Privacy Policy

Last updated: September 5, 2026

What we collect

Account details (email, name), your connected sites and their crawl/audit data, chat transcripts with your director, usage analytics, and billing information (processed by Stripe — we never see card numbers).

How we use it

To run audits, publish content you approve, track rankings, and improve the service. We do not sell personal data.

Processors

Supabase (database and auth), Vercel (hosting), Stripe (billing), Anthropic and OpenAI (content and chat processing — your site content, never your Google user data), Google (PageSpeed, Search Console and Analytics data you connect), DataForSEO (search result data), Resend (email), Sentry and PostHog (diagnostics and analytics). The full list with locations is on the sub-processors page. Analytics cookies load only after you allow them in the cookie banner; you can change that by clearing site data.

Google user data

When you connect Google Search Console or Google Analytics, Rank Sphere requests read-only access (webmasters.readonly, analytics.readonly) and, for sign-in, your basic profile (openid, email). We use this data only to show your own search performance inside your dashboard, to decide which of your pages to refresh, and to attribute traffic to the content we publish for you.

Who we share Google user data with: no one, except the infrastructure providers that operate the service on our behalf under data-processing agreements: Supabase (encrypted database and authentication) and Vercel (hosting). Google user data is never sold, never used for advertising, never shared with other customers, never used to train AI models, and never transferred to any other third party. Rank Sphere's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect it: OAuth refresh tokens are encrypted at rest with AES-256-GCM using a key held only in our server environment; Search Console and Analytics metrics are stored in a database encrypted at rest, protected by row-level security so only members of your organisation can read them; all transfer is over TLS; access is limited to automated processing and to staff resolving a support request you raised. We keep this data while the connection is active and delete it within 30 days after you disconnect Google in Settings, delete your site, or delete your account. You can also revoke access at any time from your Google Account permissions page.

Your rights

You can export or delete your data at any time from Settings, or by emailing support@ranksphereai.com. EU/UK users have GDPR rights of access, rectification, erasure, and portability.

Cookies

We use essential cookies for sign-in and consent-gated analytics cookies.