Rankzon

Privacy policy

Last updated 12 October 2026.

WK Operations Ltd (wkoperations.com) operates Rankzon and is the controller of the personal data described here. Contact: [email protected].

What we store and why

  • Account data: your name, email address and a hashed password, plus team membership and roles. Needed to sign you in and run your team. Legal basis: performance of the contract.
  • Project data: the domains, keywords, countries, languages, client names, tags and branding you add, and the daily ranking results we record for them, including the Google result pages we fetched. Needed to provide the service. Legal basis: performance of the contract.
  • Billing data: per-day usage (how many keywords were checked for your team and what it cost), invoices and the brand and last four digits of your card. Full card details are held by Stripe, never by us. Legal basis: performance of the contract and legal obligations on bookkeeping.
  • Technical data: server logs with IP addresses and request details, kept for a short period for security and troubleshooting. Legal basis: legitimate interest in running a secure service.

We do not sell personal data and we do not use it for advertising.

Cookies

The app uses a session cookie to keep you signed in and, where you choose them, browser storage for interface preferences such as a remembered filter. There are no third-party tracking cookies.

Processors we use

  • Stripe for payments, cards and invoices. Stripe receives your team name, the email address of the account owner and your payment details.
  • Serper to fetch Google result pages. It receives the keyword, country and language of each check, never your account details.
  • DataForSEO for keyword metrics and suggestions. It receives keywords, domains, countries and languages.
  • Forward Email to send transactional email such as team invitations.
  • Hosting: the application and database run on infrastructure we operate; backups are kept in the same environment.

Google user data (Search Console)

Connecting Google is optional. A team owner or admin can connect a Google account in a project’s settings so Rankzon can show the project’s Google Search Console data next to its rankings. This section explains exactly what Rankzon accesses, how it is used, stored, protected and shared, and how long it is kept.

What we access

  • The Google account’s email address (scopes openid and email), so your team can see which Google account is connected.
  • Read-only Search Console data (scope https://www.googleapis.com/auth/webmasters.readonly): the list of Search Console properties the account can access, and, for the one property you link to a project, the daily number of clicks, impressions and average Google position per search query in that project’s country.

Rankzon cannot change anything in Search Console, and it does not access Gmail, Drive, contacts or any other Google data.

How we use it

  • To show clicks, impressions and average position next to the keywords your team tracks.
  • To draw Google’s average position history on keyword charts.
  • To suggest search queries your site already appears for that your team doesn’t track yet.
  • To show which Search Console properties you can link, so you can pick the right one for each project.

Google user data is used only to provide these features to the team that connected it. It is not used for advertising, it is not sold, it is not used to build user profiles, and it is not used to develop, improve or train generalized or non-personalized AI or machine-learning models.

How we store and protect it

We keep a refresh token that lets Rankzon fetch new Search Console data each day. It is encrypted with AES-256-GCM before it is stored, and the key is kept separate from the database. The imported Search Console figures are stored in our database alongside the project they belong to, and all traffic to Google and to Rankzon is encrypted in transit (TLS). Only members of the team that connected the account can see the data in the app, and only for projects of that team. Our staff access it only when needed to provide support you ask for, to fix a problem, or when the law requires it.

Sharing

We do not share, transfer or disclose Google user data to third parties. It is not shown on public report links. It never leaves the infrastructure described under “Hosting” above, except when the law requires it or when you ask us to transfer it to you.

Retention and deletion

  • Search Console figures are kept for up to 16 months (the history Google itself keeps) and older days are deleted automatically.
  • Unlinking a property from a project deletes that project’s imported Search Console data straight away.
  • Disconnecting a Google account in project settings revokes Rankzon’s access at Google, deletes the stored token and deletes the imported data of every project that used it.
  • Archiving a project stops its Search Console sync. Deleting your team or account deletes its Google connections and all imported Search Console data.
  • You can also revoke access at any time from your Google account’s third-party access page; Rankzon then stops fetching data, and you can delete what was imported by unlinking the property or by writing to [email protected].

Limited Use

Rankzon’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Public report links

A shared report is readable by anyone who has its link. It shows the project’s domain, keywords and positions, and the branding your team configured. Disable or rotate a link to revoke access; we record how often a link is opened.

Retention

Account and project data are kept while your account exists. When you delete a project its keywords and rankings are removed; when you delete your account all of it is removed, except invoices and usage records we must keep for bookkeeping, which are retained for the period the law requires. Server logs are kept for up to 30 days.

Your rights

You can access, correct and export your data in the app, and ask us to delete your account. Where the GDPR applies you also have the rights to restrict or object to processing, to data portability, and to complain to your supervisory authority. Write to [email protected] for any request.

Changes

We will announce material changes to this policy in the app or by email before they take effect.