1. Who we are

RankCited ("we", "us") runs rankcited.com and the RankCited app. For the personal data described in this policy we are the data controller. Where we process personal data on a client's behalf inside the service, we act as their processor under our Data Processing Agreement.

Postal address: 2803 Philadelphia Pike, Suite B #1019, Claymont, DE 19703, USA. Privacy questions: [email protected].

2. What we collect

• Account data — name, email address, password (stored hashed), company name, and your account settings.
• Brand and website data — the domains, brands, markets, competitors, goals and target pages you give us, and public content we fetch from those websites to analyse them.
• Billing data — plan, invoices and credit balance. Card details are collected and stored by Stripe; we never see or store full card numbers.
• Publisher data — websites you list, their metrics, placement history, and the payout and tax details needed to pay you.
• Communications — emails and support messages you send us, and whether you open or act on our emails.
• Usage and device data — IP address, browser, pages visited and actions in the app, recorded in server logs and, with your consent, in Google Analytics.
• Outreach contacts — see section 5.

3. How we use it, and on what legal basis

• To run the service you signed up for — accounts, visibility measurement, action plans, placements, publisher payouts, billing and support. Basis: performance of our contract with you.
• To keep the service secure and improve it — fraud prevention, abuse detection, debugging and product analytics. Basis: our legitimate interests.
• To tell you about the service — service emails (reports, alerts, billing notices) are part of the contract; marketing emails are sent only where the law allows, and every one carries an unsubscribe link. Basis: contract, legitimate interests or consent.
• Analytics cookies. Basis: consent.
• Tax, accounting and legal requests. Basis: legal obligation.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

4. AI processing

To measure how AI assistants describe your brand and to draft content, we send prompts, brand names, market descriptions and website text to AI model providers (listed in our DPA). We send only what the task needs and never send payment data. We do not use your data to train AI models, and we use provider API terms under which inputs are not used for model training.

5. Website owners we contact (outreach)

To build our publisher network we contact owners and editors of websites. We collect their business contact details (name, role, email address, website) from the public pages of those websites, and record whether they reply or opt out. We do this on the basis of our legitimate interest in offering them paid publishing work.

Every outreach email includes an unsubscribe link. If you use it, or email [email protected], we stop contacting you and keep only what we need to make sure we do not contact you again. Contacts who never engage are deleted after 24 months.

6. Who we share it with

We share personal data only with:

• Service providers who host, process payments, send email, run AI models or supply search data for us, under contracts that limit them to our instructions. The current list is in our Data Processing Agreement.
• Publishers and clients, as far as a placement requires — for example, a publisher sees the brief and the brand it is for.
• Authorities, when the law requires it, or to protect our rights and prevent fraud.
• A buyer of our business, under the same protections, if RankCited is sold or merged.

7. International transfers

We are based in the United States and our providers mainly process data in the United States and the European Union. When personal data from the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or the provider's certification under the EU-US Data Privacy Framework.

8. How long we keep it

• Account, brand and website data: while your account is open. After you ask us to close it, we delete it within 30 days.
• Invoices and payment records: as long as tax and accounting law requires, usually up to seven years.
• Server logs: up to 12 months.
• Outreach contacts: as in section 5.
• Backups roll off on their normal cycle, within 35 days.

9. Security

Data is encrypted in transit (TLS) and at rest, access is limited to staff who need it, and passwords are stored hashed. No system is perfectly secure; if a breach affects your personal data, we will tell you and the relevant authorities as the law requires.

10. Your rights

Depending on where you live, you can ask us to:

• give you a copy of your personal data, or send it to another service;
• correct it or delete it;
• restrict or object to how we use it, including for direct marketing;
• withdraw a consent you gave, at any time.

California residents have the right to know, delete and correct personal information and to not be discriminated against for using these rights. We do not sell or share personal information as the CCPA defines those terms.

Email [email protected] to use any of these rights. We reply within 30 days and may need to confirm your identity first. If you are in the EU, EEA or UK, you can also complain to your local data protection authority.

11. Cookies

• Essential cookies keep you signed in and remember your language, selected brand and cookie choice. They are needed for the site to work and do not need consent.
• Analytics cookies (Google Analytics) are set only if you accept them in the cookie banner. Until you do, Google Analytics receives only cookieless, anonymous signals. You can change your choice by clearing the rc_consent cookie, which brings the banner back.

We do not use advertising cookies.

12. Children

RankCited is a business service and is not meant for anyone under 16. We do not knowingly collect their data.

13. Changes to this policy

We will update the date at the top when this policy changes, and email account holders before any change that materially affects how we use their data.

14. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Email: [email protected]

Mail: RankCited, 2803 Philadelphia Pike, Suite B #1019, Claymont, DE 19703, USA