Privacy policy

We collect the information needed to run the service:

• your name, email address, password hash, and account settings;
• sites, keywords, competitor domains, tags, disavow entries, Search Console performance, and saved history;
• support messages and private account requests;
• session IP address, signup IP and country, browser user-agent, and timestamps;
• plan use, MCP calls, error details, and security or rate-limit events; and
• invoice, subscription, and transaction metadata described below.

If you sign in with Google or GitHub, we receive the profile details needed to identify your account, such as your provider account ID, name, email address, and profile image. We store the linked account and encrypted OAuth tokens.

Sign-in is separate from optional Google service connections. It does not grant access to Search Console or Analytics. Google and GitHub handle sign-in under their own terms and privacy notices.

If you connect Google Search Console, we store the Google account email, encrypted access and refresh tokens, the verified property you pick for each site, and performance rows (queries, pages, clicks, impressions, click-through rate, and average position). We request read-only Search Console access. Disconnecting removes the grant and those rows. Sign-in with Google is a separate grant and does not include Search Console.

If you connect Google Analytics, we request read-only access and you choose the property for each site. We list the Analytics properties available to your Google account so you can choose. We store the Google account email and encrypted OAuth tokens while the Google connection is active. For the property you select, we store report rows such as page paths, views, users, engaged sessions, session duration, country and city totals, and counts for page paths you add to a funnel. Reports can include up to 400 days of history; rows older than that are removed by daily cleanup.

We use these rows to show Analytics reports in the dashboard and to answer ananalytics_pages request made through your signed-in MCP connection. The response goes to the MCP client you chose, under that client’s privacy terms. The built-in Operator assistant does not offer an Analytics report tool. We do not use Analytics report rows for advertising or sell them.

Stopping reports for a site removes its selected property and saved Analytics rows. Disconnecting Google removes the connection and saved Analytics and Search Console rows for your sites. Google sign-in is separate from these service connections. You can connect Search Console on its own; connecting Analytics also requests read-only Search Console access so both reports can use the same Google connection.

Payment details are entered on a hosted checkout. RankMySEO does not store your full card number, card security code, bank account credentials, virtual account number, or wallet credentials.

We do retain the records needed to identify and support a purchase: invoice number, plan, billing interval, amount, currency, payment status, payment method category, processor reference, subscription reference, and transaction logs.

We use IP addresses for account security, abuse prevention, session records, rate limits, and guest access rules. Signup country can also select the currency shown at checkout.

RankMySEO does not use an IP address as a tax decision and does not run automated fraud scoring. A hosting or payment service may perform its own security checks under its policy.

We use information to:

• create and secure accounts;
• run checks, store history, and answer dashboard or MCP requests;
• process plans, invoices, renewals, and account limits;
• send verification, reset, receipt, renewal, and support messages;
• find errors, prevent abuse, and protect the service; and
• meet legal, accounting, and dispute-handling obligations.

Where applicable, we process this information to provide the service you requested, meet a legal obligation, or pursue a legitimate interest in securing and operating RankMySEO.

RankMySEO monitors search positions by grabbing publicly available data from search engines like Google. A rank check sends the keyword and the site. After the page has loaded, the public website sends a page view to Google Analytics and a record of the visit to Microsoft Clarity. Cookies describes both tags.

We do not control Google’s internal indexing, ranking algorithm, or data retention. How Google crawls, indexes, stores, or deletes web pages and search queries depends entirely on Google’s independent terms and privacy policies. If you delete data in RankMySEO, that action removes your data within RankMySEO; it does not alter or delete content residing on Google or any third-party search engine.

We send only the information needed to services that handle sign-in, payments, email delivery, security checks, hosting, and SEO data collection. Site names, domains, keywords, locations, and public URLs may be sent to an SEO data service to complete a requested check. After the page has loaded, the public website also sends a page view to Google Analytics and scrolls, clicks, and pointer movement to Microsoft Clarity.

We may also disclose information when law requires it, to protect a person or the service, or as part of a sale or reorganization. We do not sell personal information or use it for third-party advertising.

RankMySEO uses first-party cookies for signed-in sessions, security, checkout currency, and interface preferences. The app also stores your last selected site, pending signup site, and navigation choices in your browser.

The public website loads two tags after the page is ready. Google Analytics counts visits and which pages people open, and sets a Google cookie for that count. Microsoft Clarity records scrolls, clicks, and pointer movement so we can see where a page is hard to use. It never records what you type into a form. Clarity sets its own cookies and syncs a Microsoft visitor ID that Microsoft uses across its services, except for visitors in the EEA, the UK, and Switzerland, where it runs without cookies. The signed-in app leaves both tags out. We do not run ads or add advertising tags of our own. A consent banner is not shown because the session cookies are needed for sign-in, security, and checkout. You can block either script in your browser. Clearing cookies can stop sign-in and saved preferences.

The signed-in app offers optional usage analytics. If you allow it, we send a coded account identifier, fixed feature names, and successful feature-request counts to our analytics service. We do not send your name, email, site addresses, keywords, page URLs, or form content, and we do not record your screen. The service receives network information, including your IP address, when your browser connects to it. These counts help us decide which features and workflows to improve. Your choice is saved for your account on this browser. You can turn analytics off in Account. We leave it off when your browser sends a Do Not Track or Global Privacy Control signal. Analytics records are retained for up to one year. Contact Support if you want existing records deleted; turning analytics off stops new collection but does not delete earlier records.

Account, site, keyword, and rank-history records are kept while your account remains active. Guest research is deleted after 24 hours if it is not paired with an account. Recorded application errors are removed after 30 days.

In compliance with statutory personal data protection principles (including Indonesia’s Law No. 27 of 2022 on Personal Data Protection / UU PDP) and global standards, you have the right to request the erasure and deletion of your personal data.

When you delete your account or submit an erasure request:

• we delete all your account profile details, passwords, API keys, tracked domains, keywords, SERP snapshots, backlink reports, on-page crawl results, and conversation logs from our active databases;
• we retain only the minimum data required by law for tax compliance, accounting, and statutory audit purposes: your email address, invoice number, and payment amount (price); and
• all other account and personal data is permanently removed or irreversibly anonymized.

Public domain metrics and search engine results already collected may remain in shared general caches because they consist of public search results and are not stored as your private account content.

We use access controls, hashed passwords and API keys, encrypted OAuth tokens, secure cookies in production, and limited admin access. No system is perfectly secure. Contact support@rankmyseo.com if you believe your account or key has been exposed.

You can change your name and password in Account, revoke an API key there, and remove sites or keywords from the dashboard at any time.

Under Indonesian Personal Data Protection Law (UU No. 27 Tahun 2022) and international privacy regulations, you have explicit rights to access, rectify, end processing of, and delete your personal data.

When you request deletion of your account or personal data via Account or Support:

• we promptly delete all your personal profile data, tracking setups, site history, audit outputs, and saved configurations; and
• we retain solely the information strictly required for tax and accounting compliance under tax law (specifically your email address, invoice number, and price paid).

To protect account security, we may ask you to verify your identity before acting on a deletion request. Requests are processed within the timeframes mandated by applicable law.

Services used by RankMySEO may process information outside your country. Where required, we use contractual or other lawful safeguards for those transfers.

RankMySEO is for people aged 18 or older. We do not knowingly collect personal information from children.

We may update this notice when the product, providers, or legal requirements change. The effective date at the top will change.

Privacy questions and requests can be sent to support@rankmyseo.com.