RankPine
Start free

Privacy Policy

Last updated: 28 June 2026

TECH RACCOONS LTD (company number 16336615), a company registered in England and Wales (“RankPine”, “we”, “us”, or “our”), operates the RankPine service (the “Service”). This Privacy Policy explains what personal data we collect, how and why we use it, who we share it with, how long we keep it, and the rights you have over it.

We are the “controller” of the personal data described here, except where we process personal data contained in your content on your behalf, in which case we act as your “processor” and our Data Processing Addendum applies. RankPine is a business service; this policy is written for our customers and the people who use our Service and visit our websites.

1. Personal data we collect

Account and profile data

Your name, email address, password (stored only as a secure hash, never in plain text), profile image if you set one, and whether your email is verified.

Authentication data

Session tokens, your IP address, your browser and device (user-agent) information, and sign-in timestamps, which we use to keep you logged in and to protect your account.

Google sign-in and Search Console data

If you sign in with Google or connect Google Search Console, we receive your Google profile and email and OAuth access and refresh tokens (encrypted at rest), and — for the properties you choose — read-only Search Console metrics such as search queries, impressions, clicks, and average positions. We use this only to prioritise your keyword plan. We never post to, or change anything in, your Google account.

Site and content configuration

The website URLs, niche, descriptions, positioning, competitors, target audiences, tone, content settings, brand colours, sitemaps, and the internal links we crawl from your site in order to generate relevant, well-linked content.

Generated content

The articles, keywords, images, SEO scores, and research sources produced for you through the Service.

Integration credentials

The API keys, tokens, application passwords, and webhook secrets for the CMS and destinations you connect. These are encrypted at rest and used only to publish content on your behalf.

Shopify app data

If you install RankPine through Shopify, we receive your shop ID, myshopify.com domain, shop name, primary domain, contact email, timezone, the content-access scopes you grant, and the Online Store blog you select. We store encrypted Shopify access and session tokens, subscription status, publishing records, and webhook delivery identifiers. We do not request or use Shopify customer, order, product, theme, or storefront analytics data. RankPine adds no storefront script.

Billing data

Billing is handled by Polar for direct RankPine accounts and by Shopify for merchants who subscribe through the Shopify App Store. We store provider identifiers and metadata such as subscription status, plan, and billing period. The applicable provider processes your payment details; we do not store your full card number.

Usage, technical, and security data

Records of how the Service is used, including AI usage and cost records, rate-limit counters, audit logs (the action taken, who took it, the source IP address, and a timestamp), and server logs. We use these to operate, secure, debug, and improve the Service.

Analytics data

Privacy-friendly, cookieless analytics about how our websites and app are used, and (where enabled) error reports and session replays used to diagnose problems and improve usability. See our Cookie Policy for details.

Communications

The content of messages you send us (for example support requests) and any feedback you provide, including any reason you give when you delete your account.

2. How we collect personal data

We collect personal data:

  • directly from you, when you sign up, configure sites, or contact us;
  • automatically, through server logs, security tooling, and our privacy-friendly analytics as you use the Service; and
  • from third parties you connect or that help us run the Service, such as Shopify (app installation and Shopify App Pricing), Google (sign-in and Search Console), Polar (billing for direct accounts), and our keyword-data provider.

3. How we use personal data, and our legal bases

Under the UK GDPR and EU GDPR we must have a legal basis for using your personal data. We use it as follows:

  • To provide and operate the Service — including account setup, authentication, researching, generating, scheduling, and publishing content, and running autopilot. Basis: performance of our contract with you.
  • To take payment and manage subscriptions — and to prevent payment fraud. Basis: performance of our contract; and compliance with legal obligations (such as tax and accounting).
  • To secure and maintain the Service — rate-limiting, abuse prevention, audit logging, and debugging. Basis: our legitimate interests in keeping the Service safe, available, and reliable.
  • To measure and improve the Service — using privacy-friendly analytics that do not profile you. Basis: our legitimate interests in understanding and improving our product.
  • To communicate with you — about your account, security, and changes to the Service. Basis: performance of our contract and our legitimate interests.
  • To send product or marketing updates — where you have opted in, or where permitted as a legitimate interest. You can opt out at any time. Basis: consent or legitimate interests.
  • To comply with law and enforce our terms — and to establish, exercise, or defend legal claims. Basis: compliance with legal obligations and our legitimate interests.

4. AI processing of your content

To generate articles and images, we send your site configuration, briefs, keywords, and related inputs to our AI sub-processors (Anthropic and Google). We do not use your content to train our own models, and our AI providers do not use data submitted through their business and API services to train their models. AI Outputs may still be inaccurate — see our Terms of Service.

