Privacy Policy

This policy describes how RankYak ("RankYak," "we," "us," or "our") collects, uses, shares, and keeps personal information across https://rankyak.com, the RankYak application, and the connections you make to RankYak from other software. It is written to comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

This policy is effective as of September 4, 2026 and was last updated on September 4, 2026.

1. Information We Collect

We collect information you provide to us, information the service produces while it works for you, and information your devices send while you use the service.

1.1. Log Data

When you visit our website or use the application, our servers log the standard data your browser or client provides: your IP address, browser type and version, the pages you visit, the time and date of each request, and technical details of any errors. We use this data for troubleshooting, security, and improving the service.

1.2. Personal Information

We ask for the following personal information:

• Name
• Email address
• Website URL(s)
• Payment information, processed by our payment processor Stripe. Subscriptions started before our move to Stripe are processed by Lemon Squeezy until they end.
• Website access credentials for the platforms you connect to RankYak (see Section 7)

Signing in uses your Google account or a link sent to your email address. RankYak does not store a password for your account.

1.3. User Content

As part of using the service, you provide content such as your website's address, a description of your business and audience, keywords, money pages, feedback on articles, and any instructions you type into the application ("User Content"). We process User Content to research keywords, plan a content calendar, write articles, and publish them to your website. See our Terms of Service for how User Content and generated content are handled.

1.4. Content Read From Your Website and Search Console

To do its work, RankYak reads the public pages of the website you connect and, when you connect Google Search Console, the search impressions, clicks, and positions Google reports for that website. We keep the pages and rows we read so that the site audit, the topical map, and the reports can compare them over time.

1.5. Copilot Conversations

The copilot inside the application is a chat assistant. We store each conversation, including your messages, the assistant's replies, and the tool calls the assistant made, so that you may return to it and so that the assistant may recall an earlier conversation when you refer to it. Credentials you paste into a conversation to connect a platform are removed from the stored conversation as soon as the connection is made.

1.6. Cookies and Similar Technologies

We use cookies and similar technologies (such as pixels) to operate the service, to understand how it is used, and to measure our advertising. A cookie is a small piece of data our website stores on your device.

We use the following types of cookies:

• Essential cookies: necessary for the operation of the website and the application, such as keeping you signed in.
• Performance cookies: tell us how the website and the application are used, so that we may improve them.
• Functionality cookies: remember the choices you make, such as the site you last opened.
• Advertising cookies: measure the effectiveness of our advertising and limit how often you see an advertisement.

The following third-party services may set cookies or receive events from our website and application:

• PostHog: product analytics, so that we may see which features are used and where errors occur. (https://posthog.com/privacy)
• Google Tag Manager and Google Analytics: website analytics. (https://policies.google.com/privacy)
• Google Ads: advertising measurement. (https://policies.google.com/privacy)
• Meta Ads: advertising measurement. (https://www.facebook.com/privacy/policy/)
• X Ads: advertising measurement. (https://x.com/en/privacy)
• Reddit Ads: advertising measurement. (https://www.reddit.com/policies/privacy-policy)
• Affonso: affiliate referral tracking, so that a partner who referred you is credited. (https://affonso.io/privacy)

You may control or disable cookies through your browser settings. However, disabling essential cookies prevents you from signing in.

2. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), we rely on the following legal bases to process your personal information:

• Contractual necessity: processing is necessary to perform the contract you enter into with us (our Terms of Service), or to take steps at your request before entering into it, such as creating an account.
• Legitimate interests: we process personal information to improve the service, to market it, and to prevent fraud and abuse, where those interests are not overridden by your rights and freedoms.
• Consent: in some cases we rely on your consent, for example for marketing communications or for connecting a third-party assistant to your account. You may withdraw consent at any time.

3. How We Use Information

We collect, hold, use, and disclose information for the following purposes:

• To provide the service: researching keywords, planning a calendar, writing and refreshing articles, auditing your website, and publishing to the platform you connect.
• To process payments for your subscription.
• To contact you about your account, your sites, and support requests.
• To send you emails about articles that are ready and periodic reports, which you may turn off per site.
• For analytics and product development, including to operate and improve the website and the application.
• For advertising and marketing, including promotional information about our products, which you may opt out of at any time.
• For internal record keeping and administrative purposes.
• To comply with our legal obligations and resolve disputes.
• For security and fraud prevention, and to make sure the service is used in line with our Terms of Service.

4. AI Processing

RankYak's core features are performed by large language models operated by third-party providers. To do its work, RankYak sends the relevant User Content, pages read from your website, Search Console rows, and the article in question to one or more of the following providers, and receives the generated text or image back:

• Anthropic (https://www.anthropic.com/privacy)
• OpenAI (https://openai.com/policies/privacy-policy)
• Google (https://policies.google.com/privacy)

We use these providers under their business terms, which do not permit them to train their models on the content we send.

RankYak does not train its own models on your User Content.

5. Connected AI Assistants

You may connect an AI assistant you use elsewhere, such as Claude or ChatGPT, to your RankYak account through our MCP server. This section applies when you do.

