Privacy Policy

1. Information We Collect

1.1 Account & Identity Data

• Email address — collected when you register with email/password or Google OAuth (via Supabase Auth).
• Name / display name — provided by you or via Google OAuth profile.
• Profile picture — optionally provided by Google OAuth.

1.2 Payment & Billing Data

We do not store your credit card details. Payment processing is handled entirely by Xendit We receive and store only:

• Payment reference ID and invoice ID
• Billing plan name and status (active, cancelled, trial)
• Billing period start and end dates
• Payment method used (as reported by Xendit) for display purposes only

1.3 Usage & Analytics Data

• Pages visited, features used, and interaction events within the platform
• Search queries and domain targets you analyze (stored temporarily to power the service)
• IP address, browser type, operating system, and device identifiers
• Timestamps of logins and API requests

1.4 SEO Data You Analyze

When you use Rank Crown to analyze a domain or keyword, we send queries to the DataForSEO API on your behalf. The targets you analyze are logged server-side to enable caching, billing calculation, and abuse prevention. We do not sell this data to third parties.

1.5 Cookies & Session Data

We use cookies and browser storage for:

• Session cookies — set by Supabase Auth to maintain your authenticated session (e.g., sb-access-token, sb-refresh-token).
• Preference cookies — to remember UI preferences such as selected locale.
• Analytics cookies — if analytics are enabled, to understand how users navigate the platform (no advertising profiling).

You can disable non-essential cookies in your browser settings. Disabling session cookies will prevent you from logging in.

2. How We Use Your Information

We use collected information to:

• Provide, operate, and improve the Rank Crown platform
• Process payments and manage your subscription via Xendit
• Authenticate your identity and maintain session security
• Cache DataForSEO API responses to reduce costs and improve performance
• Enforce fair-use limits and detect abuse
• Send transactional emails (account confirmation, password reset, billing receipts)
• Send product update emails if you opt in
• Comply with legal obligations and resolve disputes

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

3. Third-Party Services

Rank Crown relies on the following sub-processors. Each has its own privacy policy:

These services process data only as instructed by us and are contractually obligated to protect your data.

4. Data Retention

• Account data — retained for the duration of your account. Deleted within 30 days of account deletion request.
• Billing records — retained for 7 years as required by tax and financial regulations.
• API request logs — retained for up to 90 days for abuse detection, then purged.
• SEO analysis cache — retained for up to 24 hours, then automatically deleted.
• Analytics events — retained for up to 12 months in aggregated, anonymized form.

5. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing of your data for certain purposes.
• Withdraw consent — withdraw any consent you have previously given.

To exercise any of these rights, email us at privacy@rankcrown.com. We will respond within 30 days.

6. GDPR & International Transfers

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) or equivalent legislation. Our legal bases for processing personal data are:

• Contract — processing necessary to provide the services you have subscribed to.
• Legitimate interests — security monitoring, fraud prevention, and product improvement.
• Consent — marketing communications (where applicable).
• Legal obligation — tax and financial record-keeping.

Some of our sub-processors may process data outside the EEA. Where this occurs, we rely on Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms to ensure adequate protection.

7. Data Security

We implement industry-standard security measures including TLS encryption in transit, encrypted storage at rest (via Supabase), Row Level Security (RLS) policies, and periodic security reviews. Despite these measures, no system is completely secure. We encourage you to use a strong, unique password and enable two-factor authentication where available.

8. Children's Privacy

Rank Crown is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us immediately and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address on your account) and/or by posting a prominent notice on the platform. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of Rank Crown after the effective date constitutes acceptance of the updated policy.

10. Contact Us

For privacy-related questions, data requests, or concerns: