Privacy Policy

Last updated: October 16, 2026.

This policy explains what personal information RankyAI collects, why, who we share it with and the choices you have. It applies to ranky.com.mx and the RankyAI dashboard. Section 9 is our Notice to California Residents.

1. Who is responsible

RankyAI is operated in Mexico by an individual entrepreneur (persona física con actividad empresarial) while a company is being incorporated. Mailing address: Av. Huizachillos 195 B, Col. Estrella de la Mañana, La Estrella Angostura, C.P. 78483, San Luis Potosí, S.L.P., México. Contact for any privacy question or request: contacto@ranky.com.mx.

2. Information we collect

• Account data: email, password (stored only as a bcrypt hash) and, if you give it, your name. If you use "Continue with Google", Google shares your email and name with us.
• Business data: your website domain and the description of your business you write, used to write your articles and emails.
• Connection credentials: if you connect WordPress, your application password is stored encrypted (AES-256-GCM) and only decrypted to publish.
• Payment data: processed by Stripe. We only keep your Stripe customer and subscription IDs and your plan — never your card number.
• Free website audit: name, email, WhatsApp (optional), website, audit result and how you found us.
• Security logs: IP address, email used and time of failed logins and blocked requests, deleted after 90 days.
• Cookies: a strictly necessary session cookie and, on Ranky's own pages, Google Ads cookies (see Section 5).

3. How we use it

• To create and run your account and provide the service (keyword research, writing and publishing articles, prospecting tools).
• To bill your plan and support you.
• To protect the service against attacks and abuse.
• To send you account emails (password resets, payment issues) and, occasionally, RankyAI promotions — every promotion has an unsubscribe link.
• To comply with legal and tax obligations.

We do not use your account, business or Google Search Console data for advertising, and we do not use it to train AI models.

4. Service providers

We disclose the minimum data needed to these providers, which process it on our behalf: Anthropic (AI writing), Replicate (images), Brave Search and Google Programmable Search (keyword research), Stripe (payments), Google (sign-in and, if you connect it, read-only Search Console data), OpenAI, Perplexity and Google Gemini (AI visibility questions, without personal data), Apify (public Instagram profiles for the Leads tool), Brevo (newsletter emails), Hostinger (hosting), Google PageSpeed Insights (only the audited URL), Cloudflare Turnstile (bot protection). Most of them operate in the United States. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

5. Advertising cookies (Google Ads)

On Ranky's own pages (home page, sign-up, login and dashboard) we use the Google Ads tag to measure sign-ups that come from our ads and to show RankyAI ads to people who visited our site (remarketing). Google receives the page visited, the date, your IP address and a cookie ID. Under California law this can be considered "sharing" personal information for cross-context behavioral advertising. You can turn it off on our Do Not Sell or Share page, and we automatically honor the Global Privacy Control signal: if your browser sends it, the Google Ads tag is not loaded. We never place the Google Ads tag on our customers' blogs or widgets.

6. Prospect data (Leads tool)

Our customers can find business prospects among public Instagram profiles and Google Maps listings. For people who are not RankyAI users we process only information they made public (username, public name, bio, linked website, follower count, business category and any contact email or phone they published), so that the customer who ran the search can contact them commercially. Each customer only sees their own results. If your data appears and you want it removed, use ranky.com.mx/baja-datos: we delete it from every customer's list and add it to an exclusion list so it isn't collected again.

7. Security and retention

Passwords are hashed with bcrypt, credentials are encrypted with AES-256-GCM, and all traffic uses HTTPS. We keep your data while your account is active and afterwards only as long as needed for legal or tax obligations. Retention for each category is listed in Section 9.

8. Children

RankyAI is for businesses and adults (18+). We do not knowingly collect personal information from children under 13, and we do not sell or share personal information of anyone under 16.

9. Notice to California Residents (CCPA/CPRA)

This section applies to California residents and supplements the rest of this policy under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"). Residents of other states with similar privacy laws (such as Colorado, Connecticut, Virginia, Texas or Oregon) can exercise the same rights described here.

9.1 Categories of personal information we collected in the last 12 months

We collect this information for the purposes in Section 3. We use sensitive personal information only to provide the service and keep your account secure, so the right to limit its use does not apply. We do not collect precise geolocation, biometric data or the contents of your communications other than what you write into Ranky.

9.2 Sale and sharing

We do not sell personal information for money. In the last 12 months we "shared" identifiers and internet activity (IP address, cookie ID, pages visited) with Google for cross-context behavioral advertising through the Google Ads tag described in Section 5. You can opt out at any time on our Do Not Sell or Share My Personal Information page or by turning on Global Privacy Control in your browser.

9.3 Your rights

• Right to know / access: the categories and specific pieces of personal information we have about you, the sources, the purposes and who we disclosed it to.
• Right to delete: ask us to delete personal information we collected from you, subject to legal exceptions (for example, records we must keep for taxes). You can also delete your account from Settings → Delete account.
• Right to correct: ask us to correct inaccurate information.
• Right to opt out of sale or sharing: see Section 9.2.
• Right to non-discrimination: we will not deny you service, charge you a different price or give you a different quality of service for exercising your rights.

9.4 How to make a request

Email contacto@ranky.com.mx with the subject "California privacy request", saying which right you want to exercise. To protect you, we verify your identity by asking you to write from your account email (or, if you don't have an account, by matching the information you give us with what we hold). An authorized agent may submit a request on your behalf with your signed permission; we may ask you to confirm your identity directly. We confirm receipt within 10 business days and respond within 45 calendar days (we may extend once by another 45 days and will tell you why).

Appeals: if we decline your request, you can appeal by replying to our answer with the subject "Privacy appeal". We will respond within 60 days. If you are not satisfied, you can contact your state Attorney General or, in California, the California Privacy Protection Agency.

9.5 Notice at collection

This Section 9 is our notice at collection: it is linked from every page where we collect personal information, including sign-up and the free audit.

10. Changes

If we change this policy in a material way, we will post the new version here with a new date and, if you have an account, email you.

11. Contact

RankyAI · Av. Huizachillos 195 B, Col. Estrella de la Mañana, La Estrella Angostura, C.P. 78483, San Luis Potosí, S.L.P., México · contacto@ranky.com.mx