Privacy Policy

Effective Date: October 12, 2026 · Last updated: October 15, 2026

RankSurf ("we," "us," or "our") operates the RankSurf platform (the "Service"), an AI visibility monitoring tool for B2B SaaS companies. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the Service.

By using the Service, you agree to the collection and use of information in accordance with this policy.

---

Data Controller

The Service is operated by Sipos Gergely Dániel e.v. (trading as RankSurf), an individual entrepreneur (sole trader) established in Hungary, who is the data controller responsible for the personal data processed through the Service:

• Operator: Sipos Gergely Dániel e.v. (RankSurf)
• Registered address: 3300 Eger, Nagy-eged utca 39., Hungary
• Tax number: 57789680-1-30
• Email: hello@ranksurf.com

For any questions about how your personal data is handled, contact us at hello@ranksurf.com.

---

Free tools and the free scan

This section covers the free AI visibility scan, which needs no account: the scan on our site and at /audit, and the email you can ask for under its result. The older AI readiness and GEO score checkers are retired: they take no new domains, and what they stored (the domain entered, its result and the same salted hash of your IP address) is kept until you ask us to delete it. Those checkers, and free scans started before we changed how scan events are keyed, sent PostHog events keyed by that same salted hash; PostHog still holds them, and a deletion request to hello@ranksurf.com covers them too.

What we store. The domain you enter. The 10 buyer questions we ask ChatGPT about it, ChatGPT's answers and the pages it cited. The result of a check of your site: what your robots.txt allows AI crawlers to do, whether your homepage can be indexed, and whether a sitemap is declared. A salted hash of your IP address, in place of the address itself. If you ask us to email the recipe: your email address, the domain and scan it was for, whether you ticked the box, the exact wording shown beside it ("Also send me occasional tips and RankSurf product news. Unsubscribe anytime."), when you asked, and whether the email was sent, with a one-line summary of what it said.

Why. To show you the result and, when you ask, to email it to you. To limit abuse: at most 3 scans a day per IP address, a daily cap on free scans overall, and for the email at most 1 recipe per address and domain, 3 per address and 5 requests per IP address a day, which is why the hash of your IP address is kept with your request. And, only if you ticked the box, so that we may send you occasional tips and product news.

Who processes it. These providers receive the following from us:

• OpenAI: the domain, the brand name and your homepage's title, description and headings, to write the 10 questions; then each question, with a country taken from your site's language or domain, for ChatGPT to answer; and, when a brand name could mean something else, ChatGPT's answer, so a model can check which brand it means.
• Google (Gemini): when your homepage names no site name, the domain with the page's title and headings, to read the brand name; and each ChatGPT answer, to pick out the brand names in it.
• Cloudflare Turnstile: a bot check that runs in your browser when you start a scan and when you ask for the email. Cloudflare sees your IP address and browser signals as the check runs. Our server then sends Cloudflare the check's token to verify it, together with your IP address when you start a scan and without it for the email.
• Resend: your email address and the content of the email, which is the recipe for your domain. Resend also tells us when an email bounces for good or is reported as spam.
• PostHog: Our servers send PostHog an event at each step of a free scan: when it starts, finishes or fails, when its recipe is shown, when its trial button is clicked or it is shared, and when its email is asked for, sent or fails. Each event is keyed by the id of the scan record for that domain, which everyone who scans the same domain shares, and says which of our pages it came from; the start, finish and failure events also carry the domain scanned. None carries your email address or your IP address, hashed or not. Analytics on the pages themselves work as described in section 4.
• Trigger.dev and Supabase: they run the scan in the background (Trigger.dev receives the domain) and store everything above, as sections 4.4 and 4.9 describe.

How long. If you did not tick the box, we erase your email address, and the hash of your IP address stored with your request, from our database 30 days after your last request for that domain. If you did, we keep them until you unsubscribe; after that they are erased once 30 days have passed since your last request. The domain, the scan and the record of your choice stay. If an address unsubscribes, or an email to it bounces for good or is reported as spam, the address stays on a do-not-email list so that a free scan email is never sent to it again, until you ask us to remove it. Scan results, and the hash of the IP address stored with each scan, stay at their link unless you ask us to delete them. Backups follow section 7.4.

Your choices. Every free scan email has a one-click unsubscribe, and its link carries no email address. Unsubscribing stops free scan emails to that address and withdraws any consent to tips and product news. To delete anything, or to be taken off the do-not-email list, write to hello@ranksurf.com.

