Privacy Policy

Your account. Your email address, and the name you give your organisation and workspace. You can sign in with an emailed link or with a password. If you set a password we store only a hash of it, never the password itself, and we cannot read it or tell you what it is.

What you ask us to track. The brand names, domains and prompts you enter. These are business details, not personal ones, but they are yours and we treat them as confidential.

What we collect on your behalf. The answers AI assistants give to your prompts, and the sources those answers cite. These come from public AI services; we do not send them anything about you.

Usage. Pages visited, features used, and errors encountered, so we can tell a broken product from a quiet week.

If you connect Google Search Console, you sign in with Google and grant RankHound one permission: read-only access to Search Console (the webmasters.readonly scope). We cannot change anything in your Search Console account, and we never see your Google password.

What we read. The list of properties your Google account can access, so you can choose one, and for the property you choose: daily clicks, impressions and average position, by page and by search query, for up to the last 16 months, then refreshed a few times a day. We store a refresh token so the sync keeps running; it is encrypted at rest (AES-256-GCM) and used only to call the Search Console API.

What we use it for. Only to show you your own search performance inside RankHound and to compare it, inside our own database, with the answers AI assistants give about your brand, for example which of your pages Google ranks but no assistant cites. It is visible to the members of your workspace and to the API keys and agents you connect. Nothing else.

What we never do with it.We do not sell it, use it for advertising, share it with data brokers, or use it to train AI models, ours or anyone else's. We do not send it to the AI providers that answer your prompts. People at RankHound do not read it, except with your permission to fix a problem you report, for security, or where the law requires.

How long we keep it, and how to remove it. For as long as the connection stays in place. A workspace owner or admin can disconnect Search Console in the app at any time. We then revoke our access with Google and delete the stored token, every row synced from your property and any Search Console exports you uploaded, at once from the live service and within 30 days from our backups. If Google cannot be reached we still delete your data, and tell you how to remove the connection yourself. Deleting your workspace or account deletes the same data; to end our access at Google as well, disconnect first or remove it from your Google Account. You can also remove our access from your Google Account, under Security, Third-party apps with account access, which stops the sync immediately.

RankHound's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use a product analytics provider to record how the application is used, including session replay. Two limits are enforced in our code rather than by their settings, so they hold whichever provider we use:

Replay is disabled entirely on the sign-in pages and every authentication route. A sign-in link contains a working credential, and recording the address bar would put it in a third-party tool. Those parameters are also stripped from any URL we report anywhere.

Form inputs are masked by default, the opposite of the tool's own default, so a field is private unless someone deliberately marks it otherwise.

Card details.Payments go directly to Stripe. Card numbers never reach our servers; we hold only Stripe's customer and subscription identifiers, and which plan you are on.

Your Google password.Connecting Search Console goes through Google's own sign-in; we receive a token, never the password.

We use third-party providers for hosting and databases, our job queue, email delivery, error reporting and product analytics. They process data only to provide those services to us.

Two are worth naming, because what they do affects you directly:

AI providers and data vendors. Collecting answers means sending your prompts to AI services and to a data vendor that queries them on our behalf. We send them the prompt text and nothing else: never your identity, your account, or which brand the prompt belongs to.

Stripe handles payments. Card details go straight to them and never reach our servers.

A current list of our subprocessors is available on request at support@rankhound.ai. We keep it out of this page deliberately: a named list here goes stale the first time we change a vendor, and a policy that is confidently out of date is worse than one that tells you how to get the current answer.

Your data is stored in the European Union. Some subprocessors above are United States companies and may process data outside the EU under the UK's international data transfer agreement or addendum to the EU standard contractual clauses. This means your information may be handled outside the United Kingdom. UK data protection law Principle 8 requires us to say so plainly, and this is us saying it.

Collected answers and the metrics derived from them are kept for as long as your account is open, because the product's value is the trend over time.

Delete your account and we remove your organisation, workspaces, brands, prompts, collected answers and metrics within 30 days. Records we are legally required to retain, invoices chiefly, are kept for six years, as UK tax law requires.

Sign-in tokens expire after 15 minutes. Rate-limiting records are deleted within the hour.

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Email support@rankhound.ai and we will respond within 30 days.

If you are in the EU or UK, you also have the right to object to processing, to restrict it, and to receive your data in a portable format. If you are unhappy with how we handled a privacy matter you can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk, though we would rather you told us first so we can put it right.

We set a session cookie so you stay signed in, and a small number of analytics cookies. We do not use advertising cookies and we do not sell data to anyone, for any purpose.

If we change this policy materially we will email account holders before it takes effect. Questions go to support@rankhound.ai.