Privacy Policy · Effective {{EFFECTIVE_DATE}}

Privacy Policy

What the Rankfinity application stores about you, why it is allowed to, who else sees it, and how you get it back or get rid of it.

1 · Who is responsible

The controller for the data described in section 3 is {{COMPANY_LEGAL_NAME}}, {{COMPANY_ADDRESS}}, company / VAT number {{COMPANY_VAT}}, represented by {{COMPANY_REPRESENTATIVE}}. All privacy contact, including any request under section 8, goes to {{CONTACT_EMAIL}}. The same applies to people in the United Kingdom (UK GDPR) and in the United States (section 11a).

For the data you load about your own clients, the roles reverse: you are the controller and we are your processor. That is section 4, and the contract for it is the Data Processing Agreement.

We have considered whether a data protection officer is required (Art. 37 GDPR) and have not appointed one; the reasoning is kept in our internal records and is reviewed when the scale or the nature of the processing changes. Our records of processing and our impact-assessment screening for the higher-risk features (outreach email, map monitoring, AI visibility) are kept internally and are available to a supervisory authority on request.

2 · What this page covers

This page is about the application at app.rankfinity.app — the thing you sign in to — and about the parts of the public marketing site at rankfinity.app that collect anything, because the marketing site links here for its privacy policy. On the marketing site: the newsletter form and the free tools are covered in section 3; the early-access form is delivered to us by Web3Forms (see the Sub-processors page) and used only to answer you; analytics, tags and the consent choice are on the Cookies page; the web host keeps server logs (section 5, Hostinger).

3 · What is collected, and why

Everything in this table is something the application actually stores. There is no category here kept "just in case".

Do you have to give it? Account, billing and project data are needed to provide the service; without them we cannot open or run the account. Everything marked optional above — name, company, phone, marketing consent, a Google or Microsoft connection — you can leave out; the account works the same. Where the basis is legitimate interest, the interest is: keeping the service secure and able to show who did what (audit log, sessions, sign-in events), keeping the free tools from being abused (free-tool log), and learning which parts of the product are used so effort goes where it matters (usage analytics, sign-in page statistics). You can object to any of these, section 8.

Browser extension (Chrome, Edge and Firefox)

The Rankfinity browser extension (the "extension") adds a side panel to your browser. It is covered by this policy as a whole; this part says what it does with your data.

What stays on your device. The panel reads the page you are viewing in your browser when you open it or switch tabs. That reading is not sent to us. The three most important fixes, the draft fixes, the task list and the keyword phrases are worked out in your browser. Your settings, your sign-in token and the notes you keep in the panel are stored in the extension's own storage on your device, and the extension does not sync them.

What we receive, and only when you act.

• The page address when you run an audit or a re-check, press Audit on a Google results page, run an AI check, or ask for the emailed report. Sensitive parts of the address, such as tokens, passwords and session identifiers, are removed first. For an AI check only the host is sent. Our server fetches the page itself and does not follow its links.
• A copy of the page's HTML, only if our server cannot reach the page and you click "audit a copy from your browser". Form fields, scripts, styles, frames, noscript blocks and graphics are removed before it is sent.
• Your email address, if you ask for the emailed report. We send the report only after you confirm the address. If you also ask for tips and offers, we send a second confirmation first, and marketing email only after that.
• The brand, questions, service and city you type for an AI check, which we put to AI assistants on your behalf.
• Your sign-in. Signing in gives the extension your name and email address, your plan and credits, and permission to run the checks you ask for. Sign out in the extension, or revoke the access under My account › Connected apps. Removing the extension does not sign you out, so sign out first.
• A shared report, only if you press Share report. The link shows the page's host and path without its query, and a copy of its score, counts and top issues as they were when you shared it. Anyone with the link can open it. It works for 30 days or until you revoke it, and the saved copy is deleted 90 days after it expires. The secret that revokes the link stays on your device.
• Domain names only. The Overview shows the Domain Rating of the site you are viewing, for which the panel sends that site's domain name. If you turn on the Google results bar, it sends us the domain names of the results on the page (up to ten), for their Domain Rating. It never sends their addresses or your search.
• Button counts. When you press Unlock all issues, Share report or run an AI check, we record the button, the day and a daily hashed visitor identifier. No address is kept with the count.
• Install and uninstall pages. When you install the extension, a welcome page on rankfinity.app opens in a new tab. When you remove it, a feedback page opens. Both addresses carry the extension version only. Uninstall feedback is stored only if you choose to send it.