---

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address — provided via Google OAuth or email code sign-up.
• Full name — from your Google profile or as you provide it.
• Profile photo URL — from your Google profile, if available.

We do not collect or store passwords. Authentication is handled via Google OAuth or passwordless email codes.

1.2 Project and Brand Data

When you create a project, you provide:

• Domain — the website you want to monitor.
• Brand name and aliases — up to 3 alternative names for your brand.
• Market/region — the geographic market your brand operates in.
• Brand facts — structured key-value information about your brand (e.g., starting price, main product category, founding year, headquarters, key differentiator).
• Competitors — names, domains, and aliases of competing brands (both manually added and auto-detected from AI responses).

1.3 Prompts

You create or select search queries ("Prompts") that are submitted to AI engines. Prompts are text strings between 5 and 300 characters, categorized by type (branded, category, comparison, problem-solving, evaluation, use-case).

1.4 Scan Results

When Scans run, we store:

• AI engine responses — the full text returned by ChatGPT, Perplexity, and Google AI Overview.
• Brand mentions — whether and where your brand appears in each response.
• Citation URLs — source links cited by AI engines.
• Competitor mentions — which competitors appear, their positions, and citation status.
• Accuracy issues — detected mismatches between AI statements and your brand facts.
• Detected brands — all brand entities extracted from responses.

1.5 Site Audit Data

During site audits, we crawl pages on your domain and collect:

• Page titles, meta descriptions, and heading structures.
• Word counts (static and rendered content).
• Internal and external links.
• Structured data (JSON-LD, FAQ schema).
• Client-side rendering parity metrics.
• Robots.txt and sitemap data.
• Domain authority score (derived from the Tranco top-1M list).

1.6 Growth Plan Suggestions and Tasks

We generate and store:

• Suggestion and Task title, description, type, and category.
• Target URL (the specific page the Suggestion applies to).
• Impact and effort ratings.
• Evidence items supporting the Suggestion.
• Suggestion and Task status (as updated by you).

1.7 Billing Information

We collect your plan selection, subscription status, and billing period dates. We do not collect or store your payment card information. All payment processing is handled by Polar, our Merchant of Record (see Section 4.2).

1.8 Email Preferences

We store your communication preferences:

• Master unsubscribe toggle.
• Scan notification preference.
• Weekly digest preference.
• Nurture email preference.

1.9 Technical and Usage Data

We automatically collect:

• Web performance metrics — anonymized Core Web Vitals (LCP, FID, CLS) via Vercel Analytics. No personally identifiable information is collected.
• Error data — stack traces and operational context sent to Sentry for debugging. This may include your user ID to help us diagnose account-specific issues.

1.10 Where you came from and how you heard about us

When you sign up we keep a record of which site sent you, so we know which sources bring people to RankSurf.

• What is stored in your browser. One entry, ranksurf:first-touch, in your browser's local storage. It holds the site you came from (the site's name only), the page of ours you first landed on (its path only, never a private link's secret), any campaign tags in the link you followed, and when that happened.
• When it is set. If you are in the EU, EEA, or UK, only after you click "Accept" on the cookie banner. Elsewhere it is set by default, and "Cookie preferences" in the site footer turns it off.
• When it goes. It is deleted from your browser when you sign up or sign in, and its contents are then kept on your account. If you never sign up, it expires after 90 days.
• Without it. If you are in the EU, EEA, or UK and have not clicked "Accept", nothing is stored on your device. If you then use a sign-up link on the page you landed on, the same details travel only inside that link, as part of its address. If you browse to other pages first, we record that we did not capture your source.
• Your answer. On the first step of onboarding we ask, optionally, "How did you hear about us?" with the choices ChatGPT, Perplexity, Gemini, Claude, Other AI assistant, Google search, Reddit, LinkedIn / X, A friend or colleague, Other. Your answer, and the text you type beside "Other" (at most 100 characters), is stored on your account with its date. You can leave it blank; we then record only that we asked.

---

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Service Delivery

• Running Scans by submitting your Prompts to AI engines.
• Analyzing AI responses for brand mentions, citations, and accuracy.
• Building your Growth Plan of Suggestions based on scan results and site audits.
• Producing Reports and visualizations of your visibility data.
• Managing your subscription and enforcing plan limits.

