Last updated: October 21, 2026

This Privacy Policy explains how Global Zone sp. z o.o. (“Ranksmile”, “we”, “us”) processes personal data when you visit https://tryranksmile.com, use the Ranksmile application, or otherwise interact with us. We process data in line with applicable law, including the EU General Data Protection Regulation (GDPR).

Cookie-specific details are in our Cookie Policy. Where we process personal data on a customer’s behalf as a processor, see the Data Processing Addendum.

1. Controller

The controller of personal data described in this Policy is:

Global Zone sp. z o.o.
ul. Michała Kleofasa Ogińskiego 11/9, 03-318 Warszawa, Poland
NIP: 1133098955 · KRS: 0001040092
Privacy contact: privacy@tryranksmile.com

We are typically the controller for account, billing, support, marketing (where consented), and product analytics data. For Customer Content that includes personal data of your end users or employees that you upload for SEO analysis, you are generally the controller and we act as your processor under the DPA.

2. Data we process

2.1 Account and identity

  • Name, email address, authentication identifiers
  • Organization / workspace membership and roles
  • Profile preferences and onboarding answers

2.2 Billing

  • Plan, subscription status, invoices metadata
  • Billing name, address, tax IDs (e.g. NIP/VAT) you provide
  • Payment method details handled by Stripe (we do not store full card numbers)

2.3 Product usage

  • Feature usage events, device/browser metadata, IP address, approximate location
  • Logs needed for security, debugging, and reliability
  • Support communications you send us

2.4 Phone verification and account-abuse prevention

When you create an account we ask for a mobile number and send a one-time code by SMS through Twilio, our processor. We use it only to confirm that each person or organization holds one account, and we never send marketing to it. A verified number is required to finish setting up an account; without it we can’t open one.

We don’t keep the number itself: we keep a one-way cryptographic fingerprint of it and its last two digits. To stop repeat free trials we also keep one-way fingerprints of your email address, your payment card (as provided by Stripe), your tax ID, the name and postal code on your card, the network you sign in from, and a random device identifier stored in the rs_did cookie.

These checks can make two automated decisions: that a new signup belongs to an account you already have, in which case we ask you to sign in to it; or that a free trial isn’t available, in which case you can still choose a paid plan. They never charge, cancel or delete an existing account. If you think a decision is wrong, email kontakt@tryranksmile.com and a person will review it.

2.5 Customer Content

  • Keywords, URLs, page HTML/text, drafts, scores, integration payloads you connect
  • Any personal data incidentally present in content you choose to process in Ranksmile

3. Google user data

The Ranksmile app at app.tryranksmile.com lets you sign in with Google and connect Google Search Console and, if you choose, Google Analytics 4. This section explains what Google user data we access through Google APIs, how we use, store, share and delete it, and how you stay in control. It applies in addition to the rest of this Policy.

3.1 What we access

  • Sign in with Google (openid, email, profile): your Google account ID, email address, name and profile picture.
  • Google Search Console (https://www.googleapis.com/auth/webmasters.readonly, read-only): the list of Search Console properties you have verified access to, and search performance data for the properties you connect to a workspace: queries, pages, clicks, impressions, click-through rate and average position.
  • Google Analytics 4 (https://www.googleapis.com/auth/analytics.readonly, read-only, only if you connect it): the GA4 properties on your account and reports for the property you pick, such as sessions by landing page and by referral source, including visits from AI assistants.

We only ask for read-only access. We cannot change anything in your Search Console or Analytics account, and we do not access Gmail, Drive or any other Google data.

3.2 How we use it

  • To show your Search Console and Analytics data in your workspace, next to your tracked rankings, AI visibility and site audit.
  • To find pages worth improving, work out the main keyword of each page, and measure whether a change you made helped.
  • To send the reports and alerts you turn on, such as the weekly email digest.
  • To answer requests from tools you connect yourself: the Ranksmile WordPress plugin and AI assistants connected through our MCP server read the same data, only for the workspace you authorize and only when you ask.
  • Sign-in data is used to create your account, keep it secure and show who you are in your team.

We use Google user data only to provide and improve these features for you. We do not use it for advertising or marketing, we do not build profiles from it for any other purpose, and we do not use it to decide on credit, insurance or employment.

3.3 Sharing

We do not sell Google user data and do not use it for advertising. We do not transfer it to anyone except: the processors that host and run the Service (section 5), under confidentiality obligations; the tools and people you send it to yourself, such as a connected WordPress site, an AI assistant connected through MCP, or a shared report link you create; and where the law requires it.

Search queries from Search Console can become the keywords of a page or article in your workspace, for example its main keyword. When we look up search results and keyword metrics for that page, or when you use AI writing, optimization or analysis on it, those keyword phrases are sent to the search-data and AI model providers listed in section 5. They receive only the phrases, not your clicks, impressions or other Search Console or Analytics reports, and use them only to return the result to us.

