Sub-processors · Effective {{EFFECTIVE_DATE}}
Sub-processors
Who else handles data when you use Rankfinity, what they receive, and where.
Pending legal review — not legal advice. This list describes what the application calls today and was prepared by us; it is being reviewed by a qualified lawyer.
1 · The list
Each recipient gets only what its job needs. Most rows are requests our server makes. The names of our search-data provider and our domain-metrics provider are not shown on this page; we send them to you by email promptly after a request to {{CONTACT_EMAIL}}, and in any case before any personal data is processed for you under the Data Processing Agreement.
| Recipient | Purpose | Data | Location |
|---|---|---|---|
| Hostinger | The server, database, backups, logs and the support mailbox | All data at rest; server logs; email you send us | European Union |
| Search-data provider | Search results, map results, keyword, domain and backlink data; some AI-visibility measurements (AI search features and the ChatGPT interface) | Keywords, grid coordinates, language, device, your and your competitors' domains, URLs submitted for on-page checks, AI-visibility questions | Outside the EEA |
| Domain-metrics provider | Public domain-rating look-up | The domain being looked up | Outside the EEA |
| OpenAI | AI visibility: ChatGPT answers, and the model that writes the questions, reads the answers and summarises a site; images for Content Writer | The configured questions with the brand and domain names inside them; the answers to be read; public text of your site; image descriptions | Outside the EEA |
| Anthropic | The assistant and scheduled agent tasks, ready-made skills, Content Writer, the WordPress agent, Link Builder drafts and reply sorting, Business Profile drafts, Shopify app text (image alt text, page drafts and the llms.txt summary, written from the product's details), report text, the AI content checker and humanizer, keyword suggestions, and AI visibility (Claude answers) | Your question or instruction and the project data needed to answer it; for the Shopify app, a product's or page's title, type and the start of its text, and an image's file name (not the photo); prospect pages and outreach replies for Link Builder; review text for reply drafts, where switched on; the configured AI-visibility questions | Outside the EEA |
| Google (Gemini) | AI visibility (Gemini answers) | The configured questions with the brand and domain names inside them | Outside the EEA |
| Perplexity | AI visibility (Perplexity answers) | As above | Outside the EEA |
| Shopify | Only for a merchant who installed the Shopify app: the app's installation and the billing of its subscription and credit packs | The shop's domain and the billing request; the store's own data is described in Privacy section 3b | Under Shopify's own policy |
| Stripe | Payments, subscriptions, invoices, tax | Account email, billing name and address, VAT number, payment details (entered at Stripe, not at us) | Outside the EEA |
| Resend | Transactional email, alerts and reports, optional product email, outreach email sent through our outreach subdomain, and replies to it | Recipient address, subject and message, and the replies received | Outside the EEA |
| Google (Search Console, Analytics, Business Profile, PageSpeed, Chrome UX Report) | Only if you connect them or run a speed test | Performance rows for the property you select; reviews and posts of a connected Business Profile; OAuth tokens, stored encrypted; the URL tested | Outside the EEA |
| Microsoft | Sign-in with Microsoft, and Bing Webmaster Tools — only if you choose them | Your email address and name as sent by Microsoft; requests for the sites in your Bing account | Outside the EEA |
| IndexNow search engines (for example Bing) | Indexing feature — only for URLs you submit | The URLs you submit | Outside the EEA |
| Cloudflare | DNS and edge protection, where enabled for the domain | Request metadata: IP address, URL, user agent | Global edge |
| Web3Forms | The early-access form on the marketing site | The name, email and message you type into the form | Outside the EEA |
Caddy is the reverse proxy and TLS terminator on our own server; it is software we operate, not a separate recipient.
2 · Public look-ups
Some checks ask public services a question that carries no personal data about you. They are listed so the picture is complete:
- Public DNS resolvers (Cloudflare and Google) — a domain name, when a check reads its public DNS records (AI-readiness checks, email-address checks in Link Builder).
- The public RDAP service — a domain name, when a free tool reads its registration date.
- Google Search — the address of a page, when an index check asks whether Google shows it.
- The websites you audit — our crawler fetches their pages, identifying itself in
its user agent and respecting
robots.txt.
3 · Requests from your browser
| Recipient | When | Data |
|---|---|---|
| OpenStreetMap Foundation | Map screens in the signed-in application | Your IP address and the map area viewed, for map tiles |
| Google (Analytics 4, Tag Manager) | The marketing site and the sign-in screens, only if you accepted analytics or ads in the consent banner and your browser does not send Global Privacy Control | Visit and sign-up events and Google's own cookies — see the Cookies page |
Fonts and the map library are served from our own domain.
4 · Destinations you choose
Your WordPress site (through our plugin), your webhook endpoints, your own outgoing email server, the AI clients you connect over MCP and the people you share a report with receive what you send them. They are your recipients, not our sub-processors, and you are responsible for them.
5 · Transfers outside the EEA
The application and its database are on a server in the European Union. Where a recipient is outside the EEA, the transfer relies on the European Commission's standard contractual clauses, or on the EU–US Data Privacy Framework where the recipient is certified under it. For transfers from the United Kingdom we use the UK addendum or the UK extension to the framework. We tell you on request which mechanism applies to each recipient. We do not say that your data "stays in the EU".
6 · Changes and objections
If we add or replace a recipient that handles personal data for you, we tell you by email to your account address at least 30 days before, and update this page. You may object on reasonable data-protection grounds within that time. If we cannot resolve it, you may end the affected part of the service and receive a pro-rata refund of anything prepaid and unused. The terms for data you load about your own clients are in the Data Processing Agreement.
{{COMPANY_LEGAL_NAME}} · {{COMPANY_ADDRESS}} · {{COMPANY_VAT}} ·
{{CONTACT_EMAIL}}
Effective {{EFFECTIVE_DATE}} · Terms · Acceptable use · Privacy · Data Processing · Refunds · Cookies · Security · Copyright · Accessibility