This document is not finalised: company legal name, company address, company vat, contact email, effective date, company representative still missing. It is published for reference and is not a binding agreement.
Rankfinity

Data Processing Agreement · Effective {{EFFECTIVE_DATE}}

Data Processing Agreement

For agencies and anyone else using Rankfinity to work on a third party's website. This is the Article 28 GDPR contract between you, as controller, and us, as processor.

Pending legal review — not legal advice. This agreement describes what the application does today and was prepared by us; it is being reviewed by a qualified lawyer.

When this applies. It applies automatically the moment you add a domain, keyword, business location or crawl target that belongs to someone other than you. It forms part of the Terms of Service. If your own client requires a signed copy, fill in the parties below, print it, and send it to {{CONTACT_EMAIL}} — we counter-sign.

  1. The parties
  2. Subject matter and duration
  3. Processing on documented instructions
  4. Confidentiality
  5. Security
  6. Sub-processors
  7. International transfers
  8. Assistance with data subject requests
  9. Personal data breaches
  10. Return and deletion
  11. Audits and information
  12. US state privacy laws (CCPA/CPRA)
  13. Liability, precedence, law
  14. Annex I — what is processed
  15. Annex II — sub-processors
  16. Annex III — security measures

1 · The parties

ControllerProcessor
WhoYou — the Rankfinity account holder {{COMPANY_LEGAL_NAME}}, represented by {{COMPANY_REPRESENTATIVE}}
AddressThe address on your account{{COMPANY_ADDRESS}}
VAT / company no.Yours{{COMPANY_VAT}}
ContactThe email on your account {{CONTACT_EMAIL}}

Where you process personal data as a processor for your own client, this agreement operates as the sub-processing terms your client's contract requires, and your client is the ultimate controller.

2 · Subject matter and duration

Subject matter. Provision of the Rankfinity application: local and organic rank tracking, site crawling and auditing, keyword, competitor, content-gap and backlink research, AI visibility measurement, the data imported from Google and Bing services you connect, Content Writer and the WordPress agent, Link Builder, the assistant and ready-made skills (in the application and over MCP), reports, share links and client access.

Nature and purpose. Storing what you enter, sending the necessary parts of it to the sub-processors in Annex II in order to obtain search, keyword and AI-answer data, storing the results, and presenting them to you and to whoever you share a report with.

Duration. For as long as your account exists, and thereafter only for the deletion window in section 10.

The categories of personal data and of data subjects are in Annex I.

3 · Processing on documented instructions

We process the personal data covered by this agreement only on your documented instructions, including on transfers, unless required otherwise by law that applies to us — in which case we tell you before processing, unless that law forbids it.

What counts as your instruction, concretely: the projects you create, the keywords and locations you configure, the crawls you start, the AI questions you enable, the scheduled scans you leave running, the connections you make, the content you ask to be drafted or published, the outreach you approve, the reports, share links and client access you set up, the actions an AI client you connected takes in your account, and this agreement together with the Terms. Nothing else.

Destinations you choose — your WordPress site, your webhook endpoints, your own outgoing email server, the AI clients you connect and the people you share with — receive data on your instruction. They are your recipients, not our sub-processors.

We tell you if, in our opinion, an instruction infringes the GDPR or other data protection law. We are entitled to refuse to carry it out until it is corrected.

Your warranty on crawl targets. You confirm that you have a lawful basis and the website owner's authority for every domain, business location and crawl target you enter. The application will fetch what you point it at; it cannot know whether you were allowed to. This is the one obligation in this agreement that we cannot check for you.

4 · Confidentiality

Access to your data is restricted to people who need it to run or support the service — people with an administrator role, each using an individual account — and everyone with such access is bound by a duty of confidentiality that survives the end of their engagement.

Administrative access to an account is recorded in the audit log and attributed to the administrator, never presented as if you had performed the action: opening an account in the admin panel is logged with the administrator and the time, and kept for 12 months. A support "view as" session is read-only, ends after 30 minutes, needs a recorded reason, and is listed to the account holder under Account › My log › Support access; the Search Console, Analytics and Business Profile screens are blocked in it.

