Privacy Policy

Working draft — pending legal review.

What we collect

• Payment details are handled entirely by Stripe. We never see or store card numbers. We store the payment amount, status, the email you give at checkout, and your billing country.
• Listing data you submit (URL, handle, category) plus public metadata we fetch from that destination (title, description, logo).
• Click measurement: when a visitor clicks a listing we log a salted, daily-rotating hash of their IP (never the IP itself), a coarse browser class, the referring page and country. Hashes cannot be linked across days.
• Analytics: cookieless, aggregate analytics. No advertising trackers, no cross-site anything, no consent banner needed.
• Emails: if your email completed a payment, we send transactional notifications (receipts, rank alerts). Every email has an opt-out; the dashboard has a global switch.

Legal bases

Contract (running your listing and dashboard), legitimate interests (fraud prevention, click integrity, service emails to paying customers), and legal obligation (tax and accounting records).

Processors

Stripe (payments), Supabase (database hosting), Vercel (application hosting), Resend (email). Transfers outside the UK/EEA are covered by the UK–US Data Bridge / EU–US Data Privacy Framework or standard contractual clauses.

Retention and rights

Payment records are kept as long as tax law requires. Click hashes are unlinkable after 24 hours by design. You can request access, correction or deletion of your personal data via the contact on the imprint page. You can complain to the ICO (ico.org.uk).

Operator details are on the imprint page. This policy covers RankOutbid only, not the websites listings link to.