Rankzon

Privacy policy

Last updated 14 October 2026.

WK Operations Ltd (wkoperations.com) operates Rankzon and is the controller of the personal data described here. Contact: [email protected].

What we store and why

  • Account data: your name, email address and a hashed password, plus team membership and roles. Needed to sign you in and run your team. Legal basis: performance of the contract.
  • Project data: the domains, keywords, countries, languages, client names, tags and branding you add, and the daily ranking results we record for them, including the Google result pages we fetched. Needed to provide the service. Legal basis: performance of the contract.
  • Billing data: per-day usage (how many keywords were checked for your team and what it cost), invoices and the brand and last four digits of your payment method. Full payment details are held by Stripe, never by us. Legal basis: performance of the contract and legal obligations on bookkeeping.
  • Technical data: server logs with IP addresses and request details, kept for a short period for security and troubleshooting. Legal basis: legitimate interest in running a secure service.

We do not sell personal data and we do not use it for advertising.

Cookies

The app uses a session cookie to keep you signed in and, where you choose them, browser storage for interface preferences such as a remembered filter. There are no third-party tracking cookies.

Processors we use

  • Stripe for payments and invoices, as merchant of record (Stripe Managed Payments, presented as “sold through Link” at checkout). Stripe receives your team name, the email address of the account owner, your billing address for tax purposes, your payment details and the usage we bill.
  • Search data providers to fetch Google result pages, keyword metrics and keyword suggestions. They receive keywords, domains, countries and languages, never your account details or anything from your Google account.
  • Forward Email to send transactional email such as team invitations.
  • Hosting: the application and database run on infrastructure we operate; backups are kept in the same environment.

Google user data (Search Console and Google Analytics)

Connecting Google is optional. A team owner or admin can connect a Google account in a project’s settings so Rankzon can show the project’s Google Search Console and Google Analytics data next to its rankings. Each is connected separately, and Rankzon only asks for Analytics access when you connect Google Analytics. This section explains exactly what Rankzon accesses, how it is used, stored, protected and shared, and how long it is kept.

What we access

  • The Google account’s email address (scopes openid and email), so your team can see which Google account is connected.
  • Read-only Search Console data (scope https://www.googleapis.com/auth/webmasters.readonly): the list of Search Console properties the account can access, and, for the one property you link to a project, the daily number of clicks, impressions and average Google position per search query in that project’s country, which of the site’s pages get impressions for the keywords your team tracks, and Google’s index status (URL Inspection) of pages that stopped ranking for a tracked keyword.
  • Read-only Google Analytics data (scope https://www.googleapis.com/auth/analytics.readonly), only if you connect Google Analytics: the list of GA4 accounts and properties the account can access, the linked property’s name and reporting currency, and, for the one property you link to a project, the daily number of sessions, engaged sessions, key events and revenue from organic search per landing page, in that project’s country. These are aggregated totals; Rankzon does not access individual visitors, user IDs or any other Analytics data.

Rankzon cannot change anything in Search Console or Google Analytics, and it does not access Gmail, Drive, contacts or any other Google data.

How we use it

  • To show clicks, impressions and average position next to the keywords your team tracks.
  • To draw Google’s average position history on keyword charts.
  • To suggest search queries your site already appears for that your team doesn’t track yet.
  • To flag tracked keywords that need attention: several of your pages competing for one keyword, a click rate far below the keyword’s position, or a page that is no longer in Google’s index.
  • To show organic sessions, key events and revenue for the project and per landing page, and next to the keywords that rank with each page.
  • To show which Search Console and Google Analytics properties you can link, so you can pick the right one for each project.

Google user data is used only to provide these features to the team that connected it. It is not used for advertising, it is not sold, it is not used to build user profiles, and it is not used to develop, improve or train generalized or non-personalized AI or machine-learning models.

How we store and protect it

We keep a refresh token that lets Rankzon fetch new Search Console and Google Analytics data each day. It is encrypted with AES-256-GCM before it is stored, and the key is kept separate from the database. The imported figures are stored in our database alongside the project they belong to, and all traffic to Google and to Rankzon is encrypted in transit (TLS). Only members of the team that connected the account can see the data in the app, and only for projects of that team. Our staff access it only when needed to provide support you ask for, to fix a problem, or when the law requires it.

Sharing

We do not share, transfer or disclose Google user data to third parties. Search Console figures appear on a shared report link only if your team turns on the Search traffic section or the clicks and impressions columns in its report template; the report then shows the clicks and impressions of the projects in it to whoever has the link. Google Analytics figures appear on a shared report link only if your team turns on the Organic results section; the report then shows the organic sessions, key events, revenue and landing pages of the projects in it to whoever has the link. These options are off by default. Otherwise the data never leaves the infrastructure described under “Hosting” above, except when the law requires it or when you ask us to transfer it to you.

Retention and deletion

  • Search Console and Google Analytics figures are kept for up to 16 months and older days are deleted automatically.
  • Unlinking a Search Console or Google Analytics property from a project deletes that project’s data imported from it straight away.
  • Disconnecting a Google account in project settings revokes Rankzon’s access at Google, deletes the stored token and deletes the imported data of every project that used it.
  • Archiving a project stops its Search Console and Google Analytics syncs. Deleting your team or account deletes its Google connections and all imported Google data.
  • You can also revoke access at any time from your Google account’s third-party access page; Rankzon then stops fetching data, and you can delete what was imported by unlinking the property or by writing to [email protected].

Limited Use

Rankzon’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Public report links

A shared report is readable by anyone who has its link. It shows the project’s domain, keywords and positions, and the branding your team configured, plus Search Console clicks and impressions and Google Analytics organic results if your team turned them on in the report template. Disable or rotate a link to revoke access; we record how often a link is opened.

Retention

Account and project data are kept while your account exists. When you delete a project its keywords and rankings are removed; when you delete your account all of it is removed, except invoices and usage records we must keep for bookkeeping, which are retained for the period the law requires. Server logs are kept for up to 30 days.

Your rights

You can access, correct and export your data in the app, and ask us to delete your account. Where the GDPR applies you also have the rights to restrict or object to processing, to data portability, and to complain to your supervisory authority. Write to [email protected] for any request.

Changes

We will announce material changes to this policy in the app or by email before they take effect.