Privacy Policy

Last updated: 11 November 2026 · Revision 4.4

This is an English translation of the German Datenschutzerklärung for convenience. Only the German version is legally binding; in case of any discrepancy the German version prevails.

This privacy policy applies to the websites and services of rankyn, in particular rankyn.ai and rankyn.app (rankyn.de and www.rankyn.de redirect to rankyn.ai), including the SaaS application provided there.

1. Controller

The controller within the meaning of the General Data Protection Regulation ("GDPR") is:

Levin Föhrding
trading under the business name rankyn
Friedenstr. 58
47053 Duisburg
Deutschland
Email: info@rankyn.ai
VAT ID: DE462810449

No data protection officer has been appointed.

2. General information on data processing

rankyn is cloud-based B2B software for analysing and improving how brands and products are presented in, made visible by, and recommended by AI systems.

We process personal data only insofar as this is necessary to provide our website and services, to perform contracts, and for communication, billing, security and product operation, or where another legal basis applies.

rankyn is not intended for the processing of special categories of personal data within the meaning of Art. 9 GDPR or of personal data relating to criminal convictions and offences within the meaning of Art. 10 GDPR.

Our customers are contractually obliged not to enter any such data into rankyn.

As intended, the rankyn platform predominantly processes non-personal product, brand, market, competitor, prompt and measurement data.

3. Legal bases

Depending on the processing, we rely in particular on:

• Art. 6(1)(b) GDPR for contracts and pre-contractual measures;
• Art. 6(1)(c) GDPR for legal obligations;
• Art. 6(1)(a) GDPR for consent, in particular for the newsletter;
• Art. 6(1)(f) GDPR for legitimate interests.

In B2B contracts where the user is not personally a contracting party but, for example, an employee of a business customer, we generally process business contact data on the basis of our legitimate interest in performing and managing the business relationship.

Our legitimate interests include in particular secure and stable operation, IT and information security, prevention of abuse and fraud, error analysis, improvement of usability, management of business customer relationships, and legal defence.

4. Visiting our websites and hosting

Our websites and the rankyn application are operated via Vercel.

When you visit them, the following may be processed in particular: IP address, date and time, requested URL, HTTP status code, browser type and browser version, operating system, referrer information, and technical request and security information.

The processing serves the delivery, security and stability of the service.

The legal basis is Art. 6(1)(f) GDPR.

We use services of Vercel Inc., USA. The production server functions run in the European region of Dublin (Ireland). Vercel participates in the EU-US Data Privacy Framework; processing may also take place in the USA.

Name resolution (DNS) for rankyn.ai and rankyn.app is provided by Cloudflare, Inc., USA exclusively as an authoritative DNS service; website or application traffic is not routed through Cloudflare (no proxy). The domain rankyn.de is managed via the registrar INWX GmbH, Germany.

5. Database and data storage via Supabase

For database, backend and storage functions we use Supabase, Inc.

Our production Supabase instance is set up in eu-west-1, Ireland.

Depending on use, the following may in particular be stored in Supabase:

• technical user and organisation identifiers;
• workspace and organisation data;
• product and shop information;
• prompts;
• intents;
• competitor information;
• measurement results;
• AI responses and metadata;
• findings and recommendations;
• interventions and fix requests;
• reports and other data generated in the product.

As intended, this data does not contain any personal data of our customers' end customers.

6. Registration, user accounts and authentication

To manage user accounts and for authentication we use Clerk, Inc., USA.

In particular, the following may be processed: name, business email address, internal user ID, organisation assignment, login times, authentication and security information, IP address, browser and device information, and information on login attempts.

The legal basis is Art. 6(1)(b) GDPR where the user is personally a contracting party, otherwise Art. 6(1)(f) GDPR.

Clerk is a processor in the context of rankyn's own account and contract processing (data processing agreement in place); no Customer Content. Insofar as Clerk, under its DPA, processes individual account or service data for its own purposes, it does so as a separate controller under data protection law. Clerk participates in the EU-US Data Privacy Framework; processing may take place in the USA.

7. Sign-in with Google

Where offered, users may sign in via Google OAuth.

In this case, data is exchanged between Google, Clerk and rankyn. Depending on the permissions granted, this may include name, email address, Google account identifier and technically required authentication information.

The use of Google OAuth is voluntary.

The legal basis is Art. 6(1)(b) GDPR or, for users of a business customer, Art. 6(1)(f) GDPR.