2.2 Communication

• Transactional emails — welcome messages, subscription confirmations, payment receipts. These are always sent and cannot be opted out of.
• Critical emails — trial expiration notices, payment failure alerts, prompt limit warnings. These are always sent.
• Notification emails — scan completion alerts, accuracy issue notifications. You may opt out via your email preferences.
• Marketing emails — weekly digest summaries, product updates, re-engagement messages. You may opt out via your email preferences or one-click unsubscribe links.

2.3 Service Improvement

• Aggregated, anonymized analytics to understand usage patterns and improve the platform.
• Error monitoring to identify and fix bugs.
• AI cost tracking to optimize model selection and pricing.

2.4 Security

• Rate limiting on public endpoints.
• Webhook signature verification for payment events.
• Error tracking to detect and respond to security incidents.

---

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

You may withdraw consent for marketing communications at any time without affecting the lawfulness of processing based on consent before withdrawal.

---

4. How We Share Your Information

We do not sell your personal information. We share data with third-party service providers only as necessary to operate the Service.

4.1 AI/LLM Providers

We send data to AI engine providers to execute Scans and analyze their results:

When analyzing your brand and site, we also send your domain, brand name, and competitor names to AI providers for context.

We do not send your email address, account information, or any personal identity data to AI providers.

4.2 Payment Processor

Polar is our Merchant of Record and handles all payment processing. When you subscribe, Polar receives:

• Your email address (for receipts and invoicing).
• Your user ID (for linking subscriptions to your account).
• Plan selection and billing period.

Polar processes payment card data directly. We never see or store your card numbers, CVV, or bank details. Polar is PCI DSS compliant.

4.3 Email Service

Resend delivers emails on our behalf. Resend receives:

• Your email address.
• Personalized email content (e.g., brand name, scan metrics, Suggestion summaries, subscription details).

4.4 Background Job Processing

Trigger.dev orchestrates long-running tasks (Scans, site audits, building your Growth Plan, email sending). Task payloads include your project ID, user ID, run ID, and prompt data. Trigger.dev processes this data on our behalf and does not use it for any other purpose.

4.5 Web Crawling

Jina AI extracts content from pages on your domain during site audits. Jina receives the URLs of pages to crawl. No personal data is sent to Jina.

4.6 Domain Authority

Domain authority scores are derived from the Tranco top-1M list, a publicly available research dataset. The list is downloaded as a static file — no domain names or personal data are sent to any third party as part of this process.

4.7 Error Monitoring

Sentry receives error reports including stack traces and operational context. This may include your user ID for debugging purposes. Sentry does not receive your email, name, or project content. Sentry is used for error tracking only — we do not use Sentry session recording or session replay.

4.10 Product Analytics

PostHog (hosted in the European Union at eu.posthog.com) receives product-usage events — page views, feature interactions, and navigation patterns — to help us understand how the product is used and improve it. If you are in the EU, EEA, or UK, we do not set analytics cookies until you accept them via the consent banner:

• No choice yet, or Reject: we measure your visit anonymously in cookieless mode. PostHog counts you using a privacy-preserving hash computed on its own servers — no cookie, localStorage entry, or other device identifier is written to your browser for the purpose of tracking you, and you cannot be recognised across sessions. The legal basis for this anonymous, cookie-free measurement is legitimate interest. The only thing stored on your device is a small flag recording your banner choice itself, so that we do not ask you again.
• Accept: PostHog switches to cookie-based analytics tied to a pseudonymous identifier linked to your account, and session replay is enabled.

You can change your choice at any time via "Cookie preferences" in the site footer. Outside the EU, EEA, and UK, analytics is enabled by default (you can still opt out via "Cookie preferences"). PostHog does not share your data with advertising networks or other ad-tech.

4.8 Hosting and Analytics

Vercel hosts the Service and collects anonymized web performance metrics (Core Web Vitals). Vercel Analytics does not collect personally identifiable information by default. Vercel Speed Insights collects Real User Monitoring data for performance optimization.

4.9 Authentication and Database

Supabase provides authentication and hosts our database. All application data (account information, projects, scans, Suggestions and Tasks) is stored in Supabase-hosted PostgreSQL with Row-Level Security enforced.

4.11 Google User Data

If you connect Google Search Console or Google Analytics from Settings, we access your Google user data through Google's APIs under the following narrow, read-only scopes, requested one service at a time and only after you explicitly grant it:

We also request Google's basic openid, email, and profile scopes to identify which Google account granted access.

