Legal
Privacy policy
Last updated November 1, 2026
RankTwice is operated by [Company legal name], [Registered address] ("we", "us"). This policy explains what personal data we handle when you use the RankTwice app, its Chrome extension, its emails and this website, and the choices you have. Questions go to [[email protected]].
Our customers are agencies and freelancers. For the client data they add, such as the email addresses that receive reports, the agency decides what goes in and we process it on their behalf.
What we collect
Your account
Your email address, and your name and profile picture if you sign in with Google. Sign-in is handled by our authentication provider, so we never see a password.
What you put in a workspace
- Client names and domains, competitors, keywords and AI prompts.
- Branding: your logo, colour, website and report footer.
- Email addresses of teammates you invite and of people you send reports to.
What the service produces
Google rankings, saved AI answers, domain metrics, audit results and alerts for the sites you track or audit.
Google Search Console and Analytics, if you connect them
The email of the Google account you connect, a refresh token that lets us read data while you're away, and read-only data for the properties you pick: Search Console clicks, impressions, queries and pages, and GA4 organic session counts.
The Chrome extension
Nothing runs until you open the extension, except on RankTwice's own connect page, where a small script receives your extension key when you click Connect. When you open it, it reads the address and content of the tab you're on to check the page. That check happens in your browser. If you've connected a workspace, the site's domain is sent to us to look up its authority and traffic; if not, nothing is sent. The extension stores your extension key in Chrome's local storage. It doesn't collect your browsing history.
Technical data
Our hosting provider logs requests (IP address, browser, time) to keep the service running and secure. We count API key requests to enforce rate limits.
Payments
When you subscribe, Dodo Payments, our merchant of record, collects your name, billing email and address, and payment details such as your card, to take the payment, work out tax and send invoices. It handles them under its own privacy policy too. We keep only your plan, billing period and payment status, never card numbers.
How we use it
- To run the service: tracking rankings and AI answers, building reports, sending the emails you set up, and running audits.
- To keep it secure and prevent abuse, including rate limits and daily usage caps.
- To support you and tell you about changes to the service or your plan.
- To meet legal obligations.
We don't sell personal data, use it for advertising, or use your workspace data or Google data to train AI models. We only email you about other products if you agree to it.
If you're in the EEA or the UK, our legal bases are: performing our contract with you; our legitimate interests in running and securing the service; your consent, where we ask for it; and legal obligations.
Google user data
RankTwice's use and transfer to any other app of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.
- We only use Google data to show it in your workspace and in the reports you create.
- We don't transfer it to others except as needed to provide the service, to comply with the law, or with your permission.
- People at RankTwice don't read it unless you ask us to, it's needed for security or abuse investigations, or the law requires it.
- Our access is read-only. Disconnecting Google in your workspace settings revokes it, and we delete the stored token.
Who we share it with
We use these providers to run the service. Each processes data only on our instructions.
| Provider | What for | Data involved |
|---|---|---|
| Cloudflare | Hosting the app and API, background jobs, and storage of raw provider responses | All workspace data in transit; request logs |
| Supabase | Sign-in and the database | Account details and all workspace data |
| DataForSEO | Google results, AI answers and domain metrics | Keywords, AI prompts and domains you track; no personal details |
| Resend | Sending emails: invitations, alerts and monthly reports | Recipient email addresses and email content |
| Search Console and GA4 data, only if you connect a Google account | Your Google account email and the properties you choose | |
| Dodo Payments | Merchant of record for paid plans: checkout, tax and invoices | Name, billing email and address, and payment details such as card (we never see them) |
Anyone with a client-portal or shared-audit link you create can open it, so share links only with the people they're for; you can switch a link off at any time. We also disclose data when the law requires it, or to a buyer if the business is sold, under this policy.
Audits of other websites
When you run an AI-readiness audit, our crawler fetches the site's robots.txt, llms.txt and sitemap and up to 10 public pages, identifying itself as SiteReadinessAudit. It reads only what any visitor could, and doesn't sign in or submit forms.
How long we keep it
We keep workspace data for as long as the workspace exists, so that ranking and AI history stays available. When you ask us to delete a workspace or your account, we delete its data within [30] days, and from backups within [90] days, except records we must keep by law. Cached Google data is refreshed every few hours and cleared out after about a week.
Security
Data travels over encrypted connections. Google refresh tokens are encrypted at rest. API keys and invitation links are stored only as hashes, so they can't be read back from the database. Only the members of a workspace can see its data, and owners and admins control who those are.
International transfers
Our providers may process data outside your country, including in the United States. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses.
Your rights
You can ask to access, correct, export or delete your personal data, object to or restrict how we use it, and withdraw consent you've given. Email[[email protected]]; we answer within 30 days. If you're in the EEA or UK you can also complain to your data protection authority. If you're a California resident: we don't sell personal information or share it for cross-context behavioural advertising.
If your data is in a workspace that an agency runs, such as a report recipient's address, you can also ask that agency directly.
Cookies and browser storage
We use no advertising or analytics cookies, and this website sets none. The app keeps your sign-in session and your chosen workspace in your browser's storage, and sets one short-lived cookie to protect the step where you connect Google.
Children
RankTwice is a business tool and isn't meant for anyone under 16.
Changes to this policy
We'll update the date at the top when this policy changes, and email workspace owners about significant changes before they take effect.
Contact
[Company legal name], [Registered address]. Email [[email protected]].