5. How we share personal data, and our sub-processors

We do not sell your personal data. We share it with the service providers (“sub-processors”) that help us run the Service. Each is bound by contract to protect your data and to use it only to provide their service to us:

  • Anthropic — AI text generation. United States.
  • Google — AI text and image generation (Gemini), Google sign-in, and Google Search Console data. United States and global.
  • DataForSEO — keyword search-volume and difficulty data. Estonia.
  • Polar — payments, subscriptions, and invoicing (merchant of record). United States and EU.
  • Shopify — embedded app authentication, Online Store publishing, and Shopify App Pricing for Shopify App Store merchants. Canada, United States, and global.
  • Resend — transactional email, such as password resets and trial notices. United States.
  • Swetrix — privacy-friendly, cookieless analytics, error tracking, and session replay. United Kingdom.
  • Hetzner — hosting of our servers and database. Germany (EU).
  • Cloudflare — object storage (R2) for generated images, and content delivery. United States and global.

In addition, when you connect a CMS or webhook (for example Shopify, WordPress, Ghost, Webflow, Notion, or your own endpoint), we send your generated content and the metadata you configure to that destination at your instruction. Those destinations are controlled by you and governed by their own terms and privacy policies.

We may also disclose personal data:

  • where required by law, regulation, legal process, or a valid governmental request;
  • to enforce our terms, or to protect the rights, property, or safety of RankPine, our users, or others; and
  • in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honour this policy.

6. International data transfers

We are based in the UK, and some of our sub-processors are located outside the UK and EEA (for example in the United States). Where we transfer personal data internationally, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or an applicable adequacy decision. You can ask us for more detail at [email protected].

7. How long we keep personal data

We keep personal data for as long as your account is active and as needed to provide the Service. When you delete a site or your account, we delete or anonymise the associated account, site, content, and integration data, except where we need to retain limited records for longer — for example, audit logs and account-deletion feedback (kept for security, fraud-prevention, and legal reasons) and billing records (kept as required by tax law). Backups are overwritten on a rolling basis.

For Shopify installations, we disable publishing and delete stored Shopify sessions on uninstall. When Shopify sends the mandatory shop-redaction webhook, we delete the Shopify-created RankPine account, shop configuration, generated content, integration credentials, and related tenant data. We process mandatory privacy requests within Shopify’s required timeframe and retain only de-identified security or legally required records.

8. How we protect personal data

We use technical and organisational measures to protect personal data, including:

  • encryption in transit (HTTPS) for traffic to and from the Service;
  • encryption at rest for integration credentials and OAuth tokens, using AES-256-GCM;
  • strict tenant isolation enforced in our data layer, so one customer cannot access another customer’s data;
  • rate-limiting and abuse protections;
  • safeguards against server-side request forgery when we crawl or publish to URLs;
  • audit logging of sensitive actions, and access on a least-privilege basis; and
  • a practice of never logging secrets such as credentials or tokens.

No method of transmission or storage is completely secure, but we work hard to protect your data and will notify you and the relevant regulator of a personal-data breach where the law requires.

9. Your rights

Depending on where you are (including under the UK GDPR and EU GDPR), you have rights to access your personal data; to have it corrected or erased; to restrict or object to certain processing; to data portability; and to withdraw consent where processing is based on consent. You can exercise many of these directly in the app — you can edit your profile and sites, disconnect integrations, export your articles, and delete your account at any time.

To make a request, email [email protected]. We will respond within one month, which we may extend for complex requests as the law allows. We will not discriminate against you for exercising your rights. If you are in the United States, we do not sell or “share” your personal information for cross-context behavioural advertising, and you may have similar rights — contact us to exercise them.

If you are in the UK, you have the right to complain to the Information Commissioner’s Office (ico.org.uk). If you are in the EEA, you may complain to your local data-protection authority. We would appreciate the chance to address your concerns first.

10. Cookies

We use only strictly necessary cookies, together with cookieless analytics, so we do not display a cookie consent banner. For the full details, see our Cookie Policy.

11. Children

The Service is intended for business users aged 18 and over. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.

12. Third-party links

The Service and our websites may link to third-party sites and services we do not control. Their handling of your data is governed by their own privacy policies, not this one.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will give you reasonable notice, for example by email or in the Service. The “Last updated” date at the top shows when this policy last changed.

14. Contact us

For any privacy question or request, contact our team at [email protected].

TECH RACCOONS LTD (company number 16336615), registered in England and Wales. Registered office: 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom. Please contact us by email — we do not accept communications by post.