8. Use of the rankyn platform

When you use the SaaS application, we process the information required to provide its functions. This includes in particular:

• organisation and workspace;
• product and brand data;
• product variants and descriptions;
• categories, prices, availability and stock;
• GTINs, image and product URLs;
• prompts and prompt versions;
• intent labels;
• competitor names and domains;
• measurement results;
• AI responses;
• citations and grounding metadata;
• model and provider information;
• findings, interventions and fix requests;
• reports;
• technical usage and system information.

Free text

Free-text fields are not intended for the entry of personal data. In particular, users must not enter personal data of end customers or other third parties into generic purchase queries or other free-text fields.

Files

In version 1, rankyn only allows CSV imports of product data as an alternative to the Shopify connection. Other file uploads by customers are not offered. Product images are generally referenced via URLs. Reports may be provided as PDF.

9. Shopify integration

rankyn can be connected to a customer's Shopify shop.

In version 1, the integration is technically limited to product and inventory data. In particular, read_products and read_inventory are used. In addition, the products/update webhook may transmit product changes.

In particular, the following are retrieved: products and variants, product texts, categories, prices, stock and availability, GTIN, product images, product URLs, and shop and brand master data.

rankyn does not retrieve any end-customer data, order data or payment data.

The connection is set up by an authorised user of the respective Shopify shop.

10. Processing by AI providers

rankyn uses external AI providers for internal evaluation, extraction and synthesis tasks, as independent API measurement channels and – where technically provided for – as a fallback.

rankyn carries out measurements of AI providers' consumer interfaces primarily via the technical measurement service Bright Data described in Section 11.

Where rankyn addresses AI providers directly via API, rankyn uses exclusively commercial offerings or offerings intended for business customers. In particular, the following providers may be used for this:

• OpenAI Ireland Ltd. – API measurement channel "OpenAI (API)" (Responses API with web search; Enterprise plan only) for measuring AI responses via API (prompt texts with product category or domain; no customer master data); in addition, internal evaluation and technical fallback;
• Anthropic (contracting party Anthropic Ireland, Limited; processing by Anthropic, PBC in the USA) – internal evaluation, in particular suggestions for prompts and intents, extraction and synthesis, as well as API measurement channel "Claude (API)" (Claude API with web tools; Enterprise plan only) for measuring AI responses via API (prompt texts with product category, product or brand names, or domain; no customer master data). Processing takes place in the USA. The transfer is based on the EU-US Data Privacy Framework insofar as the recipient is certified, and otherwise on the Standard Contractual Clauses of the European Commission in Anthropic's Data Processing Addendum;
• Google Cloud EMEA Limited – API measurement channel "Gemini (API)" (Gemini Paid Service with Google Search grounding) for measuring AI responses via API (prompt texts with product category or domain; no customer master data); in addition, where activated, internal evaluation, extraction or synthesis;
• Perplexity AI, Inc. – API measurement channel "Perplexity (API)" (Sonar API) for measuring AI responses via API (prompt texts with product category or domain; no customer master data); in addition, where activated, internal evaluation or technical fallback.

Depending on the respective function, the following may in particular be transmitted to such direct API services:

• generic prompts or internal analysis instructions;
• language;
• country or geographic context;
• technical model parameters;
• non-personal product, brand, measurement or evaluation contexts.

The results obtained via APIs may be processed as measurement results of the API measurement channels and for internal extraction, structuring, synthesis, quality assurance or a technical fallback.

The primary measurement path for the consumer interfaces of ChatGPT, Gemini, Google AI Overviews, Google AI Mode and – where activated – Perplexity does not run via these APIs but via Bright Data in accordance with Section 11. The API measurement channels "Gemini (API)", "Perplexity (API)", "OpenAI (API)" and "Claude (API)" additionally measure the responses of the respective programming interface; their results may differ from those of the consumer interfaces.

Prompts and other inputs are not intended for the targeted processing of personal end-customer data. rankyn does not use data provided by customers to train its own generative AI models.

11. Web and market data via Bright Data

To carry out the primary measurements of consumer interfaces as well as certain market, web and AI measurements, rankyn uses Bright Data Ltd. as its primary technical measurement service.

Bright Data is used in particular for the technical retrieval of publicly accessible consumer interfaces of AI providers (in particular ChatGPT, Gemini, Google AI Overviews and Google AI Mode on Google search results pages and – where activated – Perplexity) as well as of commerce, product, brand, market and web information and measurement results.