How this data is used and stored:

• Your Google data is used only to power features inside your own RankSurf account — dashboard metrics, Growth Plan Suggestions, and Reports. It is never used for advertising, never sold, and never shared with any party outside the processors listed in this Privacy Policy.
• Data is synced periodically via background jobs (Section 4.4) and stored in our Supabase database (Section 4.9), scoped to your project with Row-Level Security.
• We do not use Google user data to train AI/ML models, general or generalized.
• Revoking access: You can disconnect a Google integration at any time from Settings, which stops future syncs, or revoke RankSurf's access directly at Google Account permissions. Disconnecting does not automatically delete previously synced data — request deletion via Section 9.3.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

---

5. Cookies and Tracking Technologies

Essential cookies (always on)

These cookies are strictly necessary to operate the Service. They are exempt from consent requirements under the ePrivacy Directive and cannot be disabled:

Our web performance and analytics measurement (Vercel Analytics and Speed Insights) is cookieless — it does not set or read cookies and does not collect personally identifiable information.

Local storage: where you first landed (set automatically outside the EU, EEA, and UK; inside them, only after you accept)

Cookieless anonymous measurement (unless you accept analytics cookies)

Unless and until you accept analytics cookies via the consent banner, product analytics runs in cookieless mode: PostHog writes no tracking cookie, no localStorage identifier, and nothing else to your device that could be used to recognise you. Instead, it counts your visit using a privacy-preserving hash computed on PostHog's own servers, which is not a persistent identifier and is not stored in your browser. We rely on legitimate interest as the legal basis for this anonymous measurement — the same position taken by other cookieless analytics providers such as Plausible and Fathom: because no tracking data is stored on your device, the ePrivacy Directive's consent trigger does not apply.

The single exception is a small flag recording your own banner choice (or the absence of one), stored so that we do not repeatedly interrupt you. That flag exists only to remember your preference — it carries no analytics data and cannot identify you.

Analytics cookies (set only after you accept)

If you accept analytics cookies via the consent banner, PostHog sets first-party cookies and switches to cookie-based, account-linked analytics with session replay:

How consent works: if you are in the EU, EEA, or UK, a consent banner appears on your first visit. Until you accept, no analytics cookies are set and PostHog measures your visit anonymously in cookieless mode — whether you reject or simply do not answer (see above). If you accept, PostHog switches to cookie-based analytics tied to your account. The same choice governs the first-touch entry in local storage described in Section 1.10: in those regions it is set only after you accept. Outside those regions, analytics cookies and that entry are enabled by default. In all cases you can change your choice at any time by clicking "Cookie preferences" in the site footer.

We do not use third-party advertising or tracking cookies. We do not participate in cross-site tracking, behavioral advertising, or cookie-based retargeting.

---

6. Email Communications

6.1 Types of Emails

We send the following categories of email:

• Transactional: Welcome, subscription confirmation, payment receipts, cancellation confirmation. Always sent; cannot be opted out.
• Critical: Trial expiration, payment failure, prompt limit warnings. Always sent.
• Notification: Scan completion alerts, accuracy issue alerts. Opt-out available.
• Marketing: Weekly digest, product updates, re-engagement. Opt-out available.

6.2 Managing Preferences

You can manage your email preferences from your account settings. Each preference can be toggled independently. A master unsubscribe toggle disables all non-transactional and non-critical emails.

6.3 One-Click Unsubscribe

All marketing and notification emails include a one-click unsubscribe link that works without requiring you to log in. These links use cryptographically signed tokens for security.

6.4 Frequency Limits

We enforce email frequency limits to prevent excessive messaging:

• Daily deduplication (no duplicate template sends per day).
• Window-based limits (e.g., accuracy alerts: maximum once per 24 hours).
• Lifetime caps on certain email types (e.g., re-engagement emails).

---

7. Data Retention

7.1 Active Accounts

While your account is active, we retain all data necessary to provide the Service:

• Account and profile data: retained for the lifetime of the account.
• Project data, prompts, scan results, and Suggestions and Tasks: retained for the lifetime of the project.
• Email logs: retained for preference enforcement and frequency deduplication.
• AI usage logs: retained for cost tracking and optimization.

