1. Who we are
Rankrama is an SEO platform made by Demor Digital. This Privacy Policy applies to the website rankrama.com, the free SEO tools on it and the Rankrama application at app.rankrama.com (together, the "Service").
The Service is operated by [COMPANY LEGAL NAME] ("Demor Digital", "we", "us"), registered at [REGISTERED ADDRESS], tax office / tax number [TAX OFFICE / TAX NUMBER], MERSİS number [MERSİS NO]. We are the data controller for the personal data described in this policy. You can reach us at [CONTACT EMAIL].
If you are in Turkey, our KVKK privacy notice under Law No. 6698 on the Protection of Personal Data also applies. If you are in the European Economic Area or the United Kingdom, our representative there is [EU REPRESENTATIVE].
2. Personal data we process
We only process the data the Service needs to work. Depending on how you use it, this includes:
- Account data: your name, email address, password (stored only as a one-way hash, never in readable form), language preference, the time of your last login and your email notification settings.
- Workspace and team data: the name of your workspace (company or team name), the members of a workspace and their roles, and the email addresses of people you invite.
- Session and security data: while you use the Service we keep a session record that contains your IP address and your browser's user agent, so that sign-ins can be managed and misuse can be detected.
- Google connection data: the service account JSON keys you upload, or, if you connect a Google account, an OAuth refresh token and the email address of that Google account. Keys and tokens are stored encrypted.
- Project data: the sites you add, their sitemaps and URLs, indexing submissions, index inspection results, site audit results, page snapshots used for change monitoring (title, meta description, canonical, robots directives, headings, hreflang, structured data types and status codes), page change history and the reports you create.
- Search Console performance data: clicks, impressions, click-through rate and average position by query, page, country and device, stored per day.
- Logs: submission logs and activity logs (who did what in a workspace, and when).
- API tokens: if you create API tokens, we keep only a hash of each token and a short prefix that helps you recognise it.
- Billing data: if you subscribe to a paid plan, the billing name or company name, address, city, postal code, country, tax office and tax number, national identity number where Turkish invoicing rules require it, billing email address, an optional phone number, your invoices and the customer reference of the payment provider. We never receive or store your full card number or security code.
- Free tool inputs: the URL or text you enter into one of the free SEO tools on our website.
- Support messages: what you write to us and our replies.
You give us most of this data directly. Session data is created automatically when you use the Service. Search Console data is fetched from Google with the access you grant. Project data comes from the public pages of the sites you add.
3. How we use your data
- To create and run your account and workspace, sign you in and keep the Service secure.
- To provide the features you use: reading sitemaps, crawling the public pages of your sites for audits and change monitoring, submitting URLs to Google and IndexNow, inspecting index status and syncing Search Console data.
- To send service emails: account emails such as password resets and team invitations, problem alerts, a daily email about pages that dropped out of the index, a weekly summary and notices about your trial and subscription. You can turn alerts, dropped-page emails and the weekly summary off in your account settings. Emails that are needed to run your account cannot be turned off.
- To manage trials, subscriptions, payments and invoices, and to meet our accounting and tax obligations.
- To answer your support requests.
- To detect and prevent misuse, for example by rate limiting the free tools and the sign-in forms.
We do not sell personal data, we do not use it for advertising and we do not build marketing profiles.
4. Legal bases
Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies, we rely on the following legal bases:
- Performance of a contract (Art. 6(1)(b) GDPR): running your account, workspace, projects, integrations, emails you need and billing.
- Legal obligation (Art. 6(1)(c) GDPR): keeping invoices and accounting records.
- Legitimate interests (Art. 6(1)(f) GDPR): keeping the Service secure, preventing misuse, rate limiting, answering questions from visitors, running the free tools and showing profile photos in the application.
For users in Turkey, the legal grounds under Law No. 6698 are listed in our KVKK privacy notice.
5. Google data
To use the indexing and Search Console features you connect Google access to a workspace, either by uploading a Google Cloud service account key or by connecting a Google account with OAuth. We request access to the Google Indexing API and the Search Console API (plus your Google account's email address when you use OAuth).
We use this access only to provide the features you use: notifying Google of new, updated or removed URLs, inspecting the index status of your pages, reading and submitting sitemaps and reading search analytics (queries, pages, countries and devices).
Rankrama's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Search Console performance data is stored per day for as long as the project exists, so you can see it beyond Google's own 16-month limit. It is deleted when the project is deleted. You can remove a connected Google account in Rankrama at any time, and you can also revoke OAuth access in your Google account at myaccount.google.com/permissions.
6. Crawling your sites and IndexNow
When you add a site, our crawler fetches its public pages: sitemaps, robots.txt and HTML pages. It identifies itself with the user agent "RankramaBot/1.0 (+https://rankrama.com/bot)". Site audits follow the robots.txt rules that apply to RankramaBot. We crawl only sites that users have added to a project, and you should only add sites that you own or are authorised to manage.
