WordPress application password for a user on your site and give it to us, choosing one of three scopes at the time you do so. The scope is fixed when the credential is issued and cannot be widened later without issuing a new one.

What we do with it. We read content so the platform can audit it, brief against it and suggest improvements. We write only when you instruct a write, and every write is verified by reading the object back and comparing it. Every write is recorded in an append-only log on your account showing what changed, when and by whom.

How the credential is stored. Encrypted at rest with AES-256-GCM, in the same protected store as the Google tokens described in section 5, never returned to the browser and never logged.

Revoking it. Disconnect the site in the platform, which deletes the stored credential. You can also revoke the application password from your WordPress user profile at any time, which stops access immediately whatever we hold. Content we previously read stays in your workspace until you delete the project or close the account.

Google Business Profile

Google Business Profile appears in the integrations area of the platform as a planned connection. It is not built, it cannot currently be connected, and no RankX AI product requests any Google Business Profile permission or accesses any Google Business Profile data today. The scopes listed in section 5 are the only Google scopes we request.

We are describing it here rather than staying silent because you can see the entry in the interface, and an unexplained integration card is exactly the kind of thing a privacy notice should account for.

If and when the integration ships, it will follow the same pattern as the Google integrations already described: an explicit, optional connection you initiate; the narrowest read-only scope that supports the feature; server-side OAuth with the refresh token encrypted at rest; use limited to user-facing features in your own dashboard; no sale and no transfer beyond our infrastructure sub-processors; and deletion of the synced data on disconnect. This policy will be updated with the exact scopes and data before the connection is made available, and the change will be notified as described in section 20.

Personal data you put into the platform about other people

Agencies, and any customer analysing a site that is not their own, put personal data about other people into the platform. Client contact details, the names of people who appear in a WordPress user list, buyers in WooCommerce order data, and individuals identifiable in search or analytics data are the common cases.

For all of it, you are the controller and we are your processor. We process it only on your documented instructions, which are the instructions implied by your use of the features. The full terms, including our confidentiality obligations, security measures, breach notification commitments, the assistance we give with data subject requests, sub-processor rules and what happens on deletion, are in the Data Processing Agreement.

You are responsible for having a lawful basis for that data, for telling the individuals concerned what is happening to it, and for having the authority to connect the accounts and websites you connect on your clients’ behalf.

Marketing, newsletters and the free tools

The free tools on rankxai.com run without an account and without an email address. When you submit a website address we record the address itself and a one-way hash of your IP address, used solely to stop one visitor from exhausting the tool for everyone else. Results are cached for a day, keyed by a hash of the website address, and contain no information about you. We do not build a profile from tool usage.

If you choose to have a report emailed to you, or to subscribe to the newsletter, we record your email address and any name you give. Those are two separate consents and we record them separately, each with its own timestamp, the page you gave it on and the IP address you gave it from, because that record is the evidence if a consent is ever challenged. Asking for a report does not subscribe you to anything.

Every marketing email carries an unsubscribe link. Unsubscribing adds your address to a suppression list, which we keep indefinitely: we have to remember that you opted out in order to honour it, and deleting the record would be the surest way to email you again by mistake. That list holds an email address, a reason and a date, and nothing else.

Existing customers may receive occasional emails about closely related features under the PECR soft opt-in, with an unsubscribe link in every one. Service emails, such as sign-in codes, billing notices and usage alerts, are part of the service and are not marketing, so unsubscribing from marketing does not stop them.

Cookies and similar technologies

The marketing site at rankxai.com sets no analytics cookies and no advertising cookies of its own. The only cookies you may meet there come from our CDN and bot-protection layer and are strictly necessary for security.

The application at app.rankxai.com sets a strictly necessary cookie to keep you signed in, and a product analytics cookie used to understand how features are used. Every cookie in use, its provider, its purpose and its lifetime is listed in the Cookie Policy, together with an honest account of the consent controls that exist today and the one that does not yet.

AI model providers, and what is sent to them

Several features send text to third-party large language models: the AI visibility checks, brand and competitor research, content generation and the assistant that helps you write tasks. It is worth being precise about what leaves the platform.

• What is sent. The prompt or brief in question, the brand and competitor context you have configured, and any source material you supply or ask us to fetch.
• What is not sent. Your account credentials, your billing data, your integration tokens, and Google user data obtained through the Search Console or Analytics APIs.
• AI visibility checks are deliberately unpersonalised. A tracked prompt is sent as a neutral question, exactly as an ordinary user would ask it, because personalising it would measure something other than what a real user sees.

Most model calls are routed through OpenRouter, which forwards them to the underlying provider. Every provider we use is named on the sub-processor page with its location. We select providers on terms that exclude the use of our traffic to train their models, and we do not send personal data to a model provider where the feature can work without it. Do not paste personal data about identifiable individuals into a prompt or a brief unless you have a lawful basis for it and are content for it to be processed as described here.

Who else sees your data

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not rent or trade mailing lists. We share it only in these circumstances:

• Sub-processors. The hosting, database, storage, payment, email, analytics, search data and AI providers we use to run the platform. Each one is named, with its purpose and location, on the sub-processor page. Each is bound by a written contract, processes only on our instructions, and is subject to appropriate transfer safeguards.
• Within your own account. Other users you invite, and where you operate an agency account, the client workspaces you configure. Access is controlled by you.
• Professional advisers. Accountants, auditors, insurers and lawyers, under duties of confidentiality.
• Law enforcement and regulators. Where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims. We review every request, disclose the minimum necessary, and tell you unless we are prohibited from doing so.
• A buyer. If the business is sold, merged or reorganised, personal data may transfer as part of it. Any transfer of Google user data in that situation would be made only with your explicit prior consent, and we would notify you of any change of controller.

Where your data is processed, and international transfers

The platform runs in the European Union. Our application servers are in Belgium and our primary databases are in Ireland, which keeps the data and the compute in the same region. Media and static assets are held in a European Union jurisdiction bucket on Cloudflare R2.

Some of the providers we depend on are established outside the UK and the EEA, principally in the United States. Where personal data is transferred to them, we rely on one or more of the following:

• a UK adequacy regulation or an EU adequacy decision covering the destination, including the EU-US Data Privacy Framework and its UK extension where the recipient is certified to it;
• the EU Standard Contractual Clauses, together with the ICO’s International Data Transfer Addendum where UK GDPR applies;
• the ICO’s International Data Transfer Agreement, where that is the more appropriate instrument.

In each case we carry out a transfer risk assessment and apply supplementary technical measures, principally encryption in transit and at rest and minimising what is sent. The mechanism relied on for each provider is noted on the sub-processor page. You can ask us for a copy of the relevant safeguards by emailing [email protected].

How long we keep personal data

We keep personal data only as long as we need it for the purpose it was collected for, plus any period we are legally required to hold it. In practice:

How we protect personal data

Security measures are technical and organisational, and the ones worth naming are these:

• TLS on every connection, and encryption at rest for every database, object store and backup.
• Integration credentials encrypted with AES-256-GCM under a separate key before they are written, and never returned to a browser or written to a log.
• Row level security in the database, so one customer’s rows are unreachable from another customer’s session, enforced by the database rather than by application code remembering to check.
• Separation of the marketing subscriber store from the content store by schema, role and connection string, so that a compromise of one cannot read the other.
• No passwords to steal: sign-in is by one-time code emailed to a verified address.
• A web application firewall, bot protection and rate limiting in front of every public endpoint, and a restricted origin so that the application cannot be reached except through it.
• Secrets held in a managed secret store, never in source control, never as build arguments.
• Least privilege access for staff, reviewed periodically, with administrative actions logged.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to people’s rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and tell affected individuals without undue delay where the risk is high. Where we are acting as your processor we will notify you without undue delay so that you can meet your own obligations, as set out in the Data Processing Agreement. Report a suspected vulnerability to [email protected].

Your rights under UK and EU data protection law

Where we are the controller of your personal data, you have the right to:

• Be informed about how we use it, which is what this policy is for.
• Access a copy of the personal data we hold about you.
• Rectification of anything inaccurate or incomplete. Most of it you can correct yourself in your account settings.
• Erasure of your personal data, where we have no overriding reason to keep it.
• Restriction of processing while a dispute about accuracy or lawfulness is resolved.
• Portability of the data you gave us, in a structured, commonly used, machine-readable format. The platform provides export directly.
• Object to processing based on legitimate interests, and to direct marketing at any time, with no qualification in the marketing case.
• Withdraw consent at any time, where processing is based on consent. Withdrawal does not affect what was lawful before it.

Exercise any of them by emailing [email protected]. We respond within one month and will tell you if we need longer, which is permitted for complex requests. There is no charge unless a request is manifestly unfounded or excessive. We may need to verify your identity first, and we will only ask for what is necessary to do that.

If your personal data is inside a customer’s workspace rather than in your own account with us, see section 2: that customer is the controller and the request belongs with them.

Additional rights for United States residents

RankX AI serves customers in the United States and Canada as well as the UK and Europe. If you live in California, or in another US state with a comprehensive privacy law such as Colorado, Connecticut, Virginia, Texas or Utah, you may have rights to know what personal information is collected, to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of its sale or of targeted advertising.

The categories of personal information we collect, the purposes we collect them for, the categories of third party we disclose them to and how long we keep them are all set out in sections 3, 4, 12 and 14. We do not use or disclose sensitive personal information for purposes that require a right to limit under the California Privacy Rights Act. We will not discriminate against you for exercising any of these rights.

To make a request, email [email protected]. An authorised agent may submit a request on your behalf with written proof of authorisation. We respond within 45 days and will tell you if we need a permitted extension.

Automated decision-making and profiling

The platform produces scores, rankings, recommendations and prioritised tasks automatically, and much of that is generated by large language models. None of it is a decision producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22, and none of it decides anything about an individual: it evaluates websites and content.

Automated systems do act on accounts in two narrow ways: rate limiting and abuse detection can restrict access, and non-payment can move an account to read-only. Both are reviewable by a person on request at [email protected].

Children

RankX AI is a business tool. It is not directed at children, and you must be at least 18 to open an account. We do not knowingly collect personal data from children. If you believe a child has given us personal data, tell us at [email protected] and we will delete it.

Changes to this policy

We update this policy when what we do changes. The date at the top of this page is the date of the current version, and it is the same date carried in the page’s structured data and in our sitemap, so an automated check of any one of them gives the right answer.

Where a change materially affects how we use personal data we already hold, we will notify you by email to your account address or by prominent notice in the platform before it takes effect. Where the change concerns Google user data, we will not apply a new purpose to data already collected without asking for your consent first.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first at [email protected]. We would rather fix it than have you escalate, and most complaints are a misunderstanding we can clear up quickly.

You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner’s Office:

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Helpline

0303 123 1113

Online

ico.org.uk/make-a-complaint

If you are in the EEA, you may complain to the supervisory authority in your country of residence, place of work or the place of the alleged infringement.