The processing is not aimed at the targeted collection of personal data. In particular, the following may be processed:

• publicly accessible product information;
• product names and product attributes;
• prices and availability;
• brand information;
• domains and URLs;
• publicly accessible website content;
• search and AI measurement results;
• language and geographic measurement context;
• generic, non-personal prompts.

rankyn does not use Bright Data for the targeted collection of end-customer data, the creation of personal profiles, or the collection of private or access-restricted personal information.

In individual cases, publicly accessible websites or AI responses may incidentally contain personal details, such as the names of founders, managing directors, brand ambassadors or other publicly appearing persons. Such processing is not aimed at these persons and is limited to the extent necessary for the respective market or measurement analysis.

Personal rankyn account data, authentication data and personal end-customer data are not specifically transmitted to Bright Data.

Further measurement service providers: DataForSEO and cloro

In addition to Bright Data, we are gradually introducing the following technical measurement services for search results and consumer interfaces of AI providers from November 2026:

• DataForSEO (DataForSEO OÜ, Tallinn, Estonia);
• cloro (Cloro Incorporation Ltd., Valletta, Malta).

From the time each service is used, as with Bright Data, generic measurement prompts relating to products, brands or categories as well as language and geographic measurement context are transmitted. Account, authentication and end-customer data are not specifically transmitted.

12. Error analysis with Sentry

To detect, analyse and fix technical errors, we use Sentry in a European data region.

Only necessary technical information is processed, in particular error type, time of error, technical request and routing information, browser and device information, technical or pseudonymous IDs, and performance information.

IP addresses may be processed as part of technical network communication.

As intended, the following are not transmitted to Sentry:

• prompt content;
• AI responses;
• Shopify payloads;
• Customer Content;
• authentication tokens;
• authorization headers;
• complete request bodies containing customer content.

Technical scrubbing mechanisms are used for this purpose.

The legal basis is Art. 6(1)(f) GDPR.

Error and security data are generally stored for no longer than 90 days, unless longer storage is necessary to investigate a specific security incident.

13. Bot protection with Vercel BotID

To protect the form for the free audit against automated and abusive requests, we use Vercel BotID (Vercel Inc., USA). When the form is submitted, a script in the browser checks technical characteristics of the browser and device to distinguish bots from humans. In particular, IP address, browser and device information, and technical signals from the browser environment may be processed. For this check, the script may store a technically necessary cookie or browser entry; it serves only to distinguish bots from humans.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting the service against abuse and unnecessary measurement costs. Access to information on the end device is based on Section 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), because it is strictly necessary for providing the requested form.

13a. Reach measurement with Vercel Web Analytics

On our public websites (rankyn.ai, not in the rankyn application), we use Vercel Web Analytics (Vercel Inc., USA) to measure how many visits our pages receive and from which pages visitors arrive. Vercel Web Analytics works without cookies and does not store or read any information on your end device.

In particular, the following are processed: the page visited (without URL parameters, which we remove before transmission), the referring page, the time of the visit, browser type, operating system, device type and the country derived from the IP address. The IP address is not stored; it is used only in shortened or hashed form to count visits within one day. This hash is discarded after 24 hours, so a visitor cannot be recognised across days. We do not use the data to identify individual visitors and do not combine it with other data.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in knowing the reach of our websites and keeping them stable.

The recipient is Vercel Inc., which already acts as our processor for hosting (section 4). Data may be transferred to the USA under the same conditions as for hosting (section 21).

rankyn does not use any product analytics in the rankyn application.

14. Cookies and similar technologies

rankyn only uses cookies or local storage mechanisms that are technically necessary to provide expressly requested functions.

These may include in particular login and session information, authentication status, security and CSRF protection, and technically necessary preferences.

Where storing information on, or accessing information from, the end device is strictly technically necessary, this is done on the basis of Section 25(2) No. 2 TDDDG.

Language choice (`rankyn_lang`): If you expressly choose a language on our website (the "EN / DE" switch), we store this choice in the cookie rankyn_lang (value en or de, lifetime 12 months) so that further pages appear in the chosen language. The cookie contains no identifier and is not used for analytics or recognition. It is not set without an express choice; you can delete it in your browser at any time. The legal basis is Section 25(2) No. 2 TDDDG, and for the processing Art. 6(1)(f) GDPR (providing the website in the requested language).

In the configuration currently envisaged, rankyn does not use any advertising cookies, remarketing cookies, marketing pixels, Google Analytics cookies, Meta Pixel or other non-essential tracking cookies.

15. Email delivery and newsletter via Resend

For technical, transactional and – after corresponding sign-up – promotional emails, we use Resend, a service of Plus Five Five, Inc., USA.