• Authorization: each assistant is connected by you, in your browser, on a RankYak page where you review the request and approve it. Nothing is connected without that approval. The approval grants the assistant an access token that expires after 7 days and a refresh token that expires after 30 days of disuse; you may revoke a connection at any time by disconnecting the RankYak connector inside the assistant.
• What a connected assistant can reach: everything your account can reach, except billing, deleting sites, organizations, or members, and connecting platforms that sign in with OAuth. It can read your sites, keywords, calendar, articles, revisions, site audit findings, money pages, and your organization's members and pending invitations, and it can change them, publish articles to your connected platform, and connect a platform when you give it the credentials.
• What the assistant's operator receives: the assistant's operator (for example Anthropic or OpenAI) receives whatever the assistant reads through the connection, as part of your conversation with it, under that operator's own privacy policy. RankYak does not control what the operator keeps.
• What we record: we record each request an assistant makes, with the name of the tool, the arguments, the response, the duration, and your account, in our product analytics, so that we may see which capabilities are used and where they fail. Arguments and responses are truncated, and credentials you pass to a connect tool are not written to the record.

6. Disclosure of Personal Information to Third Parties

We disclose personal information to the following categories of recipients:

• Service providers who process it on our behalf:
  • Payment processors (Stripe; Lemon Squeezy for subscriptions started before our move to Stripe)
  • Hosting, database, storage, and content delivery providers
  • AI model providers (Anthropic, OpenAI, Google), as described in Section 4
  • Keyword and search data providers, which receive the keywords and the website address we research
  • Web crawling providers, which receive the addresses of the pages we read
  • Google Search Console, which we read on your behalf when you connect it
  • Search engine indexing services, which receive the addresses of articles we publish
  • Email delivery and customer messaging providers, which receive your email address and the emails we send you
  • Product analytics and error monitoring providers
  • Advertising and affiliate platforms named in Section 1.6
• The platforms you connect: the content management system or website platform you connect receives the articles and images we publish there, and the operator of a connected AI assistant receives what the assistant reads (Section 5).
• Other members of your organization: members of an organization see each other's name and email address, and every member can see and manage the organization's sites.
• Affiliates: a parent, subsidiary, or affiliate of our company.
• Legal authorities: courts, regulators, and law enforcement, as required by law or to establish, exercise, or defend our legal rights.

Our service providers are bound by contracts that require them to protect personal information in accordance with applicable data protection law and to use it only to provide their service to us.

7. Website Access Credentials

To publish content to your website, you connect the content management system or website platform you use. Depending on the platform, this means giving RankYak an application password, an API key, or an OAuth authorization granted on the platform's own sign-in page.

• Security: credentials and OAuth tokens are stored encrypted, and are used only to publish and update your content and to read the lists the platform offers (such as categories or authors) so that you may choose where articles go.
• Your responsibility: you are responsible for the security of the credentials you provide and for actions taken on your platform through them. Use a credential with the smallest permissions the platform allows.
• Revoking access: disconnecting the integration in RankYak deletes the stored credential or token. You may also revoke access on the platform's side by changing the credential or removing RankYak from the platform's connected applications. The same applies to Google Search Console: disconnecting it in RankYak deletes the stored tokens, and you may revoke RankYak from your Google account at any time.

8. International Data Transfers

The personal information we collect may be stored and processed in countries other than your country of residence, including the United States, where several of the providers named above operate. Those countries may have data protection laws that differ from the laws of your country.

For transfers outside the EEA, we rely on appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission, the EU-US Data Privacy Framework where the recipient is certified, or other legally recognized mechanisms.

9. Data Security

We implement commercially reasonable measures to protect personal information from loss, theft, unauthorized access, disclosure, copying, use, or modification, including:

• Encryption of data in transit and at rest.
• Access controls that restrict access to personal information.
• Regular security assessments and updates.

However, no method of electronic transmission or storage is completely secure, so we cannot guarantee absolute security. We will comply with the laws applicable to us in the event of a data breach.

10. Your Rights (GDPR and Other Rights)

If you are located in the EEA, you have the following rights under the GDPR:

• Right of access: to request a copy of the personal information we hold about you.
• Right to rectification: to request that we correct inaccurate or incomplete personal information.
• Right to erasure: to request that we delete your personal information, subject to exceptions such as a legal obligation to retain it.
• Right to restrict processing: to request that we restrict processing in certain circumstances.
• Right to data portability: to receive your personal information in a structured, commonly used, machine-readable format.
• Right to object: to object to processing based on legitimate interests and to processing for direct marketing.
• Right to withdraw consent: where processing is based on consent, to withdraw it at any time.

You may also have similar rights under other data protection laws. You may delete your own account from your profile page in the application, and you may exercise any of these rights by contacting us using the details below.

11. How Long We Keep Your Personal Information

We keep personal information only for as long as we need it to provide the service, for legitimate business purposes, or as required by law. In particular:

• An account that never verifies its email address is deleted automatically.
• When you delete your account, or an organization or site is deleted, its records are removed from the application immediately and erased from our systems and backups within 90 days, except where we must keep a record to comply with a legal obligation such as tax law.
• Copilot conversations and the record of connected-assistant requests are kept while the account exists.
• Pages read from your website that the service no longer needs are deleted after 90 days.
• Log data is kept for a limited period for troubleshooting and security.

12. Children's Privacy

The service is not directed at children under 16, and we do not knowingly collect personal information from them. If you believe we have collected personal information from a child under 16, please contact us.

13. Complaints

If you believe we have breached a data protection law and wish to complain, please contact us using the details below with the details of the alleged breach. We will investigate and respond in writing with the outcome and the steps we will take. You also have the right to complain to a data protection authority, such as the Autoriteit Persoonsgegevens in the Netherlands.

14. Changes to This Policy

We may change this policy to reflect changes to the service, to our providers, or to the law. If we make significant changes, we will notify you by a notice on our website or by email. Your continued use of the service after a change means you accept the updated policy.

15. Contact Us

For questions about your privacy, or to exercise your rights, contact us at:

RankYak [email protected]