Requests that do not go to us. Robots.txt and llms.txt, the link and image checks, and the reading of the Google results bar go from your browser straight to the site you are checking, or to Google. The Google results bar and the sites it reads get nothing else from us.

Links that open other sites. The Tools view links to rankfinity.app tools, which carry campaign parameters only. It also links to public checkers and to Google Maps, which open only when you click them. When you click one, your browser opens that site, and the link carries the address of the page you are viewing without its query string (or the business name on the page, for Google Maps). We do not receive it. The site you open receives it under its own privacy policy.

How long. Audit and AI check results are reused for up to 24 hours and their stored copies are deleted after 8 days. Our usage log keeps the host of an audited page and a hash of its address for 30 days. Emailed-report requests and button counts are kept for 90 days, and uninstall feedback for 180 days. A shared report follows the rule above.

Your choices. Sign out in the extension; revoke a shared link with its Revoke button; turn off the Google results bar in the extension's settings (it is off unless you turn it on); remove the optional site access in the browser's extension settings; and use the unsubscribe link in any marketing email. The extension shows no advertising and loads no analytics or advertising code.

What is deliberately absent

No session replay, no screen recording, no heat-mapping of your mouse, no keystroke capture, no advertising identifier, and no analytics cookie in the signed-in application (the sign-in screens are covered in section 9). This is a standing rule, not a description of what happens to be installed this month: the screen of this application is your clients' domains, keywords, positions and addresses, and no amount of field masking makes recording that acceptable.

Usage analytics — why legitimate interest and not consent

Two questions, answered separately. Does it store anything on your device? No cookie, no local identifier, no fingerprint: the identifier is computed on the server from the account you are already signed in to, so the consent rule for storing on your equipment is not engaged. Is the interest proportionate? The data is pseudonymised when it is recorded, contains no content, cannot identify your clients and is deleted on a fixed schedule (section 7). You may object at any time under Art. 21 GDPR, by email to the address in section 12.

Sign-in page statistics

On the sign-in, sign-up and request-access pages we count, on our own server, how people use those pages, so we can see whether they reach them and where they get stuck. For each opening of the page we record: which page it was; whether the form was started and submitted and whether that worked (as a category such as "wrong password", never the text you typed); which fields were touched and how often, never what you typed into them; clicks on the Google button and on links such as Pricing, Terms or Privacy; how many seconds the page was open in front of you; the site you came from (its host name only) and any utm_ campaign tags in the address; the device class worked out from the window width; the browser family; the browser language; and the country, taken from the network country header when there is one, otherwise from your time zone — no external location service is asked.

Your IP address is never stored in full: it is cut to its network (the first three parts of an IPv4 address, the first 48 bits of an IPv6 one). To count unique visitors we keep a hash of the address and browser made with a random key that is replaced every day and then destroyed, so the same person is counted once a day and is not followed from one day to the next: the key is destroyed by the nightly clean-up, after which the earlier hashes cannot be recomputed. Until that clean-up runs the key still exists on our server. Nothing is stored in your browser: no cookie, no local or session storage, no fingerprint; the visit identifier lives only in the open page. There is no session recording, no keystroke capture and no mouse tracking. If your browser sends Do Not Track or Global Privacy Control, the page sends nothing at all. If you then create an account, that one visit is linked to the new account only to count the sign-up; it is exported with your data and deleted with your account. The records are deleted after 90 days. Legal basis: legitimate interest in making signing up work (Art. 6(1)(f) GDPR); you can object at any time, by email to the address in section 12, or simply by turning on Do Not Track or Global Privacy Control.

3b · Shopify app

This section applies to the people at a merchant who install Rankfinity from the Shopify App Store, and to the store data we read through Shopify. It adds to the rest of this policy.

What we ask Shopify for. Write access to products (the product and collection titles, descriptions, handles, SEO title and description, and image alt text); write access to content (pages, blog articles and their SEO fields and text); write access to online store navigation (we read and add URL redirects); write access to translations (the SEO text of the published languages, without changing the main text); read access to the languages the store publishes; and the app proxy that serves the store's llms.txt file. Write access includes read access, so this is the whole list. The app asks for no customer, order or payment permission, and it does not read customer records.