Transactional emails

Resend may be used in particular to send account and service information, login or security messages, technical status notifications, contract and product information, and other emails required for the business relationship.

For this purpose, the following may in particular be processed: name, email address, company or organisation reference, email content, time of sending, delivery status, and technical sending information.

The legal basis is Art. 6(1)(b) GDPR or, for contact persons of a business customer, Art. 6(1)(f) GDPR.

Newsletter

You can sign up for our newsletter only via the voluntary, non-preselected checkbox in the form for the free audit. Without this checkbox you will not receive a newsletter; the audit does not depend on it. For this purpose we process in particular email address, time of sign-up, time of confirmation, sign-up status, and technical information to evidence consent.

Before the first newsletter is sent, you confirm your sign-up via a link sent by email (double opt-in).

The legal basis for sending the newsletter is Art. 6(1)(a) GDPR.

Consent may be withdrawn at any time with effect for the future, in particular via an unsubscribe link or by message to info@rankyn.ai.

After unsubscribing, the address is removed from the active mailing list. Where necessary, minimal evidence data may remain stored.

In v1, rankyn does not use individual open or click tracking to create personal usage profiles.

Processing may take place in the USA.

16. Payment and billing via Stripe

For payment processing, subscription management and billing, we use Stripe.

In particular, the following may be processed: name, company name, billing address, email address, VAT ID, payment amount, currency, payment status, invoice and transaction ID, payment method, and technical payment information.

Full credit card data is generally processed directly by Stripe and is not stored by rankyn.

The legal basis for payment processing is Art. 6(1)(b) GDPR. Invoice and accounting information required under tax and commercial law is stored on the basis of Art. 6(1)(c) GDPR.

Depending on the specific processing, Stripe may act either as a processor or as a separate controller under data protection law.

17. Contacting us

If you contact us, for example by email, we process the information provided in order to handle your enquiry.

This may include name, email address, company, position, telephone number if voluntarily provided, the content of the message, and other voluntarily provided information.

For contract-related enquiries, the legal basis is Art. 6(1)(b) GDPR; for other business enquiries, Art. 6(1)(f) GDPR.

Our business email mailboxes (in particular info@rankyn.ai and support@rankyn.ai) are operated via Google Workspace (Google Cloud EMEA Limited, Ireland; Google LLC, USA). Google processes the mailbox data on our behalf on the basis of the Google Cloud Data Processing Addendum; transfers to the USA are safeguarded by Google LLC's certification under the EU-US Data Privacy Framework and additionally by Standard Contractual Clauses.

For appointments, we link to a booking page of Cal.com (Cal.com, Inc., USA). Nothing from Cal.com is embedded or loaded on our pages; Cal.com only collects data once you follow the link and book an appointment there. Cal.com's privacy notice applies there.

17a. Free audit

Via rankyn.ai (including via short links such as rankyn.ai/b/audit, for example from the rankyn Readiness Brief), businesses can request a free, one-time audit of how their products are presented in AI systems.

What we store: the shop domain, the business email address, the publicly retrievable product data of the shop website (in particular product names, categories, brands, prices, product URLs and structured product data) or – if you enter the products yourself – the product names and brand entered, the measurement results of the audit, and technical details on the time of the request and on delivery. To limit requests, we do not store an IP address, but only a cryptographic hash of an IP address range.

Retrieval of the shop website: We retrieve the product data automatically from the specified shop website. In doing so, we comply with the rules of robots.txt and identify ourselves with our own user agent (rankyn-audit).

What for: We use this data to create the audit, carry out measurements for it with the services named in Sections 10 and 11, and send you the result by email via the service described in Section 15. Only domain, product, brand and category details are passed to AI providers and measurement services, not your email address. To protect the form, we use the bot protection described in Section 13.

Newsletter: You will only receive promotional emails if you have ticked the voluntary checkbox for the newsletter (Section 15).

Legal basis: Art. 6(1)(b) GDPR (implementation of pre-contractual measures at your request) or, for contact persons of a business, Art. 6(1)(f) GDPR. The audit does not establish a SaaS contract or a trial. Short links may contain marketing parameters (e.g. source of the link), which are not evaluated in relation to individuals.

How long: No user account is created for you for the audit; it runs in an internal rankyn workspace. We delete the domain, email address, product data and audit results after twelve months, unless you start a trial or contract or statutory retention obligations prevent deletion.

18. Storage period and deletion

We generally store personal data only for as long as is necessary for the respective purpose.