From the pages we fetch we keep the SEO-relevant elements listed above, not full copies of the pages. Public pages can contain personal data (for example an author name in a title); that data is processed only as part of the page elements we store.
If IndexNow is enabled for a project, we send the URLs of the changed pages, together with the project's IndexNow key, to the IndexNow service (api.indexnow.org), which shares them with participating search engines such as Bing, Yandex, Seznam, Naver and Yep. Only URLs are sent, no personal data about you.
7. Free SEO tools
The free tools on our website work without an account. When you use one, our server fetches the URL you entered (or analyses the text you pasted) and shows you the result. We do not store what you enter or the results.
To prevent misuse, each tool is rate limited. For this, a counter derived from your IP address is kept in our cache for about one minute.
9. Profile photos (Gravatar)
The application shows profile photos from Gravatar, a service of Automattic Inc. To do this, your browser requests the image from gravatar.com using a SHA-256 hash of the user's email address. Gravatar therefore receives this hash together with your IP address and browser information. This also happens for the photos of other members of your workspace.
If no Gravatar image exists for an email address, the application shows the person's initial instead. Automattic's handling of this data is described in its privacy policy.
10. Service providers and other recipients
We use the following service providers (sub-processors) to run the Service. They process personal data on our behalf and only for the purposes described here.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Google LLC | Indexing API, Search Console API (URL submissions, index inspection, search analytics, sitemaps) and OAuth connection | URLs of your sites, Search Console property, service account credentials or OAuth tokens, email address of the connected Google account | USA |
| Stripe | Card payments in USD outside Turkey | Billing details, payment and transaction data | USA / Ireland (depending on the contracting Stripe entity) |
| iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) | Card payments in TRY in Turkey | Billing details, national identity number where required, payment and transaction data | Turkey |
| Automattic Inc. (Gravatar) | Profile photos in the application | SHA-256 hash of the email address, IP address, browser information | USA |
| [EMAIL PROVIDER] | Sending service and alert emails | Name, email address, email content | [EMAIL PROVIDER LOCATION] |
| [HOSTING PROVIDER] | Servers, database and backups | All data stored in the Service | [HOSTING LOCATION] |
Personal data can also reach these recipients:
- Members of your workspace, who can see the workspace's projects, reports and activity log, and the names and email addresses of the other members.
- Search engines that receive your URLs through the Google Indexing API or IndexNow (URLs only).
- Anyone with a shared report link, as described above.
- Public authorities and courts, when we are legally required to disclose data.
11. International transfers
Some of our providers are located outside Turkey and outside the European Economic Area, mainly in the USA. When personal data is transferred abroad, we rely on the safeguards the applicable law provides: [TRANSFER SAFEGUARDS].
12. How long we keep data
- Account and workspace data: for as long as your account exists. After you ask us to delete your account, we delete it within [DELETION PERIOD], except for data we have to keep by law.
- Project data (pages, audits, page snapshots, page change history, reports and Search Console performance data): for as long as the project exists. It is deleted when a workspace manager deletes the project.
- Submission and activity logs: deleted automatically after 90 days.
- Invoices and billing records: for the period required by tax and commercial law ([LEGAL RETENTION PERIOD]).
- Session records: until you sign out or the session expires.
- Free tool inputs: not stored; the rate-limit counter expires after about one minute.
- Backups: deleted data can remain in backups for up to [BACKUP RETENTION PERIOD] before it is overwritten.
13. Security
We protect your data with technical and organisational measures that fit the Service. Connections are encrypted, passwords are stored only as hashes, Google keys and OAuth tokens are encrypted, API tokens are stored as hashes and access inside a workspace depends on the member's role. No system is completely secure; if a breach affects your personal data, we will inform you and the authorities as the law requires.
14. Your rights
Depending on where you live, you have the right to:
- ask whether we process your personal data and get a copy of it (access);
- have incorrect or incomplete data corrected;
- have your data deleted;
- object to processing based on legitimate interests, and ask us to restrict processing;
- receive the data you gave us in a structured, machine-readable format (portability);
- lodge a complaint with a data protection authority: in Turkey the Personal Data Protection Authority (KVKK), in the EU the supervisory authority of your country.
Users in Turkey have the rights in Article 11 of Law No. 6698; they are listed in our KVKK privacy notice.
You can change your name, email address, password, language and email notifications yourself in your account settings, and export page lists and audit results as CSV files. Self-service account deletion is not available yet: to delete your account or exercise any other right, write to [CONTACT EMAIL] from the email address of your account. We answer within one month (within 30 days for requests under Law No. 6698).
15. Children
The Service is meant for businesses and professionals. It is not directed at children, and we do not knowingly collect personal data from anyone under 16.
16. Changes to this policy
When the Service or the law changes, we update this policy and the "Last updated" date at the top. If a change materially affects how we use your data, we will tell you by email or in the application before it takes effect.
17. Contact
[COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Email: [CONTACT EMAIL]. For requests under Law No. 6698: [KVKK CONTACT EMAIL].