Privacy Policy

1. Scope and Purpose

This Privacy Policy covers how RankZero handles:

• Personal Information that we collect directly from you when you use our Site or Service, and
• Service Data (usage information collected automatically during Service operation).

This policy does not govern "Customer Data," meaning the data that agencies upload, submit, or generate while using RankZero for their clients (e.g., keywords, brands, AI answers, or analytics reports). Customer Data is processed solely under the terms of the agency's service agreement with RankZero.

RankZero acts as a data processor for Customer Data and a data controller for the Personal Information it collects directly from users.

2. Definitions

For clarity in this Privacy Policy:

• "Customer" means an agency or organization that purchases or subscribes to the RankZero Service.
• "Customer Data" means any data or content that a Customer uploads, submits, or inputs into the Service on behalf of itself or its clients.
• "Personal Information" means any information relating to an identified or identifiable individual, as defined by applicable data protection laws.
• "Service Data" means data generated through use of the Service (log data, analytics, device information) but not derived from Customer Data.
• "Processing" means any operation performed on data, such as collection, storage, use, or deletion.

3. Information We Collect

3.1. Information You Provide

We collect Personal Information that you voluntarily provide, including:

• Name and contact details (email address, agency name).
• Login credentials (username, password).
• Communications you send to us (support requests, inquiries, or feedback).
• Information related to account setup, billing, or onboarding.

We do not request or knowingly collect end-user personal data (such as your customers' consumers or visitors). Agencies using RankZero should not upload such data.

3.2. Information We Collect Automatically

When you use our Site or Service, we may automatically collect:

• Log and usage information (IP address, browser type, device identifiers, access times, referring URLs).
• Activity metrics within the platform (features used, time spent, error logs).
• Cookies and similar technologies to authenticate sessions and analyze performance.
• Analytics services (e.g., Google Analytics and PostHog) may collect aggregated statistics about Site usage.

3.3. Customer Data

Agencies may upload or generate data such as:

• Brand or product names
• Client domains or URLs
• Keywords or search terms
• AI answer snapshots or analytics results

RankZero processes Customer Data strictly under the Customer's direction and does not access or use it for independent purposes.

4. Cookies and Similar Technologies

We use cookies and similar tracking technologies to:

• Maintain user sessions and authentication
• Improve site functionality and analytics
• Remember user preferences

You may control cookies through your browser settings. Blocking essential cookies may affect functionality.

5. How We Use Information

We use Personal Information and Service Data to:

• Operate, maintain, and improve the Service
• Authenticate users and secure accounts
• Provide customer support and respond to inquiries
• Communicate updates and service-related notices
• Generate analytics and improve performance
• Enforce our Terms of Use and prevent misuse
• Comply with legal obligations

We do not:

• Sell Personal Information to third parties
• Use Customer Data to train general-purpose AI models
• Use Customer Data for marketing, profiling, or unrelated product development

6. Legal Bases for Processing (GDPR / UK GDPR)

If you are located in the EEA or UK, our lawful bases for processing Personal Information include:

• Performance of a Contract — to deliver the Service you requested.
• Legitimate Interests — to improve and secure our Service.
• Compliance with Legal Obligations — when required by law.
• Consent — when you explicitly agree to optional activities such as marketing emails or cookie use.

You may withdraw consent at any time.

7. Disclosure and Sharing of Information

We may share Personal Information only in the following cases:

Service Providers and Subprocessors: We use trusted vendors to host, support, and maintain the Service. These include:

• Vercel (hosting and deployment)
• Google Analytics and PostHog (analytics)
• LLM providers such as OpenAI and Anthropic (for AI-based components)

Legal Requirements: When required by law, subpoena, or government request.

Business Transfers: In case of a merger, acquisition, or sale of assets.

Protection of Rights: When necessary to prevent fraud, enforce our Terms, or ensure the safety of our users.

Subprocessors process data solely under RankZero's instructions and are required to maintain appropriate security standards (e.g., SOC 2, ISO 27001, or equivalent).

8. Data Transfers

RankZero is based in the United States, and data may be transferred to and processed in the U.S. or other countries where we and our subprocessors operate.

When we transfer data from the EEA, UK, or other regions with data protection laws, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission; and
• Additional technical and organizational safeguards (encryption, access control, and data minimization).

By using the Service, you understand and consent that your data may be processed in countries that may not provide the same level of data protection as your home jurisdiction.

9. Data Retention

We retain data according to the following principles:

Customer Data

• Stored for up to one (1) year from creation unless deleted earlier by the agency.
• Agencies may delete Customer Data at any time through account settings or by request.
• Backups and logs may persist up to 30 days after deletion for operational integrity.

Personal Information

• Retained for as long as your account is active or as required by law.
• Deleted or anonymized when no longer necessary for the purposes described.

Communications and Logs

• Retained as needed for auditing, troubleshooting, and compliance (generally not exceeding 24 months).

We may retain de-identified or aggregated information indefinitely for analytics and product improvement.

10. Data Security

We implement technical and organizational safeguards, including:

• Encryption in transit (TLS) and at rest
• Role-based access controls (RBAC)
• Secure credential and secret management
• Multi-factor authentication (MFA)
• Continuous monitoring and intrusion detection
• Regular vulnerability scanning and patch management
• Incident response protocols

While we take all reasonable precautions, no system is completely secure. You use the Service at your own risk.

11. Customer Data Processing (Light DPA Section)

When RankZero processes Customer Data on behalf of an agency:

• Role: RankZero acts as a data processor; the agency is the data controller.
• Purpose: Solely to provide, support, and improve the contracted Service.
• Access: Limited to authorized personnel under confidentiality obligations.
• Security: RankZero implements measures consistent with Section 10 (Data Security).
• Subprocessors: Used only with notice and contractual protections.
• Deletion: Customer Data is deleted or returned upon termination or request.
• Non-Use: RankZero does not access, share, or train AI models using Customer Data beyond operating the Service.

12. Your Rights

Depending on your jurisdiction, you may have the following rights:

General Rights (GDPR / UK GDPR)

• Access: Request a copy of your Personal Information.
• Correction: Correct inaccurate or incomplete information.
• Deletion: Request deletion ("right to be forgotten").
• Restriction: Limit processing in certain cases.
• Portability: Request data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: At any time, for processing based on consent.

How to Exercise

Send your request to legal@rankzero.io. We may verify your identity before fulfilling your request.

13. Additional Rights for U.S. Residents (CCPA / CPRA)

If you are a resident of California or another U.S. state with privacy laws, you may have rights to:

• Know what categories of Personal Information we collect and how we use it.
• Request deletion of Personal Information.
• Request correction of inaccurate information.
• Opt out of the sale or sharing of Personal Information (we do not sell or share data).
• Not be discriminated against for exercising these rights.

To exercise these rights, contact legal@rankzero.io. We will confirm receipt and respond within the timeframes required by applicable law.

14. Children's Privacy

Our Service is not directed toward children under 13, and we do not knowingly collect their data. If you believe a child has provided us information, contact us immediately to delete it.

15. Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your data may be transferred as part of that transaction. Any successor entity will be bound by this Policy or an equivalent level of protection.

16. Changes to This Policy

We may update this Privacy Policy periodically. If we make significant changes, we will notify you by email or through a prominent notice on our Site. The "Last Updated" date above reflects the most recent revision.

17. Accessibility Statement

RankZero strives to ensure this Privacy Policy is accessible in accordance with WCAG 2.1 AA guidelines. If you need this document in an alternative format, please contact legal@rankzero.io.

18. Contact Us

If you have any questions or concerns about this Privacy Policy, our data practices, or wish to exercise your rights, contact us at: