Privacy Policy

1. Controller

Rankly is a service of TECHSON - TECNOLOGIAS ONLINE, LDA ("TechsOn", "we"), NIF (tax number) 515616222, with registered office at Rua do Correio, 11, 2025-041 Alcanede, Portugal.

For any matter relating to personal data, contact us at info@techson.pt.

2. Who this applies to

This Policy applies to anyone who visits https://joinrankly.com and to anyone who creates an account and uses Rankly ("customer"). Data about the people that customers manage through Rankly (contacts, leads, bookings, email recipients) follows the rules in section 5, because in that case it is the customer who decides on the processing.

3. What data we process

• Account data: name, email, company (optional), password (stored only as an encrypted hash, never in plain text), plan, and the dates of the free trial and of the subscription.
• Billing data: the customer identifier and the subscription status in Stripe. Card or bank account details are entered directly in Stripe and are never received or stored by Rankly.
• Project content: business name, website address, sector, area, brand tone, goals, keywords, articles, pages, posts and any other content created or generated in Rankly.
• Analysed websites: the addresses and public content of the customer's website and of the competitor websites indicated by the customer, collected for initial analysis, technical audits and competitor monitoring.
• Integration tokens: the authorisations the customer grants to connect external services — Google (Search Console, Analytics, Business Profile, Ads), Meta (Facebook and Instagram), CMS (WordPress, PrestaShop, Shopify or a custom connection) and the customer's own email server (SMTP). They are used only to carry out the actions the customer configures and can be revoked at any time.
• Contacts managed by the customer: contacts imported or collected through forms, landing pages and bookings, email lists and the related events (sending, opening, click, unsubscribe).
• Technical data: IP address and server logs, used for security, abuse prevention and error diagnosis.

4. Purposes and legal bases

• Performance of a contract (Article 6(1)(b) GDPR): creating and managing the account, providing the service (keyword research, content generation and publishing, audits, integrations, sending emails on behalf of projects), charging the subscription and sending service messages (welcome, password reset, account notices).
• Legal obligation (Article 6(1)(c) GDPR): invoicing and compliance with tax and accounting obligations.
• Legitimate interest (Article 6(1)(f) GDPR): platform security, rate limiting and prevention of fraud and abuse, and improvement of the service based on aggregated usage data.
• Consent (Article 6(1)(a) GDPR): marketing communications, if and when we send them, always with an option to unsubscribe. Consent can be withdrawn at any time.

We do not make decisions with legal effects on individuals based solely on automated processing.

5. Customers' contact data (Rankly as processor)

When the customer imports or collects contacts through Rankly and sends them emails, manages bookings or scores leads, the customer is the controller and TechsOn acts as processor, under Article 28 GDPR.

In that capacity, TechsOn: processes that data only to provide the service and in accordance with the customer's instructions, as set out in the Terms of Service and in the settings the customer defines; ensures that the persons with access are bound by confidentiality; applies appropriate security measures; engages only the processors listed in section 6; assists the customer in responding to requests from data subjects; and deletes or returns the data at the end of the service, unless there is a legal obligation to retain it.

The customer is responsible for ensuring that it has a legal basis for processing that data — for example, consent to send email marketing — and for informing the data subjects. Campaign and sequence emails sent by Rankly always include an unsubscribe link.

6. Who we share data with

We share data only with the providers strictly necessary for the service, each limited to its own function:

• OVH SAS (France, EU) — hosting of the Rankly servers and database.
• Stripe — payment processing and subscription management.
• Anthropic (USA) — text generation by artificial intelligence. It receives the instructions and project content needed to generate each text.
• fal.ai (USA) — image generation by artificial intelligence, from text descriptions.
• Google — search volume data through the Google Ads API and, only when the customer connects those accounts, Search Console, Analytics and Business Profile.
• Meta Platforms — only when the customer connects Facebook or Instagram pages, to publish and read statistics.
• DataForSEO — search and SEO data (keywords and domains).
• Pexels — stock image search; it receives only search terms, with no personal data.

Rankly's own emails and the emails of projects without their own email server are sent through our servers, with no external sending provider. If the customer configures its own SMTP or CMS, those services are chosen and contracted by the customer.

We do not sell personal data or pass it on to third parties for advertising purposes. We may also disclose data to authorities where required by law.

7. International transfers

Some of these providers (namely Stripe, Anthropic, fal.ai, Google and Meta) may process data outside the European Economic Area, particularly in the United States. These transfers take place under the EU-US Data Privacy Framework, where the provider is certified, or under the Standard Contractual Clauses approved by the European Commission.

8. How long we keep data

• Account and project content: while the account is active. After the customer requests closure of the account, the data is deleted within a reasonable period, unless there is a legal obligation to retain it.
• Contacts managed by the customer: for as long as the customer keeps them in Rankly; the customer can delete them at any time.
• Integration tokens: until the customer disconnects the integration or closes the account.
• Billing data: for the legal retention period for tax documents (10 years).
• Technical server logs: only for as long as necessary for security and diagnosis.

9. Security

We use encrypted connections (HTTPS) throughout the service, passwords stored only as hashes, a protected session cookie (httpOnly and secure), limits on login attempts, and access to systems restricted to authorised TechsOn staff. No system is infallible; if a data breach occurs that poses a risk, we notify the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority, and, where required, the affected data subjects.

10. Your rights

Under the GDPR, you have the right to:

• access your personal data;
• rectify inaccurate or incomplete data;
• request erasure of the data, except where there is a legal obligation to retain it;
• request restriction of processing;
• receive your data in a structured, commonly used format (portability);
• object to processing based on legitimate interest;
• withdraw consent at any time, where the processing is based on it.

To exercise these rights, write to info@techson.pt. We respond within one month. If you are a contact of a Rankly customer (for example, you received an email from a company that uses Rankly), please address your request to that company; if you contact us, we will forward the request.

You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority, at www.cnpd.pt.

11. Cookies

The website https://joinrankly.com uses a single, strictly necessary cookie: the "auth_token" session cookie, created when you log in, which keeps you signed in for up to 30 days or until you log out. We do not use analytics, advertising or social media cookies, and therefore no consent is requested.

The dashboard also stores the last opened project in the browser (local storage), purely for convenience.

Public project pages hosted on Rankly (https://joinrankly.com/project-name) may include tracking pixels or tags configured by the respective customer. In that case, the customer is responsible for those cookies and for obtaining the necessary consent.

12. Minors

Rankly is intended for businesses and professionals aged 18 or over. We do not knowingly collect data from minors.

13. Changes

We may update this Policy. The version in force is always the one published on this page, with the date of the last update at the top. If the changes are substantial, we will notify customers by email.

14. Contact

TECHSON - TECNOLOGIAS ONLINE, LDA · Rua do Correio, 11, 2025-041 Alcanede, Portugal · info@techson.pt