This policy explains what [company name not set] ("we") collects when you use RankPilot, why, who sees it and what your rights are. Effective 2026-10-29.
Account data: name, email, a password hash (never the password), organisation name and country, the role you hold, sign-in times, and, if you turn it on, your two-factor secret (stored encrypted).
Store and catalog data (from stores you connect): product, category and information page text and fields (names, descriptions, meta text, attributes, prices, stock status, images paths, review counts and averages), web address keywords and the store's public settings (name, title, description, languages). We do not collect cost prices, supplier details, customer records, orders or reviewer names, and the connector does not expose them.
Search Console data (only if you connect it): which searches showed your pages, with clicks, impressions, click rate and position, per page and day. Access is read-only. We keep Google's access tokens encrypted.
Website analysis: public pages of the address you enter, fetched like a search engine would.
AI keys and usage: your Anthropic API key (encrypted; only its last four characters are ever shown) and counts of AI tokens used.
Billing data: plan, payment references and invoices, your billing details such as GSTIN and address. We do not store card numbers; payments are confirmed against bank transfer or UPI references you give us.
Technical data: IP address, browser type, request logs, security and audit logs (for example sign-in attempts and who changed what), error logs.
To provide the service you asked for (reading your store, writing suggestions, publishing what you approve, reports); to run billing and support; to keep the service secure, prevent abuse and investigate problems; to improve the service using aggregated usage; and to meet legal duties. We do not sell your data and do not use it for advertising.
Our staff can see account data to give support; sensitive actions are logged. Staff accounts require two-factor authentication.
Data is stored on servers we control. Secrets (AI keys, Google tokens, store signing keys, two-factor secrets) are encrypted at rest. Traffic uses HTTPS; requests from our system to your store are signed and expire after minutes. Access is limited by role, every administrative change is logged, and each customer's data is separated from others. No system is perfectly secure; if we learn of a breach affecting you we will tell you as the law requires.
We use only the cookies needed to keep you signed in and protect forms (a session cookie and a security token). We do not use advertising or tracking cookies.
While your account is active we keep your data to run the service. After you close your account we delete or anonymise it within 90 days; encrypted backups can hold it for a short time longer. We may keep billing and tax records for as long as the law requires, and security logs for a limited period. Search Console data is deleted when you disconnect it.
You can ask to see, correct, export or delete your personal data, to object to or limit some uses, and to withdraw consent you gave. In India this includes the rights under the Digital Personal Data Protection Act; in the EU and UK, under GDPR/UK GDPR. Write to [support email not set] and we will answer within the time the law sets (and at most 30 days). We may need to confirm who you are first. You can also complain to your data protection authority. The organization owner can download all the data we hold about the organization under Settings → Your data and can ask for the account to be deleted there; other requests are handled by our team.
The service is for businesses. It is not directed at children and we do not knowingly collect their data.
If we change this policy in a way that matters, we will tell you by email or in the app. The effective date above shows the current version.
[company name not set] · [support email not set]