Privacy Policy

RankFlow provides the RankFlow SEO content platform. For data about our customers, their team members, people who contact us and visitors to rankflow.works, RankFlow is the controller.

When you use RankFlow to handle data about your own website visitors or customers, for example conversations and contact details collected by the Chat AI widget, or contacts synced from GoHighLevel, you are the controller of that data and RankFlow processes it on your behalf and on your instructions.

For any privacy question or request, write to hello@rankflow.works.

Depending on the features you use, we collect:

• Account data: your name, email address, password (stored only as a one-way hash), an optional profile picture, your plan and your account status.
• Signed-in devices: for each browser or phone signed in to your account, its browser user agent, the IP address it last used, when it signed in and when it was last active. You can see them in the app under Account → Signed-in devices and sign any of them out.
• Team data: invitations (the invitee's email address and role), roles and section permissions, and messages in team chat.
• Billing data: invoices with the plan, billing period, amount, due date, status and payment notes.
• Site and content data: the websites you add and their settings, briefs, keywords, strategies, articles, landing pages, generated sites, forms, and the images and files you upload. If you use that feature, also product data synced from WooCommerce.
• Credentials for connected services: WordPress Application Passwords, API keys and access tokens of publishing platforms (such as WordPress.com, Shopify, Webflow, Wix, Ghost, Framer, Duda, BigCommerce and Snapps), REST API keys, FTP or FTPS logins, SMTP or Brevo keys for sending form emails, GoHighLevel tokens, Google OAuth tokens and the access tokens or keys of the social networks you connect.
• Data from connected services, depending on what you connect: Search Console performance, URL inspection and sitemap data; Google Analytics visitor and traffic reports; Business Profile locations, reviews (including reviewers' names), posts, photos and performance data; GoHighLevel contacts, opportunities, conversations, and social and ad statistics; for the social networks you connect, the name, username, picture and link of each page, profile or channel, and the performance numbers of posts RankFlow published.
• Usage and AI metering: which AI features were used, for which site, with which model, and the calls, tokens and cost involved.
• Audit log: for actions that change data in a site, who performed them, when and what changed (with secrets redacted), plus the IP address and browser user agent of the request.
• Visits to rankflow.works, only if you accept analytics cookies: Google Analytics, loaded through Google Tag Manager, records the pages you view, how you arrived (the referring site or campaign), your device and browser, your approximate location (country or city) and clicks.
• Email and notification data: a log of the emails we send (type, recipient, subject, status), the extra notification recipients you add, and your notification preferences.
• Support data: support tickets and messages, and feature requests you send from the app.
• The quote form on rankflow.works: your name, email address and website address, and optionally the plan you are interested in and a message. The form is sent to our team by email and is not stored in the RankFlow app.

We also process data about your website's visitors on your behalf, as described below under “Visitor data we process for you”.

• To create and run your account, review registrations and provide the features you use.
• To generate content, analysis and replies with AI, publish to the sites you connect, sync data from connected services, and run the checks you start or schedule.
• To measure usage against your plan's limits, issue invoices, and suspend or restore access depending on whether invoices are paid.
• To send service emails, such as registration and approval messages, team invitations, account suspension notices and the notifications you choose to receive.
• To keep the service secure: rate limiting, preventing abuse, investigating problems and keeping the audit log.
• To answer support tickets, feature requests and quote requests.
• To troubleshoot and improve RankFlow, including checking logs of AI requests when output or costs look wrong.
• To see how visitors use rankflow.works and improve it, with Google Analytics, only if you accept analytics cookies.

We do not sell personal data and do not use it for advertising. The app uses no third-party analytics or advertising trackers. On rankflow.works, Google Analytics runs only after you accept analytics cookies, and Google's advertising features stay off.

Our legal bases under the EU General Data Protection Regulation (GDPR) and Serbia's Law on Personal Data Protection, which follows it:

• Performing our contract with you (GDPR Art. 6(1)(b)): your account, the features you use, connected services, billing and service emails.
• Our legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse, the audit log, troubleshooting and improving RankFlow, and answering people who contact us. You can object to this processing at any time.
• Your consent (Art. 6(1)(a)): Google Analytics cookies on rankflow.works and the quote form. You can withdraw it at any time with Cookie settings at the bottom of every page of rankflow.works, or by writing to us. Withdrawing does not affect processing done before.
• Legal obligations (Art. 6(1)(c)): keeping invoices and accounting records as tax law requires, and answering lawful requests from authorities.

