Privacy Policy

1. Information we collect

• Account: name, email, organization, settings, billing details, and the billing address and tax details you provide for invoices.
• Connected tools: data from the third-party analytics, search, project-management and other services you authorize via OAuth or API. We never see your passwords. We read from these services and write to them only when you ask us to, for example when you export tasks to your project tracker.
• Tracking script: if you add the RankSage tracking script to a site you own, by hand or through our WordPress plugin, it collects cookieless, pseudonymous behavioural signals over an encrypted channel: page views, scroll depth, clicks and rage clicks, page performance, script errors, file downloads, and the AI assistant or search engine that referred the visit. It also records general device and browser characteristics such as screen size, language, time zone and browser type.
• Bot detection: to separate real visitors from automated traffic, the script derives two technical signals from the browser: a hash of a small image drawn off-screen and the name of the graphics renderer. Combined with the device characteristics above, these signals can act as a device fingerprint. We use them solely to classify bots and limit abuse. We never use them to identify a person or to follow a visitor across sites, and we never share them. They are not collected from visitors whose browser sends a Do Not Track signal; for those visitors the script records aggregate page and scroll data only. IP addresses reach our servers with every request and are kept only in hashed form for abuse prevention and rate limiting.
• WordPress plugin: if you install the RankSage Connect plugin, it records visits to your site from known AI crawlers (the crawler’s name, the page requested and the time) and sends them to us. It never records human visitors. The plugin also adds the tracking script, if you leave that option on, and answers search engines’ requests for your IndexNow key.
• Conversations you upload or connect: if you upload customer conversations or connect a support inbox, we extract the questions your buyers ask and the language they use. Personal details are masked before anything is stored, and we act as a processor on your instructions. You confirm you are entitled to share that data with us.
• Social Scout: publicly available brand and competitor mentions (see §3).
• Usage & technical: features used, reports generated, IP address, device/browser, logs, and, in the signed-in app, performance and error telemetry (page timings, script errors, browser type) in which account identifiers are pseudonymised.
• Communications: support messages and, with consent, marketing email.

We don’t store card numbers — payments are handled by Razorpay.

2. How we use it

• Provide the service: AI-visibility tracking, analytics, content gap analysis and optimization, Social Scout, reports, and digests.
• Manage your account, process billing, and send transactional email.
• Secure the service, prevent abuse, and improve features.
• Act on your instructions in connected tools, for example exporting tasks or notifying search engines about your pages.
• Meet legal obligations.

We don’t sell your personal data or share it for cross-context advertising.

3. Social Scout and public data

Social Scout surfaces publicly available discussions and mentions of your brand and competitors, based on the brand and keywords you configure. We collect public content snippets, engagement metrics, and metadata and associate them with your account for reporting. We don’t access private, restricted, or login-gated content, and you control which brands and keywords are tracked. Where this includes data individuals have made public, it falls within the DPDP Act’s publicly-available-data exemption and, under GDPR, our and your legitimate interest in monitoring public brand commentary.

4. Data sent to AI providers

To power visibility tracking, analysis, and briefs, we send limited context — such as brand names, domains, competitors, and keywords — to third-party AI providers and to the AI engines we track on your behalf. We never send your email, password, billing data, or private analytics for this purpose, and we don’t use your data to train AI models. Our providers operate under confidentiality and no-training terms. If you connect an AI assistant to RankSage through our connector or API, the data you ask for is delivered to that assistant and handled by its provider under your agreement with them.

5. Google data (Limited Use)

Where you connect Google services (such as Analytics or Search Console), our use of information from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. That data is used only to provide the features you see in RankSage — never for advertising, never sold, never used to train AI models. Humans don’t read it except with your consent for support, for security, or where required by law.

6. Subprocessors

We share data only with vetted providers under data processing agreements. Hosting and infrastructure: Vercel and Railway (application hosting), Supabase (database, hosted in Singapore), Upstash (caching). Identity and communications: Clerk (authentication), Resend (email delivery). Payments: Razorpay. Monitoring: Sentry (error tracking, with personal details stripped and session recordings masked) and New Relic (performance monitoring and logs, with pseudonymised identifiers). Web, search and page data: Firecrawl, DataForSEO, SerpApi, Tavily, Brave, and Google (PageSpeed Insights and, where you connect it, the Indexing API). Search-engine notifications, only when you ask: IndexNow, which forwards to Microsoft Bing and its partner engines. Site content: Notion. AI processing and the engines we track on your behalf: Anthropic, OpenAI, Google, Microsoft, Perplexity, xAI, Mistral, DeepSeek, and OpenRouter, through which we reach Alibaba Cloud (Qwen) and Meta (Llama) models. Our DPA is available on request; we give notice before adding new subprocessors.

