Privacy Policy

RankSignal is operated by NABX LTD, trading as RankSignal ("we", "us"), of [BUSINESS ADDRESS]. We're the data controller for the personal data described in this policy.

Questions about this policy or your data: hello@ranksignal.co.uk.

Account data: your email address, hashed password, and workspace/agency name.

Campaign data you add: the businesses you track (name, address, category, coordinates, and public Google identifiers), the keywords and prompts you configure, and the rank/visibility results we generate from them.

Billing data: handled by Stripe, our payment processor. We never see or store your card details — Stripe passes us only your subscription status and billing history.

Technical data: IP address (for security and abuse prevention), session identifiers, and request logs. We use structured application logs and Sentry for error monitoring, which can include technical request metadata.

Support correspondence: anything you send us by email.

To provide the service: running the rank-tracking and AI-visibility checks you configure, and showing you the results.

To operate your account: authentication, billing, sending you service emails (verification, password reset, team invitations, billing receipts).

To keep the service secure: rate limiting, fraud prevention, and audit logging of account and billing changes.

We do not sell your data, and we do not use it for advertising or profiling.

We use a small number of subprocessors to run the service, each only for the specific job described:

• DataForSEO — runs the Google Maps searches behind your rank-grid scans, on our behalf, using the business names and locations you configure.

• OpenAI, Anthropic, Google (Gemini), and Perplexity — whichever of these your plan includes are sent the AI-visibility prompts you configure, to check whether your tracked businesses are mentioned. Only the plan generic-search prompts are sent, never your account or billing data.

• Stripe — processes payments and manages your subscription.

• Resend — sends transactional emails on our behalf (verification, password reset, invitations, receipts).

• Sentry — error monitoring, to help us find and fix bugs.

• Our hosting provider — runs the servers the application and database run on.

We don't share your data with anyone else, except where required by law.

Some of our subprocessors (including OpenAI, Anthropic, Google, Perplexity, and Sentry) are based in or transfer data to the United States. Where that happens, it's covered by that provider's Standard Contractual Clauses or an equivalent safeguard recognised under UK GDPR.

We only use strictly-necessary cookies: one to keep you signed in (your session), and one for CSRF protection (stopping other sites from making requests on your behalf). Both are essential to the service working at all and are exempt from cookie-consent requirements under UK PECR.

We don't use analytics, advertising, or tracking cookies. Your theme preference (light/dark) and last-viewed workspace are stored in your browser's local storage, not as cookies, and never leave your device.

We keep your account and campaign data for as long as your account is active. If your subscription lapses, we pause scanning but keep your data so you can pick up where you left off if you resubscribe — we don't delete it automatically.

You can ask us to delete your account and data at any time (see "Your rights" below); we'll action it within 30 days, subject to what we're legally required to keep (e.g. billing records for tax purposes).

Under UK GDPR, you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data deleted; restrict or object to certain processing; and receive your data in a portable format.

To exercise any of these, email hello@ranksignal.co.uk. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ico.org.uk), though we'd appreciate the chance to sort things out directly first.

Passwords are hashed, never stored in plain text. Sessions use secure, httpOnly cookies. Every account's data is scoped to that account's own workspace and cannot be accessed by other customers.

RankSignal is a business tool, not directed at or intended for anyone under 18.

If we make a material change, we'll email account holders and update the date at the top of this page.