Account data is needed to create an account and use RankFlow; without it we cannot provide the service. rankflow.works works the same without analytics cookies.

Access is suspended automatically when an invoice stays unpaid, as our terms provide, and you can ask for a person to review a suspension. Apart from that, we make no decisions with legal or similarly significant effects based solely on automated processing.

To generate output, RankFlow sends the data a feature needs to AI providers through their APIs. Depending on the feature, this can include your site details and content, article drafts, keywords, web pages fetched for research, Search Console queries, Google reviews you want to answer, the Search Console and Google Analytics numbers you ask the in-app assistant about, social posts you ask AI to write or rewrite with the styles and example posts you give it, and messages from visitors to your Chat AI widget.

• Anthropic: Claude models, including its web search and web fetch tools for research features.
• OpenAI: GPT models, image generation, and text embeddings for the Chat AI knowledge base.
• DeepSeek: DeepSeek models, when RankFlow assigns them to a feature.

RankFlow decides which provider and model handles each feature and may change this. Each provider processes the data under its own API terms, and may do so outside your country.

We keep logs of AI requests (the prompt sent and the output received) on our servers to troubleshoot quality and cost. Requests that extract contact details from a visitor's chat messages are left out of these logs.

Other recipients:

• The infrastructure provider that hosts our servers and database, and the email service we use to send email.
• The public OSV vulnerability database (osv.dev), which receives only the names and versions of public software libraries that a Site Health check finds on your site.
• The services you connect, such as your WordPress site, your store or website platform, your hosting, GoHighLevel, Google, Brevo, the social networks you post to or a webhook you set up, which receive data because you instruct us to send it.
• Google (Google Tag Manager and Google Analytics), for visits to rankflow.works, only if you accept analytics cookies.
• Your team members, according to the roles and permissions you give them.
• Authorities, where the law requires it, or a successor if RankFlow's business is transferred, in which case this policy continues to apply to your data.

Transfers outside Serbia and the European Economic Area: some of these recipients process data in other countries, mainly the United States (Anthropic, OpenAI and Google) and, for DeepSeek models, China. Where the law requires a safeguard for a transfer, we rely on an adequacy decision, such as the EU-U.S. Data Privacy Framework, or on standard contractual clauses. Write to hello@rankflow.works for details of the safeguard for a recipient.

If you connect Google Search Console, Google Analytics or Google Business Profile, you sign in with Google and approve access on Google's consent screen.

• Search Console (webmasters scope): we read your properties, search performance (queries, pages, clicks, impressions, positions), URL inspection results and sitemaps, and manage sitemaps when you ask us to.
• Indexing API (indexing scope): we notify Google about URLs you publish or choose to submit.
• Google Analytics (analytics.readonly scope): we read, without changing anything, your Analytics accounts and properties with their web streams, to find your site's property, and its reports on visitors, sessions, page views, engagement, key events, traffic sources, devices and countries.
• Business Profile (business.manage scope): we read and manage your locations, profile information, reviews and replies, posts, photos and performance data, and publish the changes and replies you make or approve, including automatic review replies if you turn them on.

We use Google user data only to provide the RankFlow features you use. We do not sell it, use it for advertising or use it to train AI models. When you use an AI feature that needs Google data, such as keyword research with Search Console queries, a reply to a review or a question to the in-app assistant about your visitors, only the data needed for that output is sent to our AI provider.

People at RankFlow do not read your Google data unless you ask us to for support, it is necessary for security, or the law requires it.

RankFlow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google tokens are stored encrypted. You can disconnect at any time in the app; disconnecting Business Profile also revokes our access at Google and deletes the synced profile data from RankFlow, and disconnecting Google Analytics deletes the Analytics reports stored in RankFlow. You can also remove RankFlow's access in your Google Account settings (myaccount.google.com/permissions).

