Privacy, in plain English.

Free tools & checks: the website address or business details you type, so the tool can run. The SEO and AEO checkers analyze your live page and store nothing unless you ask for an emailed report. The AI Visibility Checker stores the captured engine answer so your shareable receipt link works.

Email capture:if you request a report or run the free check with your email, we store that email, what you ran, and the result — so we can send it and, if you’re a fit, follow up like humans. One useful email, no drip sequences.

Client accounts:your name, email, business details, and the access you hand over during onboarding (see encryption below). Plus the work records and evidence we produce for you — that’s literally the product.

Basic telemetry:standard server logs and privacy-respecting analytics. We hash IP addresses used for rate-limiting; we don’t run cross-site ad trackers.

Access you share in onboarding (for example a website login) is encrypted at rest with AES-256-GCM before it touches our database, using a key that lives only in our server environment — never in code, never in the browser. Secrets are decrypted only server-side, only when our team is actively working on your account, behind an admin allowlist. Where a platform supports it, we prefer invites (Google Business Profile manager invites) over passwords entirely.

Vercel (hosting), Supabase (database, auth, file storage — US region), Resend (email delivery), and the AI engines we query for visibility checks (your business name and public questions only — never your credentials). Payment processing, when you buy, happens with the named processor at checkout; we never see full card numbers.

We never sell your data. We never buy or fake reviews. We never post as you without your approval. We never email addresses that bounced or complained (automatic suppression). And we never use your credentials for anything outside the work you hired us for.

Ask for a copy of your data, correction, or deletion any time: email team@ranknext.io and a human answers within one business day. Deleting your account removes your credentials immediately and your workspace data within 30 days, except records we must keep for legal or billing reasons. California residents: this is your CCPA notice — same email exercises those rights; we don’t sell personal information.

If this policy changes materially, we’ll note it here with a new date and tell active clients directly. Questions? team@ranknext.io.