5 · Security

We implement appropriate technical and organisational measures under Art. 32 GDPR. The measures in force are listed in Annex III — that annex is descriptive of what is implemented, not aspirational. We may change a measure for an equivalent or better one; we will not materially reduce the overall level of security during the term.

6 · Sub-processors

You give general written authorisation for the sub-processors listed in Annex II. Each is engaged under a written contract imposing data protection obligations equivalent to those in this agreement, and we remain fully liable to you for their performance.

The name of the search-data provider is not published on our public pages; we send it to you by email promptly after your request, and before any personal data is processed for you.

If we intend to add or replace a sub-processor, we give you 30 days' notice by email to your account address. You may object on reasonable data protection grounds within that period. If we cannot resolve the objection, you may terminate the affected part of the service and receive a pro-rata refund of anything prepaid and unused.

7 · International transfers

The application and its database are hosted in the European Union. Several sub-processors in Annex II are outside the European Economic Area. Those transfers are made under the European Commission's standard contractual clauses, or under an adequacy decision where one covers the provider, and Annex II says which applies to each.

The current list, with what each recipient receives and a 30-day change notice, is on the Sub-processors page. For transfers from the United Kingdom the UK addendum to the standard contractual clauses applies. Annex II states the location of every recipient. A recipient whose location we cannot establish would be marked as such rather than guessed at in the flattering direction.

8 · Assistance with data subject requests

Requests from data subjects come to you, not to us — you are the controller and it is your relationship. If one reaches us directly, we do not answer it on the merits; we forward it to you without undue delay.

We help you answer, taking into account the nature of the processing and the information available to us. In practice most of the help is self-service: the account export produces a machine-readable copy of everything held for your account, and project and account deletion are buttons you control. Where a request needs more than those, write to {{CONTACT_EMAIL}} and we will assist within a period that lets you meet your own deadline.

We also assist, on the same basis, with your obligations under Art. 32 to 36 GDPR — security, breach notification, data protection impact assessments and prior consultation.

9 · Personal data breaches

We notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting data processed under this agreement. The notice describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

The 48 hours are deliberately shorter than the 72 hours Art. 33(1) GDPR gives you, so that you can meet your own deadline to the supervisory authority.

Where the full picture is not available within 48 hours, we send what we have and follow up in phases rather than delaying the first notice. We do not notify supervisory authorities or data subjects on your behalf unless you ask us to in writing.

10 · Return and deletion

At any time during the term you can export your data yourself from the account screen, in a machine-readable format. Do that before you close the account, because after deletion there is nothing left to export.

On termination, and at your choice, we delete or return the personal data. If you choose deletion, or make no choice, the deletion runs on the schedule in the Privacy Policy: confirmation, then seven days, then removal of the account and everything belonging to it in a single transaction.

Two exceptions, stated rather than hidden. Backups taken before deletion still contain the data until they rotate out of the backup window; if one is ever restored, the deletion is re-applied. And an accounting record — orders, payments and credit rows, without email, name or domain but under an internal account number — is retained for as long as accounting and tax law requires.

11 · Audits and information

We make available the information necessary to demonstrate compliance with Art. 28, and allow and contribute to audits, including inspections, by you or an auditor you mandate.

Practically: the first line is this document plus written answers to your questions, at no charge. An on-site or remote inspection may be requested once in any 12-month period, on 30 days' notice, at a time that does not disrupt the service, subject to confidentiality, and at your cost — except where an audit uncovers a material breach by us, in which case we bear it. An audit required by a supervisory authority is not limited by this paragraph.

There is no third-party certification or penetration-test report to hand you today. Saying so is part of the disclosure.

12 · US state privacy laws (CCPA/CPRA and similar)

This section applies where you are a "business" (or "controller") under the California Consumer Privacy Act as amended (CCPA/CPRA) or a similar US state law and the personal information in the service relates to US consumers. In that case Rankfinity acts as your service provider (or processor/contractor) and:

  1. processes the personal information only for the business purposes in section 2 and Annex I — running the service for you — and for no other commercial purpose;
  2. does not sell or share the personal information (as those words are defined in the CCPA);
  3. does not retain, use or disclose it outside the direct business relationship between you and us, or for any purpose other than the business purposes above;
  4. does not combine it with personal information it receives from another source or collects from its own interactions with the consumer, except as the CCPA permits for the business purposes;
  5. complies with the CCPA as it applies to a service provider and gives the same level of privacy protection as the CCPA requires of you; and tells you promptly if it can no longer meet these obligations;
  6. allows you, on reasonable notice, to take reasonable and appropriate steps to make sure we use the information consistently with your obligations (the information and audit terms in section 11), and to stop and remediate unauthorised use;
  7. helps you respond to consumer requests to know, delete and correct (section 8); and engages sub-processors only under written terms that bind them to these same restrictions (section 6).