If you use Social, you connect the social network accounts you want to post to. For most networks you sign in on the network's own page and approve access there. For Telegram, Bluesky, Viber and Medium you paste a key or token that you create on that network. RankFlow uses this access only to do what you ask: publish, schedule and remove your posts and show how they perform.

• Facebook (Meta): we read the Pages you manage (name, username, picture and link) and the Instagram accounts linked to them. We publish the posts, photos, videos and first comments you write, schedule or approve to the Pages you choose, read the performance numbers of those posts and delete them when you ask. Permissions: pages_show_list, pages_read_engagement, pages_manage_posts, pages_manage_engagement and business_management.
• Instagram (Meta): we read your professional account's ID, username, name, account type and profile picture. We publish the posts, carousels, reels and stories you write, schedule or approve, add a first comment if you write one, and read the performance numbers of those posts. Permissions: instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments and instagram_business_manage_insights, or the matching instagram_* permissions when you connect through a Facebook Page. Instagram does not let apps delete posts.
• YouTube (Google): we read your channel's name and picture, upload the videos and Shorts you choose, read the performance numbers of those videos and delete them when you ask (youtube.upload and youtube.readonly scopes). RankFlow uses YouTube API Services: by connecting YouTube you agree to the YouTube Terms of Service (youtube.com/t/terms), and the Google Privacy Policy (policies.google.com/privacy) applies to how Google handles your data. The section on Google user data above applies to YouTube data too.
• Threads (Meta): we read your profile's ID, username, name and picture, publish the posts you write, schedule or approve, read their performance numbers and delete them when you ask. Permissions: threads_basic, threads_content_publish, threads_manage_insights and threads_delete.
• X: we read your account's ID, name, username and picture, upload the pictures and videos of your posts, publish your posts and threads and delete them when you ask. Scopes: tweet.read, tweet.write, users.read, media.write and offline.access, which keeps you connected without signing in again.
• LinkedIn: we read your member ID, name and picture and publish your posts to your profile (openid, profile and w_member_social). When company pages are available, we also read the pages you administer and publish to the ones you choose (r_organization_social, w_organization_social and rw_organization_admin). We delete posts when you ask.
• Pinterest: we read your account's username and picture and your boards, create pins on the boards you choose, read their performance numbers and delete them when you ask. Scopes: user_accounts:read, boards:read, boards:write, pins:read and pins:write.
• TikTok: we read your basic profile (ID, display name and avatar) and upload and publish the videos and photo posts you choose (user.info.basic, video.upload and video.publish). We read no performance numbers from TikTok, and TikTok does not let apps delete posts.
• Reddit: we read your username (identity), the communities you belong to (mysubreddits) and their post flairs (flair), submit your text, link and image posts to the communities you choose (submit), read their performance numbers (read) and delete them when you ask (edit).
• Tumblr: we read your blogs' names and pictures (basic), publish posts to the blog you choose (write), stay connected without a new sign-in (offline_access), read the notes count of those posts and delete them when you ask.
• Discord: you pick a server and channel on Discord's own screen, and Discord gives RankFlow a webhook for that channel (webhook.incoming). You can also paste a webhook URL. We store only the webhook address with its name and the server and channel IDs, post your messages there and delete them when you ask. We read nothing else from your server.
• Mastodon: on the server you choose, we read your account (name, username and picture) and the performance numbers of your posts (read), publish posts with their pictures and videos (write:statuses and write:media) and delete them when you ask.
• Telegram: you add RankFlow's bot, or your own bot, as an admin of your channel or group. We store the chat's ID and name, and your bot token if you use your own bot, post your messages and delete them when you ask. The bot does not read the messages in the chat.
• Bluesky: you enter your handle and an app password that you create in Bluesky's settings, never your main password. We store them encrypted, read your profile and the performance numbers of your posts, publish posts and delete them when you ask.
• Viber: you paste your channel's token from Viber. We read the channel's name and picture and post your messages to the channel.
• Medium: you paste an existing Medium integration token. We read your profile (ID, username, name and picture) and publish the articles you choose.
• Google Business Profile: posts go out through the locations you connected in Google Business, and the section on Google user data above applies.
• Quora and other places without posting access: RankFlow has no access to these accounts. We keep the post you prepared and remind you when it is time to post it; when you mark it as posted, you can add its link.

