Privacy Policy

Inubiz Marketing Ltd, a company registered in England and Wales with company number 17309858, registered office 82a James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom, is responsible for this website and the RankBiz platform.

For anything in this notice, write to Support@rankbiz.ai.

We handle two kinds of personal data and our legal role is different for each. Getting this the wrong way round would mislead you about who is accountable, so it is set out first.

Your account: we are the controller. Your name, email address, password, plan, billing records and usage history are data we decide the purposes for. This notice governs them.

Your clients’ records: you are the controller, we are the processor. When you add a client to your workspace — their contact name, email address, your internal notes about them, their website data — you decide why that data is there and what happens to it. We only store and process it on your instructions in order to run the platform. We do not use it for our own purposes, we do not sell it, and we do not use it to train AI models. Our commitments as your processor are in clause 9.

When you create an account

• Your name and email address.
• A password, stored only as a scrypt hash. We never hold your password itself and cannot recover it.
• The date you signed up and the date you last signed in.

When you use the platform

• The URLs you submit for crawling and analysis, and the page content retrieved from them.
• Client records you create: business name, contact name, contact email, and any internal notes you write.
• A record of every tool run — what was run, when, by whom, and what it cost in credits. This is what your usage page and your invoice are built from.
• Data from accounts you choose to connect: Google Search Console properties, Google Business Profile locations. We request read access only, and only to the properties you select.

When you pay us

• Billing name, email and country, plus the subscription record. Card numbers never reach our servers — Stripe collects and holds them directly.

Automatically

• A session cookie so you stay signed in. It is strictly necessary and carries no tracking identifier.
• Standard server logs — IP address, timestamp, and the page requested — kept for security and troubleshooting.
• If you open the live chat, the messages you send and the page you were on. See clause 7.

We do not run advertising trackers, we do not build behavioural profiles, and we do not sell personal data to anyone.

We use the following subprocessors. Each receives only what its function requires, and each is bound by a written contract that restricts what it may do with the data.

On AI models specifically: page content sent to an AI model for analysis is sent through a commercial API. Anthropic does not train its models on data submitted through that API. We do not send your client records, your notes or your billing data to any AI model — only the page being analysed and the figures that appear in your own report.

We will also disclose data where the law requires it, and to a buyer if the business is sold — in which case you will be told before your data moves.

Data is stored on servers in the United Kingdom or the European Economic Area, and is accessed by us from the United Kingdom. One kind of transfer goes beyond that, and it is named rather than glossed over.

To the United States. Anthropic, Google and tawk.to process data there. These transfers rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the UK International Data Transfer Agreement.

You can ask us for a copy of the safeguards in place for any of these transfers at Support@rankbiz.ai.

This site sets a strictly necessary session cookie when you sign in. Without it you could not stay signed in, so it does not require consent and there is no banner asking for it. We set no advertising or analytics cookies.

Our live chat is provided by tawk.to, which sets its own cookies to keep a conversation together across pages. It loads on this public website. If you would rather not use it, simply do not open it — and you can always email Support@rankbiz.ai instead.

• Account and workspace data — while your account is open, then 30 days after closure so an account closed by mistake can be restored, then deleted.
• Crawl and analysis results — while your account is open, or until you delete the project they belong to.
• Billing and accounting records — six years after the end of the accounting period, as UK tax law requires.
• Server logs — 90 days.
• Live chat transcripts — as long as tawk.to retains them under its own policy.

Where you are the controller of client data in your workspace (clause 2), we undertake to:

• process that data only on your documented instructions;
• keep it confidential and ensure our staff are bound to the same;
• apply appropriate technical and organisational security measures;
• engage subprocessors only as listed in clause 5, and tell you before adding a new one;
• help you respond to requests from the people whose data it is, and to any security incident;
• delete or return the data when you close your account, on the timetable in clause 8.

If your own compliance requires a separate signed data processing agreement, email Support@rankbiz.ai and we will provide one.

Under UK GDPR you have the right to:

• be told what we hold about you, and get a copy of it;
• have inaccurate data corrected;
• have data erased where we no longer have grounds to keep it;
• restrict or object to processing based on our legitimate interests;
• receive your data in a portable, machine-readable form;
• withdraw consent at any time, where consent is what we rely on.

Email Support@rankbiz.ai and we will respond within one month. There is no charge.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office. We would rather you came to us first so we can put it right.

Every item below describes something the software actually does today. A security statement is a representation you are entitled to rely on, so this section lists mechanisms rather than intentions.

• Encrypted in transit. Every connection to RankBiz uses TLS (HTTPS). Traffic to the third parties in clause 5 is encrypted the same way.
• Passwords are never stored. Only a scrypt hash is kept. We cannot read your password, recover it, or tell it to you — a reset is the only route, for us as much as for you.
• API keys are encrypted at rest. Any provider key you add for your own models is sealed with AES-256-GCM before it touches the database, under a key derived from a secret held outside it. Once saved it is never displayed again, to you or to us — the settings screen can show only its last four characters.
• Tenant isolation is enforced at the query, not the page. Every database read is filtered by the workspace making it, so one customer’s data cannot be returned to another even if a page asked for it. A client-portal login carries both a workspace filter and a client filter, so a mistake in either still fails closed. This is covered by an automated test that runs against the real database.
• Sessions are signed and HTTP-only. The session cookie cannot be read by JavaScript and is rejected if altered.
• Access on a need-to-know basis. Staff at Inubiz Marketing Ltd reach customer data only when handling a specific request, and only the data that request needs.
• Sign-in is rate limited per account and per address, so a password cannot be guessed at volume.

No system is perfectly secure, and we would rather say so than imply otherwise. If a breach affects your rights we will tell you, and the Information Commissioner’s Office, within the time the law requires.

RankBiz is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

We will update this notice as the platform changes. The effective date at the top always reflects the current version, and we will email account holders before any change that materially affects how we use personal data. Related documents: our Terms of Service and Refund Policy.