What we hold. The access token Shopify gives us, encrypted; the storefront password, if you give one for a site audit, stored encrypted (the session cookie it produces is kept in memory only); the store's product, collection, page and article texts that the features work on; the Shopify user ID, email address and permission flags of each staff member who opens the app, so that we know who may approve a change; the copies of original product images kept for the undo of an image optimisation; the changes you approve and their history; and the rank, AI visibility and site audit results for the keywords, questions and pages you choose.

Why. To show the SEO gaps, and the current and the proposed text for each product, collection, page and article; to write a change to the store when you approve it, or as you set Autopilot or automatic image optimisation (both off by default), and to read it back to check that the new text is saved; to track rank and AI visibility for what you choose; and to bill the plan and the credit packs through Shopify's billing, where Shopify issues the invoice. The text that an AI model writes for an image alt text, a page draft or the llms.txt summary is written from the product's title, type, the start of its text and the file name of the image. The photo itself is not sent.

Who else sees it. The data providers and AI model providers listed in section 5 and on the Sub-processors page, for the tasks described there; and Shopify, for the billing request.

Uninstall and deletion. When the app is uninstalled, we stop reading the store and delete the access token and the storefront password. Shopify then asks us to erase the store's data (the shop-redaction request), about 48 hours after the uninstall. When that request arrives we erase the store's data: the token, the storefront password, the changes and their history, the rank, AI visibility and audit results, and the image originals. Audit log entries follow section 7. A merchant can also ask for a copy or for deletion at the address in section 12.

Customer requests. Shopify may ask us about a store customer (a data request or a redaction request). We do not read or keep customer records from a store. We search the store's records for the customer and record only the number of matches; we do not record the customer's details.

3c · Accounts created by a partner platform

A partner platform that you use may create your Rankfinity account and send us the details it holds about you: your name, your email address, whether the platform has verified that address, and the identifiers the two systems use for you and your organisation. We use them to create the account, to connect it with the platform and to sign you in through a one-time link. If an account with the same email address already exists and is not connected to that platform, we do not connect them: the platform is told only that the address is already in use. The plan the platform gives you is shown in your account. The basis is the contract with you (Art. 6(1)(b) GDPR). The platform's own privacy notice applies to what it holds.

3a · How we use your usage data

"Usage data" here means what the application records about how you use it: which actions you ran, the credits they cost, when you signed in, which screen you used and for how long, and when your last scan ran. It is not the content of your projects (section 4 covers that). We use it for these purposes, and only these:

• Operating the service — to run scans on schedule, show you your history and keep your account working. (Contract, Art. 6(1)(b).)
• Billing and credits — every credit you buy, spend or are refunded is a ledger row, so you and we can both check what an action cost, and so we can keep the accounting records the law requires. (Contract and legal obligation, Art. 6(1)(b) and 6(1)(c).)
• Security and abuse prevention — sign-in events, sessions, rate limits and the audit log, to notice someone getting into an account and to stop misuse of paid features. (Legitimate interest, Art. 6(1)(f).)
• Support — when you ask for help, a member of staff can look at your account to see what you see. (Contract and legitimate interest; see "Staff access" below.)
• Product improvement — the screen-and-seconds records described in section 3, in pseudonymised form and never including the content of your projects. (Legitimate interest, Art. 6(1)(f); you can object, section 8.)

Staff access

Staff of {{COMPANY_LEGAL_NAME}} with an administrator role can see, for each account: the email address, the plan and credit balance, the credit ledger and spend per account, the list of projects, the audit log entries for that account, the time of the last sign-in and last scan, and the date and version of the Terms you accepted, and — by looking up your pseudonym — which screens you used and for how long. Administrators can add private notes and tags to an account for follow-up; these are never shown to you or to other customers, and a note is personal data about you that you can ask to see (section 8). An administrator sees no password and no stored provider key in clear text.

Staff access is limited to what the work needs. Administrator accounts are individual, protected by sign-in, and every administrator action that changes something is written to the audit log. Opening your account is logged too: when an administrator opens your account in the admin panel — your profile, or by selecting your account so that a screen shows only your data — the administrator, the time and the network are written to the audit log, which we keep for 12 months. These routine views are not emailed to you; you can ask us for them under your right of access (section 8). "View as" sessions are also listed to you directly, as described next.

"View as" — support access to your account

To help you, an administrator can open a "view as" session that shows the application as you see it. These sessions are:

• Read-only — the session cannot change settings, send anything or spend credits; requests that would are refused and the refusal is logged.
• Time-limited — they end automatically after 30 minutes unless ended sooner.
• Logged — the start of every session is written to the audit log with who started it, when, and the reason they gave; the end is written when the session is ended or, for one that simply times out, the next time the expired session is used.
• Visible to you — the same entries are listed to you in the application, under Account › My log › Support access.