Performance numbers are counts such as likes, comments, shares, saves, views, reach and clicks, on the networks that report them. We do not read your followers, your private messages, other people's comments or posts that were not published through RankFlow. We do not sell this data, use it for advertising or use it to train AI models.

When you ask AI to write a post, draw a picture or learn your style, the topic, text, style and example posts needed for that output are sent to our AI providers as described above. Access tokens, keys and passwords are never sent to them. People at RankFlow do not read your social network data unless you ask us to for support, it is necessary for security, or the law requires it.

To publish pictures and videos, RankFlow puts a copy at a temporary public address on our servers, so that the network can download it. The copy is deleted afterwards.

Access tokens, keys and app passwords are stored encrypted. When you disconnect a channel, its planned posts stop and RankFlow deletes its access as soon as no other channel connected with the same sign-in uses it. Posts that were already published stay on the network until you delete them there or, where the network allows it, from RankFlow.

How to delete your social network data: disconnect the channels in Social, delete the site, or email hello@rankflow.works from the address on your account and we will delete the data and confirm by email. You can also remove RankFlow's access in each network's own settings, for Facebook and Instagram under Apps and websites or Business integrations, and for YouTube at myaccount.google.com/permissions. RankFlow can then no longer post to that account.

Some RankFlow features run on your website and handle data about your visitors. For this data you are the controller and RankFlow is your processor.

• Chat AI widget: we store each conversation (messages, a random visitor ID, browser language and times) for your site. Visitors' messages are sent to an AI provider to generate replies. Your team can read conversations, take over a chat and delete conversations.
• Contact capture: off by default. If you turn it on, details a visitor shares in the chat, such as name, email, phone, company, address and custom fields you define, are saved to your site's Contacts, which your team can edit, export and delete.
• The widget sets no cookies. When chat history is enabled, it keeps the random visitor ID in the visitor's browser localStorage (key __rf_vid) so that a returning visitor can continue the conversation.
• Landing page and RFW site analytics: pages you publish with RankFlow report page views, scroll depth, time on page and clicks. They set no cookies, use a random session ID kept in sessionStorage that ends when the tab is closed, and we do not store visitors' IP addresses. For RFW sites we keep only the referring domain and the device type; raw events are deleted after 30 days and daily totals are kept.
• Forms: submissions from landing page forms are forwarded to the destination you choose (an email sent by RankFlow, your Brevo account or your webhook) and are not stored in RankFlow; emailed submissions include the sender's IP address, browser and page address. Forms on RFW sites are handled by a script on your own hosting and do not pass through RankFlow at all.
• Pages RankFlow generates can load fonts from Google Fonts, which means visitors' browsers connect to Google.

You are responsible for having a legal basis for this processing, for telling your visitors about it in your own privacy notice, and for answering their requests. We will help you with requests about data we hold for you.

• Account, site and content data: while your account is active. Deleting a site deletes it and the data stored with it from our database. Deleting an account also deletes the sites it owns.
• Suspended accounts: blocked, not deleted; their data is kept.
• Audit log: 90 days in our database, after which entries move to compressed monthly archive files; archive files older than six months are deleted.
• Chat conversations and contacts: until your team deletes them or the site is deleted.
• Social network channels and their access tokens: until you disconnect the channel or delete the site. Social posts and their numbers: until you delete them or the site.
• RFW visitor analytics: raw events for 30 days; daily totals for as long as the site exists.
• Google Analytics reports: refreshed daily while Google Analytics is connected. Reports for periods that ended more than a week ago are deleted, and disconnecting Google Analytics deletes them all.
• Team invitations: the invitation link expires after seven days.
• Sign-in sessions: an access token is valid for 15 minutes. Each signed-in device stays signed in until it goes 7 days without use, you sign it out, or you reset your password; its device record is then deleted.
• Google Analytics data from rankflow.works: kept by Google for the retention period set in our Google Analytics account, at most 14 months. The _ga cookies in your browser expire after up to 2 years, and declining in Cookie settings deletes them.
• Your cookie choice: kept in your browser (rf_consent) for 12 months, after which we ask again.
• Logs of AI requests and other technical logs: kept on our servers for troubleshooting.
• Quote requests from rankflow.works: kept in our email for as long as we need them to answer you and follow up.