We certify that we understand these restrictions and will comply with them. The business purposes are those in section 2 and Annex I.

13 · Liability, precedence, law

Liability under this agreement is subject to the limitations in the Terms of Service, except where those limitations are not permitted by data protection law.

If this agreement conflicts with the Terms of Service on the processing of personal data, this agreement prevails. On everything else, the Terms prevail. Governing law and jurisdiction are those in the Terms.

Annex I — what is processed

Categories of data subjects

Categories of personal data

CategoryExamples
Account data Email address, password hash, name, company, time zone
Technical account data Session records with the IP address truncated to its network, browser and device string, sign-in events including failures
Project configuration Domains, keywords, business names and identifiers, geographic coordinates, competitor domains
Results Ranking positions over time, crawled page content from sites you nominated, audit findings, AI assistant answers and the mentions and citations extracted from them
Outreach (Link Builder) Business contact email address, name and role found on public pages; the messages you send and the replies received
Imported Google data Rows you import from Search Console, Analytics and Business Profile for properties you select (queries, pages, countries, devices, sessions; reviews with the reviewer's display name and text)
Imported Bing data Rows from Bing Webmaster Tools for the sites in the key you connect
Content and conversations Drafts written with Content Writer, changes requested through the WordPress agent, questions to the assistant and its answers, and bot visits reported by the WordPress plugin (bot, page, time — no visitor IP address)
CommercialCredit ledger entries and the actions they paid for
AccountabilityAudit log of state-changing actions

No special categories. The service is not designed for, and must not be used to process, data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, or data about sex life or sexual orientation. Do not enter it, and do not point the crawler at a site whose page content consists of it.

Frequency and duration

Continuous for the duration of the account: on demand when you run something, and on the schedule you configure for recurring scans.

Annex II — sub-processors

This annex is the list on the Sub-processors page at the time you read it, which also lists public look-ups that carry no personal data. The name of the search-data provider and of the domain-metrics provider is sent to you on request (section 6).

Sub-processorPurposeDataLocation
HostingerHosting of the server, database and backups All data at rest, and server logsEuropean Union
Search-data providerSearch, map, keyword, domain and backlink data; some AI-visibility measurements Keywords, grid coordinates, language, device, your and your competitors' domains, URLs submitted for on-page checks, AI-visibility questions Outside the EEA — standard contractual clauses
Domain-metrics providerPublic domain-rating look-up The domain being looked upOutside the EEA — standard contractual clauses
OpenAIAI visibility (ChatGPT answers; writing the questions and reading the answers); images for Content Writer The configured questions and the brand and domain names inside them; the answers; public text of the site; image descriptions Outside the EEA — standard contractual clauses or the EU–US Data Privacy Framework
AnthropicAssistant and agent tasks, ready-made skills, Content Writer, the WordPress agent, Link Builder drafts and reply sorting, Business Profile drafts, report text; AI visibility (Claude answers) The instruction and the project data needed for it; prospect pages and outreach replies; review text, where reply drafts are switched on; the configured questions Outside the EEA — standard contractual clauses
GoogleAI visibility — Gemini answers The configured questions and the brand and domain names inside them Outside the EEA — standard contractual clauses or the EU–US Data Privacy Framework
PerplexityAI visibility — Perplexity answers As aboveOutside the EEA — standard contractual clauses
ResendTransactional email, alerts and reports, optional product email, outreach email sent through our outreach subdomain on the controller's instruction, and replies to it Recipient address, subject and message body; for outreach, the replies received Outside the EEA — standard contractual clauses
StripePayments, invoices and tax Billing name and address, VAT number, payment details and invoice records of the account holder Outside the EEA — standard contractual clauses or the EU–US Data Privacy Framework
GoogleSearch Console, Analytics, Business Profile, PageSpeed and Chrome UX Report — only if the controller connects them or runs a speed test Performance rows for the property selected; reviews and posts of a connected Business Profile; the OAuth tokens, stored encrypted; the URL tested Outside the EEA — standard contractual clauses or the EU–US Data Privacy Framework
Microsoft"Sign in with Microsoft" and Bing Webmaster Tools — only if the user chooses them Email address and name of the user; requests for the sites in the connected Bing account Outside the EEA — standard contractual clauses or the EU–US Data Privacy Framework
IndexNow search engines (for example Bing)Indexing feature — only for URLs the user submits The URLs submittedOutside the EEA — standard contractual clauses
CloudflareDNS and edge protection, where enabled for the domain Request metadata — IP address, URL, user agent Edge, global — standard contractual clauses