An administrator cannot start a "view as" session on another administrator, or on a suspended account.

What we do not do with it

We do not sell usage data, do not use it for advertising, and do not share it with anyone except the processors in section 5 where that is needed to run the service. We do not read the content of your projects except as described above for support, and we do not build profiles of you for any decision with legal or similarly significant effect (section 11).

How long each kind of record is kept is in section 7. Marketing email is separate and optional (section 3); the Terms and this Privacy Policy are accepted with a separate required tick at sign-up, and we store the date and version of the text you accepted, plus a salted hash of the address you accepted it from.

4 · Your clients' data

Most of what you type into this tool is about somebody else's business. Domains, business names, coordinates, and every page the crawler pulls off a site you nominated — a sole trader's business is frequently their own name, so this can be personal data.

For that content you are the controller and we are the processor. We process it on your documented instruction, which in practice means: the projects you create, the scans you schedule, and the crawls you start. We do not use it for anything else, do not combine it across accounts, and do not sell it. The full terms — sub-processors, security, breach notice, deletion — are in the Data Processing Agreement.

Your side of that bargain is section 6 of the Terms: point the crawler only at sites you own or are authorised to audit.

People whose data reaches us from public sources (Art. 14 GDPR)

Some features collect information about people who have no account and with whom we have no relationship: business listings and reviews seen in map results, the content of web pages you ask us to audit, and — if you use Link Builder — the public business contact details (name, role, email address) found on websites you want a link from. For that data you are the controller and we are your processor (section 4); we also keep a time-limited cache of contact details found on public pages (30 days by default; kept per account and never reused for another account) so that the same page is not fetched twice, and an opt-out list of addresses that must not be contacted. The source is always a public page; every outreach email carries an opt-out link, and the sending customer is responsible for stating who they are and where the address was found (the product does not add that line for you yet); an opt-out applies to all later mail. A person whose address is in the cache can ask us to erase it at {{CONTACT_EMAIL}}. Whether the sender may lawfully write to a given person (for example in the EU and the UK, where cold email to individuals is restricted) is the sending customer's responsibility; the product does not yet block those recipients, which is why real outreach sending stays switched off for the whole service until it does. Outreach is sent from the customer's own mailbox or from a dedicated outreach address on our sending subdomain, and replies come back to the customer.

Reviews. Map results and a connected Business Profile contain reviews (the reviewer's display name and text). They are shown to the customer. If reply drafts are switched on for a project, the text of each new review — not the reviewer's name — is sent to an AI provider (section 5) to draft a reply; we keep the draft, the star rating and the review's identifier, not the review. A draft is posted only when the customer approves it, except that a customer may choose to have replies to 4- and 5-star reviews posted automatically; replies to 1- to 3-star reviews always wait for a person.

5 · Who else sees it

These are the recipients. Each one gets only what its job requires. The full, current list — including what each receives and where — is on the Sub-processors page. The names of our search-data and domain-metrics providers are not published on our pages; we give them to you on request at {{CONTACT_EMAIL}}.

Transfers outside the EEA. The application and its database sit on an EU server; several of the providers above do not. Those transfers rely on the European Commission's standard contractual clauses, or on the EU–US Data Privacy Framework where the provider is certified under it; for the United Kingdom, on the UK addendum or the UK extension to that framework. We do not say that your data "stays in the EU". You can ask us for a copy of the safeguards.

Google user data

When you connect Google, Rankfinity asks only for these permissions:

• Search Console (webmasters.readonly) — clicks, impressions, CTR, position, queries, pages, countries and devices for the property you choose, shown in your project's Search Console screens, dashboard and reports.
• Google Analytics (analytics.readonly) — only when the Analytics feature is switched on for your account: sessions, users, channels, pages and key events for the GA4 property you choose, shown in your project's Analytics screens, dashboard and reports.
• Google Business Profile (business.manage) — only if the Business Profile feature is switched on for your account. Google offers no read-only permission for this product, so the permission itself also allows changes; we use it to read your profile, reviews and performance, and to post a review reply or an update only when you press the button for it. The first two permissions above are read-only.
• Your email address (openid, email) — only to show which Google account is connected, or to sign you in.

