Rankfor.AI — Privacy Policy

Last updated: 09 Oct 2025 Data Controller: Rankfor.AI Sp. z o.o., ul. Skarbowców 23B, 53-025 Wrocław, Poland • dpo@rankfor.ai This policy explains what we collect, why, how we use it, and your rights under GDPR.

1) What we collect

  • Account & identity: name, email, company, role.
  • Auth & logs: login timestamps, session IDs, IP (anonymized for analytics), user agent.
  • Product usage: features used, prompts/inputs you submit, generated artifacts, error telemetry.
  • Billing (if paid): billing contact, address; card data handled by our processor (we don't store PANs).
  • Content context: public URLs you scan; we process publicly available content for analysis.

2) Why we collect (lawful bases)

  • Contract (Art. 6(1)(b)) — provide the Platform and support.
  • Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, service improvement, quality analytics (pseudonymous).
  • Consent (Art. 6(1)(a)) — marketing emails; non-essential cookies/analytics.
  • Legal obligation (Art. 6(1)(c)) — tax/audit records.

3) How we use data

Operate the Platform; secure accounts; measure and improve performance; send service updates; process payments; provide reports/exports; and (if you opt-in) send marketing. We may use de-identified aggregates to improve reliability and reduce bias.

4) Cookies & tracking

See Cookie Policy summary in the Terms; analytics/marketing load only with consent. Manage choices via the banner or "Cookie settings".

5) Sharing (processors/sub-processors)

We use vetted providers under Article 28 agreements:

  • AI providers: Google Gemini; OpenAI — process inputs to generate Outputs; SCCs for US transfers; no model training on your data per provider terms.
  • Auth: Authentik (self-hosted) — email, user ID, login timestamps.
  • Cache/infra: Redis (self-hosted/Redis Cloud EU) — session & short-lived scan cache.
  • Payments: Stripe (EU/US) — billing and transactions.
    We don't sell personal data.

6) Retention

  • Account data: while active + 30 days after deletion request.
  • Scan cache: ~24 hours; auto-purged.
  • Reports/outputs you keep: until you delete or close account (+30 days).
  • Billing records: 7 years (legal).
  • Anonymized analytics: may be kept longer; cannot identify you.

7) International transfers

When data leaves the EEA (e.g., to OpenAI/Stripe US), we use Standard Contractual Clauses and safeguard measures.

8) Your rights (GDPR)

Access, rectify, erase, restrict, portability, object, withdraw consent, and lodge a complaint with your authority (PL: UODO). Request at dpo@rankfor.ai (subject: "GDPR Request"). Response within 30 days.

9) Security

We apply technical/organizational measures (encryption in transit, access controls, audit trails). We'll notify you and/or authorities of personal-data breaches as required. (Audit and DPA hooks available for enterprise.)

10) Children

Not for under-18s; we do not knowingly collect children's data.

11) Changes

We'll post updates here and notify of material changes in advance where required.

12) Contact

Data Controller: Rankfor.AI Sp. z o.o., ul. Skarbowców 23B, 53-025 Wrocław, Poland
Privacy: dpo@rankfor.ai • Legal & Support: contact@rankfor.ai