• Account passwords are stored only as bcrypt hashes.
• Passwords, API keys and OAuth tokens for connected services are encrypted at rest with AES-256-GCM.
• Sign-in uses short-lived access tokens kept only in the page's memory, and a refresh token in an HttpOnly cookie that we store only as a hash. Requests are protected against cross-site request forgery, and a suspended account can no longer sign in or renew a session.
• Inside a site, access depends on each member's role and section permissions. In the app, only the site owner can view the audit log, and passwords, tokens and keys are redacted from it.
• The API applies rate limits and standard security headers.
• When you connect WordPress through the RankFlow plugin, the Application Password is exchanged directly between the servers and never appears in a URL.
• Authorised RankFlow staff can access an account when needed for account approval, support, billing or security. Actions staff take inside an account are recorded in the audit log as staff actions.

Files you upload to the media library are stored on our servers under random file names and served from public web addresses, so that they can appear on your published pages. Anyone who has a file's address can open it.

No system is completely secure. If a breach affects your personal data, we will inform you as the law requires.

Under the GDPR and Serbia's Law on Personal Data Protection, you have the right to:

• access your personal data and get a copy of it;
• have it corrected if it is wrong or incomplete;
• have it deleted;
• restrict how we process it;
• receive the data you gave us in a structured, machine-readable format and have it sent to another service (portability);
• object to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting processing done before;
• not be subject to a decision based solely on automated processing that significantly affects you, and to ask for a person to review it.

Much of this you can do yourself in the app: edit your profile, turn off notification emails by type for each site, disconnect integrations, remove team members, delete chat conversations and contacts, export contacts and, as a site owner, delete a site.

For anything else, including deleting your account or getting a copy of your data, email hello@rankflow.works from the address on your account. We may need to confirm your identity, and we aim to reply within 30 days.

If you are a visitor to a website that uses RankFlow, contact that website's owner, who controls your data. If you write to us instead, we will pass your request on to them and help them respond.

You also have the right to complain to a data protection authority, in particular where you live or work: in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs); in the EU, your country's data protection authority.

On rankflow.works:

• rf_lang (localStorage) remembers the language you choose.
• Fonts are loaded from Google Fonts, so your browser connects to Google's servers.
• The latest blog posts are loaded from our blog at blog.rankflow.works.
• Our chat widget is loaded from api.rankflow.works. It sets no cookies; it may keep a random visitor ID in localStorage (__rf_vid) so that you can continue a conversation. If you chat with us, RankFlow is the controller of that conversation.
• Blog posts count their views: a small script reports a view to api.rankflow.works once you have seen the post for a second. It sets no cookies; sessionStorage (__rf_s) remembers which posts this tab already reported and localStorage (__rf_r) the day you last read each post. We keep only daily counts per post, never your IP address.
• Google Tag Manager (googletagmanager.com) loads on every page with Google Consent Mode set to denied: until you accept, Google tags set no cookies and send only cookieless signals.
• If you accept analytics cookies, Google Analytics sets the _ga and _ga_<ID> cookies (up to 2 years) to recognise repeat visits. rf_consent (localStorage) remembers your choice for 12 months.
• You can change your choice at any time with Cookie settings at the bottom of every page. Declining deletes the Google Analytics cookies.

In the app at app.rankflow.works:

• contentai_refresh_token: an HttpOnly cookie that keeps you signed in on that device until it goes 7 days unused.
• rf_csrf: a cookie, also copied to localStorage, that protects against cross-site request forgery.
• localStorage also remembers interface preferences, such as the theme and panel sizes. The app loads fonts from Google Fonts.

We use no advertising cookies. Apart from the Google Analytics cookies you can accept or decline on rankflow.works, everything listed here is needed for the site or the app to work or to remember your choices.

RankFlow is a service for businesses and professionals and is not intended for children. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We update this policy when the way we handle data changes. The date at the top shows the current version. We will tell account owners about material changes by email or in the app before they take effect.

Privacy questions and requests: hello@rankflow.works.

Service emails are sent from noreply@rankflow.works. To reach us, write to hello@rankflow.works rather than replying to them.