Rankfinity's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use this data only to provide and improve the user-facing features you see in the application (Search Console, Analytics and Business Profile screens, dashboard and reports), and show it to you and the people you share your project with; we transfer it to others only as needed for those features, for security or abuse prevention, to comply with the law, or as part of a merger or sale with your consent where required; we do not sell it; we do not use it for advertising; we do not use it to develop, improve or train general AI or machine-learning models; no person at Rankfinity reads it unless you ask us to for support, it is needed for security, or the law requires it. If you ask the in-app assistant a question, or connect an AI client through MCP, the rows needed to answer your question are sent to the AI model you chose or that we use for the assistant, at your request and only to answer you. You can disconnect Google at any time in Project settings › Integrations or in your Google account permissions; disconnecting deletes the stored tokens, and deleting the project or your account deletes the imported rows.

6 · Where it lives

One virtual server in the European Union, running one SQLite database. Backups are written to the same machine and rotate there. There is no second region, no data warehouse, and no copy in an analytics product.

7 · How long it is kept

What deletion actually means

Deleting your account asks for your password (if you signed up with Google, Microsoft or an emailed link and never set one, use "Forgot password" first, or write to us: erasure by email is always possible), asks you to type a confirmation word, emails you a confirmation link, and then waits seven days. You can cancel throughout. After that, the account, its projects, scans, crawled pages, AI answers, reports, sessions and stored provider keys are removed in a single transaction.

What remains is mainly an accounting record: orders, payments, credit and invoice rows that the law requires us to keep, which may still carry your internal account number. In addition, audit-log lines are kept for 12 months, a one-way hash of your email address is kept in the suppression list so that a complaint or unsubscribe is still honoured, and proof of consent is kept for the accounting period. Some operational records (for example Search Console property names and error subjects) can still be linked to the deleted account number until we purge them; needs a lawyer to confirm the periods. A business has to be able to reconcile what it invoiced, and this is the smallest version of that which still works.

The honest caveat is backups. A backup taken before your deletion still contains your data until it rotates out. If a backup ever has to be restored, the deletion is re-applied.

8 · Your rights, as buttons

You have the rights of access, rectification, erasure, restriction, portability and objection, and where processing rests on consent you may withdraw it at any time without affecting what came before. Most of them are already controls in the product rather than emails you have to send:

• Access and portability. The export button on your account screen produces a downloadable archive of your data — profile, projects, keywords, scans, reports, activity, and the credit ledger as a spreadsheet. One export every 24 hours, because it reads your whole database.
• Rectification. Name, company, time zone and email are editable in account settings.
• Erasure. The delete-account flow described in section 7.
• Your own activity. You can read the log of what has happened in your account. An action taken by an administrator on your behalf is labelled as such, never shown as if you had done it.
• Sessions. You can see every active session and end all the others.
• Email choices. Marketing consent is one switch, effective immediately and separate from the account itself; every other optional email category can be switched off in account settings or with the link at the bottom of the email.
• Assistant conversations and connections. You can delete a conversation, revoke an MCP token or remove a webhook or plugin key yourself.
• Restriction and objection. By email, under Art. 18 and Art. 21 GDPR. Where we rely on legitimate interest — the audit log, sign-in events, usage analytics, referral checks and check-in emails — tell us and we will weigh it; an objection to check-in emails is simply an unsubscribe.

For anything not covered by a button — including a copy of the administrator views of your account (section 3a) — write to {{CONTACT_EMAIL}}. We may ask you to confirm the request from the address on your account. We answer within one month. You can also complain to the data protection authority in your country, or to the one where {{COMPANY_LEGAL_NAME}} is established: in Bulgaria the Commission for Personal Data Protection; in the United Kingdom the Information Commissioner's Office.

9 · Cookies and browser storage

Inside the application, once you are signed in, there are no analytics, advertising or third-party cookies. The cookies the application sets are strictly necessary (sign-in, security, remembering a shared-link password) or come from a link you followed (the plan you clicked) — and the referral and partner cookies are set only after you have accepted them in the consent banner and never when your browser sends Global Privacy Control; without them, the referral still counts if you sign up from the link you followed, because the code travels with the sign-up request itself. The complete list, with names, purposes and lifetimes, is on the Cookies page.

The one exception is the sign-in and sign-up screens. There, Google Analytics 4 and Google Tag Manager load only if you accepted analytics in the consent banner of the marketing site (the choice is stored in the cookie rf_consent), and never when your browser sends a Global Privacy Control signal. Without that consent, nothing is requested from Google: the fonts are served from our own domain. This page itself sets no cookie and runs no script.

