Privacy Policy

What data we have

• Your account: name, email address and password — the latter only as a bcrypt hash, never in plain text.
• The company in your account: its name, the team members, their roles and the invitations sent.
• What you track: project domains, keywords, the competitors you add and the measurement results — rankings, audits, backlinks.
• Google Search Console data, only if you connect it yourself and give your consent on the Google screen: clicks, impressions and queries for the properties you choose. We keep the access token received from Google encrypted (AES-256-GCM) and you can revoke it at any time.
• The sign-in log: IP address, date and device, so we can stop repeated attempts and let you know when someone tries your password.
• On your phone, if you turn on ranking alerts: the device’s notification token, so we can send them to you.
• Payments: on the website, through Stripe; in the apps, through the App Store or Google Play. We never see your card number — we only receive the subscription status.

Why we use it

To make the service work: measuring your rankings, auditing your site, sending you the sign-in code and alerts, and collecting the subscription. We don’t use it for advertising, we don’t build profiles and we don’t sell it. The legal basis is the performance of our contract with you and, for Search Console, your consent.

Who we share it with

No one, for advertising or analytics. We work with providers that keep the service running, and each one only gets what it needs to do its job:

• Vercel — hosting for the website and servers.
• Neon — the database.
• DataForSEO — the queries to Google for rankings, search volumes and backlinks. It receives keywords and domains, not your account data.
• Google — Search Console, only if you connect it.
• Stripe — payments on the website.
• Apple and Google — payments in the phone apps, through the App Store and Google Play.

Transfers outside the EU

Some of these providers also process data outside the European Union. They do so with the safeguards required by the GDPR, through the European Commission’s standard contractual clauses.

How long we keep it

For as long as you have an account. We keep the sign-in log only as long as needed for account security. When the account is deleted, we delete the data within 30 days; payment records are kept for as long as accounting law requires.

Cookies

We only use strictly necessary cookies: the session cookie, which keeps you signed in, and the one that remembers your chosen language. We don’t use analytics or advertising cookies, which is why we don’t ask for your consent to them.

Your rights

Under the GDPR, you can request access to your data, a copy of it in a portable format, and its correction, restriction or erasure, and you can object to its processing. You can withdraw your consent for Search Console at any time by disconnecting it in SpokRank or in your Google account. Write to us and we’ll sort it out within 30 days. You also have the right to lodge a complaint with the Romanian data protection authority, ANSPDCP (dataprotection.ro), or with the authority in your country.

Deleting your account

Email us at office@spokrank.ro from your account’s address and we’ll delete it, together with your projects, measurements and Search Console connection, within 30 days. A subscription bought from the App Store or Google Play is cancelled in the store’s settings: deleting your account or the app doesn’t cancel it on its own.

Children

SpokRank is a business tool and is not intended for children under 16. We don’t knowingly collect their data.

Changes

If we change anything important, we’ll tell you by email before it takes effect.

Contact

For any question: office@spokrank.ro