Privacy policy

OneRank is run by [Company legal name], [registered address]. We are responsible (the “controller”) for the personal data described here. Contact us about privacy at [privacy contact email]. [If required: our data protection representative / officer is [name and contact].]

• Account details: your name, email address and team membership, so you can log in and work with your team.
• Billing details: your plan, invoices and Stripe customer reference, so we can charge for paid plans. Card details are held by Stripe and never reach us.
• Your projects: the websites, keywords, competitors and settings you add, plus the results we gather for them (rankings, site audit findings, backlinks, reports).
• Google data you connect: if you connect Google, we ask for read-only access to Google Search Console (the webmasters.readonly permission) and Google Analytics (the analytics.readonly permission). We can't change anything in your Google account. For the projects and properties you choose, we download and store the search numbers (clicks, impressions, click-through rate and position by day, search and page) and the visit numbers (sessions, users, engaged sessions and key events by day, landing page and channel). They are used only to show them to your team and in the AI features you use. Disconnecting Google, choosing a different property or deleting the project deletes the downloaded data, and Google's own settings let you remove our access at any time. OneRank's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements: we don't sell it, use it for advertising, or let people read it except as needed to run the service or where the law requires.
• AI conversations: questions you ask the AI copilot and its answers, so you can see them again and so we can count AI credits.
• Emails we send: a record of account emails (welcome, plan confirmation, trial reminders, reports) so we never send the same one twice.
• Technical logs: error reports and basic request logs to keep the service secure and working. We don't use advertising trackers.

• To provide the service you signed up for (contract): accounts, projects, billing and account emails.
• Our legitimate interests: keeping OneRank secure, fixing errors and improving the product.
• Legal obligations: keeping billing records for tax and accounting.
• Your consent: connecting Google Search Console and Google Analytics, which you can withdraw by disconnecting it.

We share only what each service needs to do its job:

• Clerk: sign-in, email verification and teams.
• Stripe: payments, invoices and receipts.
• Google: Search Console and Google Analytics data, read-only, only if you connect them.
• [SEO data provider]: keyword, ranking and backlink data. We send it the keywords and website addresses you add, not your personal details.
• [AI provider]: answers from the AI copilot and drafts. We send it your question and the relevant project data. [It doesn't use this data to train its models.]
• [Email provider]: sending account emails and reports.
• [Hosting provider, e.g. Microsoft Azure, region]: where OneRank and its databases run.
• Sentry: error reports, without personal details where possible.

[Some of these services are outside your country. Where that happens we rely on [standard contractual clauses / adequacy decisions].]

• While your account is open: we keep your data so the service works.
• After you cancel a paid plan: data above the Free plan's limits is kept read-only for 90 days, then deleted. Data within the Free limits stays.
• After a payment fails and isn't paid: see the timeline in our Terms. After 14 days the team moves to the Free plan, and data above its limits is kept read-only for 90 more days, then deleted.
• After you delete a project: [removed straight away / within [N] days], and from backups within [N] days.
• After you close your account: [personal data deleted within [N] days], and from backups within [N] days.
• Billing records: [N] years, as tax law requires.
• Google Search Console and Analytics numbers: up to the last 16 months (all Google keeps), while Google stays connected; deleted when you disconnect it or delete the project.
• Error logs: [N] days.

Depending on where you live, you can ask to see, correct, export or delete your personal data, or object to how we use it. Email [privacy contact email] and we'll reply within [30] days. You can also complain to your data protection authority [e.g. the ICO in the UK].

Team owners can export their projects as CSV and PDF at any time.

Data is encrypted in transit, each team's data is kept separate from every other team's, and access to production systems is limited to the people who need it. If a breach affects your data, we'll tell you as the law requires.

We use only the cookies OneRank needs to work: staying logged in (set by Clerk), remembering your light or dark theme and sidebar, and remembering the plan you picked on the pricing page through sign-up (kept for 7 days). We don't use advertising cookies.

If we change this policy in a way that matters, we'll email the team's owner before it applies.