Browser storage (theme, language, table layout) stays in your browser and is not sent to us.

The sign-in page statistics described in section 3 store nothing in your browser at all, which is why they are not on the Cookies page (the separate analytics tag above is a different thing and is consent-based). If analytics that does store something is ever added to the application itself, it will arrive behind a consent banner with nothing pre-ticked.

10 · Security

• Passwords hashed with Argon2id; the plain password never touches the database.
• Provider API keys and OAuth tokens encrypted at rest; the encryption key is held separately from the data.
• Session cookies HttpOnly and SameSite=Lax, and Secure over HTTPS.
• Per-user isolation enforced in SQL — every query that reads your data carries your account identifier in its WHERE clause, so one account structurally cannot read another's.
• Rate limiting on sign-in and on administrative endpoints.
• Optional two-factor authentication.
• An audit log of security-relevant and administrative actions (sign-in, sharing, billing, account and project deletion, administrator actions, an administrator opening an account, "view as").
• HTTPS everywhere, with HSTS and a restrictive set of security headers at the edge.
• Staff "view as" sessions are read-only, time-limited, need a stated reason, are logged and listed to you under Account › My log › Support access, and the Search Console, Analytics and Business Profile screens are blocked in it (section 3a). Summary figures on the dashboard may still include totals drawn from them. More on the Security page.

What that does not mean: this is a small operation on a single server, with no formal certification, no security team and no third-party penetration test. Judge it as what it is. If a personal data breach occurs, affected users and the supervisory authority are notified within the deadlines the GDPR sets.

11 · Automated decisions and children

There is no automated decision-making producing legal or similarly significant effects about you, and no profiling of you as a person. The product profiles domains, not people. A few anti-abuse checks run automatically — for example the referral check (section 3), limits on the free tools and on trials — but they only hold a reward or a request for review, or apply a published limit; a person decides anything that goes further, and you can ask for that review at the contact address.

The service is a professional tool. It is not directed at children and accounts are not knowingly issued to anyone under 18. If we find that an account belongs to someone under 18, we close it and delete its data.

AI features. Some features use AI models of the providers in section 5 to produce text or to check what AI assistants say about a brand. Their output is a draft for you to review; no decision with legal or similarly significant effect about a person is taken by it.

11a · United States residents

Do not sell or share my personal information: there is nothing to opt out of in the application, because we do not sell personal information. The application does not share it for cross-context behavioural advertising, with one exception that is consent-based: if you accept "ads" in the consent banner, the marketing site and sign-in screens may load Google Tag Manager and Google Ads signals, which is "sharing" in the California sense. We treat a Global Privacy Control signal as an opt-out of both and then load nothing. You can also withdraw by deleting the cookie rf_consent (Cookies page). If you live in California, Colorado, Connecticut, Virginia or another state with a privacy law, you can ask us to tell you what we hold, to correct it, to delete it, or to give you a copy, at {{CONTACT_EMAIL}}; we will not treat you worse for asking, and we will answer within the time your state sets (45 days in California). We honour these requests whether or not a particular state law applies to us. Sensitive personal information as those laws define it — such as your account login — is used only to provide the service and keep it secure. Categories (last 12 months). Identifiers (email, name, network address) and commercial information (plan, credit ledger, invoices) are collected from you and, for payments, from Stripe; internet activity (usage analytics, sign-in events) is collected from your browser; professional information (company) from you. They are used for the purposes in section 3 and disclosed to the processors in section 5, and not sold or shared; retention is in section 7. Rights: know, delete, correct, opt out of sale/sharing, and non-discrimination. We verify a request by asking the signed-in account, or by a confirmation email to the address on file; an authorised agent can write to the same address with your written permission. We answer within 45 days (extendable once by 45).

12 · Changes and contact

This page is updated when the practice changes, and the effective date at the top moves with it. A change that materially affects what is collected or who receives it is announced by email at least 30 days before it takes effect; a new recipient is also announced on the Sub-processors page.

Contact for everything on this page: {{CONTACT_EMAIL}}.

{{COMPANY_LEGAL_NAME}} · {{COMPANY_ADDRESS}} · {{COMPANY_VAT}} · {{CONTACT_EMAIL}}
Effective {{EFFECTIVE_DATE}} · Terms · Acceptable use · Data Processing · Refunds · Sub-processors · Cookies · Security · Copyright · Accessibility