7. Data retention

• Account and waitlist data: while your account is active. You can schedule deletion of your account in Settings; it takes effect after a 14-day grace period, during which you can cancel it, and everything tied to the account is then erased.
• Tracking-script data: raw visitor events are kept for the window included in your plan, never longer than 90 days, and then deleted; the aggregated statistics built from them are kept while your account is active.
• Conversations you upload or connect: kept for the window included in your plan, at most 13 months, and then deleted.
• Connected-tool data: cached for performance; the source of record stays in your provider account; deleted when you disconnect.
• Social Scout data: kept while you’re subscribed; deleted on closure or request.
• Assistant chat history: kept while your account is active so you can return to earlier conversations.
• Backups and logs: purged on a rolling schedule.

8. Security

We encrypt data in transit and at rest, use least-privilege access, and process every event (no sampling). Error reports have personal details stripped and any session recording masks all text; performance monitoring carries only pseudonymised identifiers. No system is perfectly secure; if a breach affects you, we’ll notify you and the relevant authorities (including India’s Data Protection Board) within the time the law requires. See our Security page.

9. International transfers

RankSage operates from India. Our primary database is hosted in Singapore, and application hosting and content delivery use Vercel and Railway infrastructure. For transfers from the EEA, UK, or Switzerland to India or other non-adequacy countries, we rely on the EU Standard Contractual Clauses (and UK Addendum) with supplementary measures. A copy is available on request.

10. Your rights — EEA / UK / Switzerland

You can access, correct, delete, restrict, object to, or port your data, and withdraw consent, and complain to your supervisory authority. RankSage is not established in the EEA/UK; before we offer the service to data subjects there, we’ll appoint and name an EU and a UK representative under Article 27. Until then, contact privacy@ranksage.com.

11. Your rights — India (DPDP Act)

You may access, correct, complete, update, erase, and nominate, and withdraw consent at any time. To exercise a right or raise a concern, contact our Grievance Officer at grievance@ranksage.com. We respond within 30 days; if unresolved, you may complain to the Data Protection Board of India. This notice is available in English; on request we’ll provide its substance in a scheduled Indian language.

12. Your rights — US states

Residents of US states with privacy laws (around twenty as of 2026) can know, access, correct, and delete their data, and appeal a denial. We don’t sell data or share it for cross-context advertising, and we honor Global Privacy Control signals.

13. Cookies

ranksage.com uses strictly necessary cookies plus three analytics tools: Google Analytics, which sets cookies, and two cookieless tools, Vercel Analytics and our own tracking script. Our own visits are filtered out of these figures. You can decline Google Analytics with Google’s browser opt-out add-on, and our script honours Do Not Track and Global Privacy Control. The RankSage tracking script on your sites sets no cookies and assigns no persistent identifier. The only thing it stores in a visitor’s browser is a record of their opt-out, so that the choice is remembered on later visits. It honours Do Not Track and Global Privacy Control, and it offers an opt-out control that consent-management tools can trigger before it loads; the details are in our developer documentation. If you install the script on your site, you are the controller of your visitors’ data. Where your visitors’ jurisdiction requires consent for analytics or device fingerprinting, for example in the EU and UK under the GDPR and ePrivacy rules, load the script only after consent, or use AI-crawler capture alone, which never involves human visitors.

14. Children

RankSage is a business tool for users 18+. We don’t knowingly collect data from anyone under 16; if you believe a child provided data, contact us and we’ll delete it.

15. AI systems and AI-generated content

Parts of RankSage are AI systems, and we tell you when you are dealing with one. The in-product assistant is an AI chat system — you are interacting with software, not a person. Content drafts, briefs, and analysis summaries the platform produces are AI-generated and are presented as drafts for human review, not finished work; where they can be exported or published, they should be reviewed and labeled accordingly. AI outputs can be wrong. This disclosure reflects our obligations under the EU AI Act (Article 50) and similar transparency rules.

16. Changes & contact

We’ll announce material changes by email and update the date above. Questions: privacy@ranksage.com (India Data Principals: grievance@ranksage.com).