We do not use Google user data to develop, improve or train generalized AI or machine-learning models. Ranksmile staff do not read it, except with your permission (for example to help with a support request), for security reasons, or where the law requires it.

3.4 Storage and protection

Google user data is stored on our own servers in the EU (Frankfurt, Germany). We protect it with:

  • Encryption in transit: every connection to Ranksmile and from Ranksmile to Google uses TLS.
  • Encrypted tokens: the OAuth tokens that let us call Google APIs on your behalf are encrypted at rest with AES-256-GCM and are never shown in the app or sent to your browser.
  • Closed database: the database is not reachable from the internet, only from the application on the same servers.
  • Limited access: only the people who run the Service can reach production systems, each with their own credentials.
  • Tenant isolation: every request is checked against your organization and workspace, so other customers cannot read your data.
  • Encrypted backups kept in the EU.

We store only the Google Analytics property you picked. Analytics reports are fetched from Google when you open them and are not stored on our servers.

3.5 Retention and deletion

We keep the Search Console data we fetched (search performance and weekly page snapshots) for as long as the workspace it belongs to exists, so you can see history over time.

  • Disconnect Google at any time in Settings → Integrations. We delete the stored token and stop fetching new data.
  • Revoke Ranksmile's access from your Google account at myaccount.google.com/permissions.
  • Delete a workspace and we delete its Search Console data right away.
  • Close your account by writing to privacy@tryranksmile.com. Within 30 days we delete all Google user data and tokens we hold for you and revoke our access at Google. Backups that still contain it are deleted no later than 31 days after that.

3.6 Limited Use

Ranksmile's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

  • Provide the Service (accounts, workspaces, SEO/AI features, integrations) — contract (Art. 6(1)(b) GDPR)
  • Billing and accounting — contract and legal obligation (Art. 6(1)(b)(c))
  • Security, abuse prevention, fraud (including phone verification and one-account-per-person checks, section 2.4) — legitimate interests (Art. 6(1)(f))
  • Product analytics and improvement — legitimate interests and/or consent for non-essential cookies (Art. 6(1)(f)/(a))
  • Transactional email (confirmations, security, billing) — contract / legitimate interests
  • Marketing communications (if offered) — consent where required (Art. 6(1)(a))

5. Processors and recipients

We use infrastructure and service providers under contracts that require appropriate safeguards. Categories include:

  • Application, database and authentication hosting on our own servers at Oracle Cloud (Frankfurt, EU)
  • Payments and card fraud screening (Stripe)
  • SMS phone verification and number type lookup (Twilio)
  • Transactional email (Resend)
  • Caching / queues (Redis hosting)
  • Error monitoring (Sentry)
  • CDN, DNS and bot protection (Cloudflare)
  • Product analytics (PostHog)
  • AI model providers, when you use AI features or we analyze your pages and AI answers: OpenRouter (which forwards each request to the model provider we select, such as OpenAI), Google (Gemini API) and Anthropic
  • Search results, keyword metrics and AI answer tracking (DataForSEO, Serper)

We may disclose data if required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset sale (with notice where required).

6. International transfers

Where personal data is transferred outside the EEA/UK, we use appropriate safeguards such as EU Standard Contractual Clauses and vendor assessments, unless an adequacy decision applies.

7. Retention

We retain account and billing data for the life of the subscription and as required for legal, tax, and accounting obligations. Customer Content is retained while your workspace needs it and deleted or anonymized after account closure according to our deletion practices and the DPA, subject to legal holds.

Phone verification and abuse-prevention fingerprints (section 2.4) are kept while your account exists and for 12 months after it is deleted, then removed.

Logs:

  • Sign-in security log (IP address, approximate location, unusual sign-in flags): 90 days, then deleted automatically.
  • Application server logs (which can include IP addresses, account IDs and request details): cleared each time we update the application, which usually happens within a few days. Our web server does not keep access logs.
  • Records of changes our staff make to your account or subscription: kept as long as your billing records.
  • Error reports (Sentry) and product analytics events (PostHog): kept for the retention period of our plan with each provider.

8. Your rights

Subject to GDPR and local law, you may have the right to:

  • Access, rectify, or erase personal data
  • Restrict or object to certain processing
  • Data portability
  • Withdraw consent where processing is based on consent
  • Lodge a complaint with a supervisory authority (in Poland: UODO)

Requests: privacy@tryranksmile.com. We may need to verify your identity.

9. Security

We implement technical and organizational measures appropriate to the risk (access controls, encryption in transit, least-privilege practices, monitoring). No method of transmission or storage is perfectly secure.

10. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children. Contact us if you believe we have done so.

11. Changes

We may update this Policy. The “Last updated” date at the top of this page will change. Material updates may also be communicated in-product or by email.

12. Contact

Global Zone sp. z o.o.
ul. Michała Kleofasa Ogińskiego 11/9, 03-318 Warszawa, Poland
privacy@tryranksmile.com · kontakt@tryranksmile.com

This Policy is also available in Polish.