7.2 Lapsed Subscriptions

If your subscription ends — by cancellation, or because our payment processor exhausts its retry schedule after a failed renewal charge — your account is not deleted immediately. Your project data, scan history, and reports remain available in a read-only view for 90 days from the date your subscription ends, so you can review your data or reactivate without losing history. We email a reminder 7 days before this window closes. After the 90-day window, this data becomes eligible for deletion under the schedule described in Section 7.3.

7.3 After Account Deletion

If you ask us to delete your data. When you request deletion (see Section 9), we act without undue delay and in any case within 30 days:

• Your personal data (name, email, profile) will be deleted within 30 days.
• Project data, scan results, and Suggestions and Tasks will be deleted within 30 days.
• Shared reports will be immediately inaccessible and deleted with the project.

If a lapsed-subscription retention window closes. Once the 90-day period described in Section 7.2 has passed, that data is no longer needed for the purpose it was collected for and becomes eligible for deletion. We remove it periodically rather than on a fixed date, so the exact timing varies. You do not have to wait for that — you can ask us to delete it immediately at any time, and we will act within 30 days as described above.

In both cases:

• Anonymized, aggregated data (which cannot identify you) may be retained indefinitely.
• Data required for legal compliance (e.g., billing records) may be retained as required by law.

7.4 Backup Retention

Database backups are managed by Supabase and follow their retention policy. Backups containing deleted data are purged according to their standard retention schedule.

---

8. Data Security

We implement the following security measures to protect your data:

• Encryption in transit: All data transmitted between your browser and our servers uses TLS encryption.
• Row-Level Security: Database access is enforced at the row level. Users can only access their own data. Background jobs use a service client with restricted scope.
• No passwords stored: Authentication uses Google OAuth or email one-time codes. No password hashes are stored.
• Server-side secrets: API keys for third-party services are stored as server-side environment variables and are never exposed to client-side code.
• Webhook verification: All incoming webhooks (payment events) are verified using cryptographic signatures.
• Signed tokens: Unsubscribe links use cryptographically signed tokens that cannot be forged.
• Error monitoring: Sentry provides real-time error tracking to detect and respond to issues quickly.

---

9. Your Rights

9.1 Rights for EEA/UK Residents (GDPR)

If you are in the European Economic Area or United Kingdom, you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data (subject to legal retention requirements).
• Right to data portability — request your data in a structured, machine-readable format.
• Right to restrict processing — request that we limit how we use your data.
• Right to object — object to processing based on legitimate interest.
• Right to withdraw consent — withdraw consent for marketing emails at any time.

9.2 Rights for California Residents (CCPA)

If you are a California resident, you have the following rights:

• Right to know — request disclosure of the categories and specific pieces of personal information we collect.
• Right to delete — request deletion of your personal information.
• Right to opt-out of sale — we do not sell your personal information, so this right does not apply.
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.

9.3 How to Exercise Your Rights

You can exercise your rights by:

• Email preferences: Manage directly from your account settings or via one-click unsubscribe links.
• Account deletion: Contact us at hello@ranksurf.com to request account deletion.
• Data export: Contact us at hello@ranksurf.com to request a copy of your data.
• General requests: Email hello@ranksurf.com with your request. We will respond within 30 days.

We may need to verify your identity before processing your request.

---

10. International Data Transfers

Your data may be processed in the following locations:

For transfers from the EEA/UK to countries without an adequacy decision, we rely on the service providers' Standard Contractual Clauses (SCCs) and other appropriate safeguards as required by GDPR.

---

11. Children's Privacy

The Service is a B2B product designed for business professionals. We do not knowingly collect personal information from anyone under the age of 16. If we learn that we have collected data from a person under 16, we will delete it promptly. If you believe a child under 16 has provided us with personal information, please contact us at hello@ranksurf.com.

---

12. Third-Party Links

The Service may display URLs cited by AI engines in their responses. These are third-party websites that we do not control. We are not responsible for the privacy practices or content of external sites. We encourage you to review the privacy policies of any third-party sites you visit.

---

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will:

• Provide at least 30 days' notice via email to the address associated with your account.
• Update the "Effective Date" at the top of this page.
• Post the revised policy on our website.

Your continued use of the Service after the effective date of the revised policy constitutes acceptance. If you do not agree to the changes, you should stop using the Service and request account deletion.

---

14. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

• Email: hello@ranksurf.com
• Website: https://ranksurf.com

If you are in the EEA and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection supervisory authority.