Privacy Policy

RankSlide is operated by RankSlide, House 771, Buikora, Noapara 7460, Jashore, Bangladesh. Contact: privacy@rankslide.com.

• Account data: your name and email address from Google sign-in.
• Google Search Console data: with your permission we read, for the properties you connect, daily clicks, impressions, click-through rate and average position by page and by search query. For each site's most important pages we also ask Search Console's URL Inspection whether Google has them indexed, and store that answer. We request only the read-only scope (webmasters.readonly) and never change anything in your Search Console or on your website.
• Clients who connect through an agency's link: when an agency's client opens a connect link and allows access, we receive their Google email address and a read-only Search Console access token, and see the list of Search Console properties their account can access. Only the properties the client then chooses are added to that agency's account; we read the same Search Console data described above for them, and the agency can see that data and the client's email address. The client does not get a RankSlide account. If the client doesn't finish choosing sites, the token is revoked and deleted within a day.
• Team members: if an account owner invites you to their team, we store the invite (your email address) and your membership. Team members can see and work with the account's data, and the owner can see each member's name and email. If you add a site from your own Google account while on a team, your read-only Search Console access is stored for that site so it can sync.
• Page checks: to investigate traffic drops, our server loads the public pages of your sites that appear in your Search Console data (the user agent is “RankSlide/1.0”), and keeps a copy of each key page's title, description, main heading, canonical, robots rules, word count and structured data types about once a week, so we can show what changed before a drop. We don't store the page text itself.
• Client email addresses: if you turn on monthly client reports, the addresses you add for each site. We use them only to send those reports on your behalf. Every report email has an unsubscribe link, and an address that unsubscribes stays unsubscribed for that site unless you remove and re-add it at the person's request.
• Your sending mailbox: if you connect your own mailbox so client reports come from your address, we store its SMTP server, username, From and reply-to addresses, and its password, which is encrypted before it is stored and never shown again or sent to a browser. We use it only to send your client reports and the test emails you ask for. Removing the mailbox in Settings deletes these details.
• Feeds and webhooks you turn on: a live feed link lets anyone who has it read the data you chose for your account (that is how Google Sheets imports it), so treat it like a password; you can replace or turn it off in Settings. Webhooks send event data (for example a drop's page, numbers and likely cause) to the web addresses you add, signed with a secret we store encrypted. Where that data goes after it reaches your address is up to you and that service.
• Billing data: your plan, subscription status and Lemon Squeezy customer id. Card details are collected and stored by Lemon Squeezy, never by us.
• Usage data: standard server logs (IP address, browser, pages visited) kept for security and debugging.
• Site analytics: we count visits to our public pages and the demo with our own cookieless analytics: the page, the referring site, any campaign tag in the link and the device type. We don't use cookies or browser storage for this and don't store IP addresses; a visitor is a code made from that day's random value, the IP address and the browser, so visits can be counted within a day but not linked across days or to a person (each day's value is deleted after two days). When you sign up we note which page and source brought you that day. Your browser's Do Not Track or Global Privacy Control setting turns this off. Pages your clients open from you (reports, dashboards, connect links) are never counted.

To detect traffic drops and declining pages, generate explanations and reports, send the alerts and client reports you've set up, provide support and bill you. While you get started we also email you a few setup tips and reminders about your trial, using your own account's numbers; you can turn these off in Settings or from any of those emails. Aggregated metrics for a specific drop (page URL, click and position numbers, affected queries) may be sent to an AI provider (Anthropic) to produce a plain-English explanation; no account or personal data is included. When you choose another language for a client's reports, the report's generated sentences (which can include page paths and search terms) are sent to the same provider to be translated, and the translations are kept for up to 16 months so the same sentence isn't translated twice.

RankSlide's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or allow humans to read it except with your consent, for security, or as required by law.

Only the service providers that run RankSlide: Supabase (database and authentication), Hostinger (hosting and email), Anthropic (AI explanations, summaries and report translations) and Lemon Squeezy (payments and invoicing, as Merchant of Record, and our affiliate program). Each processes data only on our instructions. We never sell your data.

When we investigate a traffic drop, we send the address of that one public page, and nothing else, to the Internet Archive (to find its earlier archived copy, when we don't have one) and, for drops mostly on mobile, to Google PageSpeed Insights (to test its mobile speed).

Search data (daily page and query metrics, detected drops and their investigations, key-page copies and reports) is kept for up to 16 months and then deleted automatically every night. Disconnecting a site deletes its data and, for a site a client connected, revokes the client's Google access once no other site uses it; deleting your account removes everything within 30 days. Unused client connect links are deleted after 90 days. Anyone who granted access can also revoke it at any time from their Google account permissions page. Billing records are kept as long as the law requires.

We use the cookies needed to keep you signed in and remember your preferences (such as dark mode). We don't use advertising cookies.

If you arrive through an affiliate link (a link containing ?aff=), Lemon Squeezy's affiliate script sets a referral cookie (ls_aff_ref) for up to 60 days so the person who referred you can be credited if you subscribe. To prevent referral fraud, Lemon Squeezy also derives an anonymous browser identifier when it records the referral. The script isn't loaded for visitors who didn't come through an affiliate link. You can delete the cookie at any time in your browser settings.

Data is encrypted in transit (HTTPS) and at rest. Google access tokens are stored server-side only and are never exposed to the browser. Access to production systems is restricted and logged.

You can access, correct, export or delete your data at any time from Settings or by emailing privacy@rankslide.com. If you are in the EU or UK you also have the right to complain to your data protection authority.

We'll email you about material changes to this policy at least 14 days before they take effect.