Caddy is the reverse proxy and TLS terminator, running on the Hostinger server. It is software we operate ourselves, not a separate recipient, and is listed here only so that the edge is fully described. The transfer mechanism shown for each recipient is confirmed to you on request.

Annex III — security measures

Every measure below is implemented today. It is not a roadmap.

MeasureHow
Password storage Argon2id hashing. Plain passwords are never stored and cannot be recovered — only reset. Sign-in timing is padded so that a non-existent email cannot be distinguished from a wrong password.
Encryption at rest for credentials Provider API keys and OAuth tokens are encrypted with Fernet before being written to the database. The key is held outside the database.
Encryption in transit HTTPS everywhere, with HSTS, and TLS certificates renewed automatically at the edge.
Session handling Session cookies are HttpOnly, so no script can read them, and SameSite=Lax, so they are not sent from other sites; Secure in production. Sessions expire after 30 days and the account holder can end all other sessions.
Per-user data isolation Enforced in SQL: every query that reads account data carries the account identifier in its WHERE clause, so one account structurally cannot reach another's rows. This is held in place by an automated check that fails the build if a query loses its filter.
Access control Accounts are created by invitation or, while public sign-up is open, by registration; spending credits can require a confirmed email address. Optional two-factor authentication. Staff support access is read-only, limited to 30 minutes, needs a recorded reason, is logged and listed to the account holder under Account › My log › Support access, and the Search Console, Analytics and Business Profile screens are blocked in it. Administrative endpoints are separately guarded and return "not found" rather than "forbidden" to a non-administrator, so the surface is not enumerable.
Rate limiting Sliding-window limits on sign-in and administrative endpoints, keyed by network and endpoint group, so that probing does not slip under a per-path counter.
Audit logging Security-relevant and administrative actions (sign-in, sharing, billing, account and project deletion, administrator actions, an administrator opening an account, "view as") are recorded with actor, object and time, and kept for 12 months. Administrative actions taken on an account are attributed to the administrator, never to the account holder.
Data minimisation IP addresses in session, sign-in and audit-log records are truncated to their network before storage. Email message bodies are never written to logs, because a reset email contains a live token, and the copy in the mail queue is emptied 7 days after sending. Card identifiers and cardholder names used for referral checks are kept only as keyed hashes.
Backups and recovery Automated database backups on a rotating retention window, plus a copy taken immediately before each deployment and before a project is deleted. Restores are tested against a copy, not against the live database.
Segregation and hardening The application runs in a container on a dedicated virtual server in the EU, behind a reverse proxy that sets HSTS, frame-denial, content-type-nosniff and a restrictive referrer policy.
Deletion Account and project deletion run as single transactions covering every table that holds the data, so a partial deletion cannot leave orphaned client data behind.

Signature

Where a signed copy is required, both parties complete the following.

ControllerProcessor
Name{{COMPANY_LEGAL_NAME}}
Signatory{{COMPANY_REPRESENTATIVE}}
Position
Date
Signature

{{COMPANY_LEGAL_NAME}} · {{COMPANY_ADDRESS}} · {{COMPANY_VAT}} · {{CONTACT_EMAIL}}
Effective {{EFFECTIVE_DATE}} · Terms · Acceptable use · Privacy · Refunds · Sub-processors · Cookies · Security · Copyright · Accessibility