Privacy Policy

What We Collect

We keep only what the service needs to work:

• Account email — if you create a free account, so we can sign you in and send verification or reset links.
• Every scan and its inputs — when you run a free scan or a Rank DNA report, we store what you entered (the domain, and for Rank DNA the category, market, city, and the keyword list), the scores it produced, and a link to the report. We keep these to improve the product and, if you have an account, to contact you about your results.
• Your scan history, linked to you — a scan you run while signed in is linked to your account. If you create an account later, we may connect scans you ran before signing up — matched by your browser session or a one-way hash of your address — and we label those links inferred, so it is clear they were not made while signed in.
• A one-way hash of your IP address — scan records store a salted hash of your address (not the address itself) for linkage and abuse control. Your raw address still appears in ordinary server logs, the way it does with any web server.
• Messages — if you write to us, or use a client message thread, we keep the thread.
• Server logs — the ordinary request logs (address, time, page) that any web server keeps.

What We Don't Do

We do not sell your data. We do not run advertising networks, and we do not embed third-party advertising or cross-site tracking cookies. We do no third-party identity resolution and no device fingerprinting — the only signals we use to connect your activity are your signed-in account, your session, and a one-way hash of your IP address. Our site uses a privacy-first, cookieless web-analytics measurement provided at our edge to count page views and performance — it sets no cookies and does not follow you across other sites.

Cookies

The marketing pages and the free scan set no cookies. When you sign in to a free account or the client portal, we set a single session cookie so you stay signed in. It is marked HttpOnly and SameSite=Strict, is scoped to the area you signed in to, and carries no tracking — it exists only to keep your session.

How Long We Keep It

We keep your account while it is active, and we keep every report you run so it stays available to you. A report is a measurement of a business and its website, and we keep it permanently as part of our measurement record (see “How We Use Reports”, below). Server logs rotate on an ordinary schedule. When you delete your account, you lose access and we sever your personal login identity from our records; the reports themselves — the domain and inputs, the scores, the time — remain.

Deleting Your Data

You can ask us to delete your account at any time. Email [email protected] from the address on the account, and we will confirm when it is done. Deleting your account ends your access and severs your personal login identity: your email, and the account, session, and hashed-address linkage, are cleared from your scan records so nothing in them points to you as a person. The report itself — the domain and inputs you entered, the scores, and the time — remains as part of our measurement record. We are honest about what that means: a report names a public website, so it still identifies that business; what it no longer carries is you, the person who signed in.

How We Use Reports

Every report measures a business and its website, and we keep it as part of our measurement record. We may use the reports and scan facts we hold to operate, improve, and build our products, to publish research and benchmarks, and to show example reports — on two firm conditions: anything we publish has the business name and domain masked, and it never includes personal identity. We publish aggregate statistics only for groups of at least five different businesses, so no single business can be read out of a figure. Showing an individual report publicly as a named, identifiable example still requires your consent, exactly as it does today, and you can withdraw a published example at any time through our removal path. ‘Masked’ and ‘de-identified’ mean your personal login identity is removed and the business is hidden on anything public — not that a business can never be identified in our own internal records, which keep the domain.

Scanning Someone Else's Site

When you scan a domain, we collect nothing about that domain's owner. We read a public page and public records the way a browser or a search engine does — no login, no private data, nothing behind a wall. If you own a scanned site and want its public report unpublished, our Acceptable Use policy has the removal path.