Account and contract data

Account and user data are generally stored for the duration of the business or contractual relationship.

After the end of the contract, operational customer data is generally kept available for 30 days for a possible export and then deleted from active production systems, unless another legal basis precludes this.

Product and measurement data

Prompts, AI responses and associated raw provider objects are stored during the contract term for monitoring, time series and retest evidence.

The response texts of the measured AI systems and the evaluations derived from them (in particular mentions, positions, citations, metrics and findings) are held in the database (PostgreSQL) and are generally retained there for up to 12 months. The complete raw data of a measurement (raw provider objects) is stored in compressed form in Supabase Storage and deleted 365 days after the measurement.

Backups

According to the intended production configuration, production database backups are created daily and generally retained on a rotating basis for seven days. They cover the database, including the response texts and evaluations. The raw measurement data stored in Supabase Storage is not covered by these backups; no separate backup exists for it.

Logs

Application and security logs are generally stored for a maximum of 90 days. In the event of specific security incidents, relevant logs may be stored for longer until the investigation and documentation have been completed.

Invoices and business records

Records relevant under commercial and tax law are stored in accordance with the applicable statutory retention periods. Depending on the document, these may in particular be six, eight or ten years.

19. Anonymised and aggregated data

We may anonymise and aggregate data in such a way that neither a natural person nor a specific customer can be identified by means reasonably available.

Such anonymised information may be used in particular for category benchmarks, general model comparisons, aggregated market statistics and technical performance analyses.

20. Recipients of personal data

Personal data is only disclosed insofar as this is necessary or legally permissible.

Recipients may include in particular hosting and cloud providers, database providers, authentication providers, email service providers, payment service providers, error and security monitoring providers, providers of bot protection and reach measurement, AI API providers and technical measurement services where, in exceptional cases, personal data is processed, tax advisors, other professional advisors, authorities or courts.

Where service providers process personal data on our behalf, we conclude the required data processing agreements in accordance with Art. 28 GDPR.

Under the current product architecture, Bright Data, DataForSEO and cloro are not used as recipients of personal Customer Content data.

21. Transfers to third countries

Some service providers are based outside the EEA or use sub-processors there.

Personal data is only transferred to a third country if the requirements of Art. 44 et seq. GDPR are met.

Possible transfer mechanisms include in particular an adequacy decision of the European Commission, the EU-US Data Privacy Framework insofar as the specific recipient is validly certified, Standard Contractual Clauses of the European Commission, or other legally permitted safeguards.

Information on the safeguards used in each case can be requested at info@rankyn.ai.

22. Data security

We take appropriate technical and organisational measures, in particular:

• HTTPS/TLS;
• encryption of stored data via the cloud providers used;
• MFA for administrative systems;
• individual administrative user accounts;
• secure management of API keys and secrets;
• no secrets in the source code repository;
• tenant separation;
• Row Level Security;
• authorisation and ownership checks;
• separate development and production environments;
• data minimisation in analytics and error monitoring;
• regular backups;
• documented security and data protection incident process.

23. Source of personal data

We generally receive personal data directly from the data subject.

In addition, data may be provided to us by the company for which a person works, for example when they are invited to a workspace.

When signing in via Google, we may receive the data required for authentication from the authorised Google account.

As intended, we do not collect any personal end-customer data from connected Shopify shops.

24. Obligation to provide certain data

Certain details are required to create and use a rankyn account, in particular an email address and the information required for authentication.

Payment and billing information is required insofar as a paid contract is concluded.

25. Automated decisions

rankyn does not use personal data for decisions based solely on automated processing within the meaning of Art. 22 GDPR that produce legal effects concerning a data subject or similarly significantly affect them.

26. Rights of data subjects

Subject to the statutory requirements, data subjects have in particular the right to:

• access;
• rectification;
• erasure;
• restriction of processing;
• data portability;
• withdrawal of consent given, with effect for the future.

Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, insofar as this processing is based on Art. 6(1)(e) or (f) GDPR.

Following such an objection, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, you may object to this processing at any time without giving reasons.

Right to lodge a complaint

You also have the right to lodge a complaint with a data protection supervisory authority.

The authority competent for rankyn is in particular:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Deutschland

27. Exercising your rights

To exercise your data protection rights or if you have any questions, please contact:

info@rankyn.ai

Where necessary, we may request appropriate information to confirm your identity.

28. Changes to this privacy policy

We may amend this privacy policy if our services, technical infrastructure, service providers used, processing purposes or legal requirements change.

The currently published version applies.