Privacy Policy

Effective Date: November 9, 2026

Company: GBFS Holding, SAS with a share capital of €100, registered with the Rennes Trade and Companies Register (RCS) under number 999 449 796

Registered office: Apt 106, 74 Rue Danton, 35700 Rennes, France

Contact: hello@rankpeak.co

1. Introduction

Your privacy is critically important to us. This Privacy Policy explains how rankpeak (operated by GBFS Holding) collects, uses, stores, shares, and protects personal information when you use rankpeak, our service for researching keywords, writing SEO blog articles with AI, publishing them to your website, and tracking how they perform. This policy applies to the rankpeak web application, its free SEO tools, the blogs rankpeak hosts for its customers, the rankpeak Framer plugin, and the rankpeak MCP server for AI assistants.

2. Data We Collect

We collect the following categories of data:

Account Information: Email address, name, and profile picture (received from Google if you sign in with Google), and your password if you sign up with email, which our authentication provider stores only as a hash
Organization and Team: Organization name, team members and their roles, and the email addresses of the people you invite
Website and Brand Information: Your website URL, text from the public pages of your website that rankpeak reads, your brand profile (company description, audience, products, and competitors), target countries and languages, and your content, image, and publishing schedule preferences
Content: Keywords, article briefs, reference documents you add to a brief, articles, translations, cover images, and illustrations
Integration Data: Credentials for the platforms you connect (stored encrypted, see Section 4), site, blog, and collection identifiers, the IDs and URLs of the posts rankpeak publishes, and product catalog data (product names, descriptions, prices, images, and links) imported from your store
Google User Data: Described in detail in Section 3
Performance Data: Search performance data from Google Search Console, keyword positions, backlink and domain metrics, and AI visibility results (how AI assistants mention your brand)
Visitor Analytics for Hosted Blogs: For blogs hosted by rankpeak, page views and link clicks with the referring page, browser user agent, country, a salted hash of the visitor's IP address, and random visitor and session identifiers kept in the visitor's browser
Billing Information: Plan, subscription status, credit purchases, and invoice details. Payment card details and billing addresses are collected and stored by Stripe; rankpeak never receives your full card number
Support Messages: The messages you send to our support team, by email or in the support chat (Section 12)
Technical Data: Session identifiers, browser type, IP addresses, and server logs
Free SEO Tools: IP address, approximate location, browser user agent, and the input you submit, used to enforce daily usage limits and prevent abuse

3. Google User Data

rankpeak lets you sign in with Google and, if you choose, connect Google Search Console and Blogger. This section describes which Google user data rankpeak accesses and how we use, store, share, and delete it. Each Google connection is optional and only happens after you approve it on Google's consent screen.

3.1 Google Data We Access

Google Sign-In (optional): With Google's standard email and profile permissions, we receive your name, email address, profile picture, and Google account identifier. Signing in with Google does not give rankpeak access to any other Google data.
Google Search Console (optional, read-only): When you connect Search Console in rankpeak's Integrations, we request the read-only scope https://www.googleapis.com/auth/webmasters.readonly. We read the list of Search Console properties you can access, to select the one that matches your website, and the search performance data of that property: search queries, page URLs, countries, dates, clicks, impressions, and average position for roughly the last 90 days, refreshed daily. This permission is read-only: rankpeak cannot change anything in your Search Console account.
Blogger (optional): When you connect Blogger, we request the scope https://www.googleapis.com/auth/blogger, which Google requires to create posts. We read the list of blogs on your account to find the blog to publish to (rankpeak uses the first blog listed and stores its ID, name, and URL). We then create posts with your articles and update the posts rankpeak created. We do not read, change, or delete your other posts, pages, or comments.

3.2 How We Use Google Data

We use Google user data only to provide the rankpeak features you use:

Your Account: To create your account, sign you in, show your name and picture in your dashboard and to your team, and send you emails about your account, such as team invitations, invoices, and support replies
Search Console: To show you your clicks, impressions, ranking keywords, average positions, and top pages in Analytics, the positions of the keywords you track in Keywords, and the search performance of your product pages in Products. This data is visible only to you and the members of your rankpeak organization.
Blogger: To publish the articles you publish or schedule to your blog, and to update them when you edit and republish them

We do not sell Google user data, use it for advertising (including personalized or retargeted ads), or use it for any purpose other than those listed above.

3.3 How We Store and Protect Google Data

The OAuth access and refresh tokens for Search Console and Blogger are encrypted with AES-256-GCM before they are stored, in a database table that only rankpeak's servers can read. rankpeak does not keep a Google access token from Google Sign-In.
Your Google profile information (name, email address, picture) is stored with your account in our database.
Search Console data is stored in our database as daily totals per country, positions for the keywords you track, and search queries for your product pages.
Our database is hosted by Supabase, encrypted in transit and at rest, and protected by Row Level Security so that only members of your organization can see your data.

3.4 Retention and Deletion of Google Data

We keep Google user data while your account is active and, for Search Console and Blogger, while the connection is in place.
When you disconnect: When you click Disconnect on the Google Search Console or Blogger integration, rankpeak marks the connection as disconnected and immediately stops using its token: no more data is read from Google and nothing more is published. The encrypted token stays in our database, unused, until you connect again (which replaces it) or your account is deleted. Search Console data already imported stays in your dashboard. To have the token and the imported data deleted right away, email us at hello@rankpeak.co.
When your account is deleted: Your profile, the organizations you own and their websites, integration connections, encrypted Google tokens, and imported Search Console data are deleted from our database. Deleted data may remain in our database provider's backups until those backups expire.
Posts already published to your Blogger blog stay on your blog; you can delete them in Blogger.

3.5 Google Data Sharing

We do not sell, rent, or trade your Google user data, and we do not share it with advertisers, data brokers, or other third parties, except in the following limited circumstances:

With the service providers that host and run rankpeak, solely to operate the service for you: Supabase (database and authentication), Vercel (application hosting), and Trigger.dev (the background jobs that sync Search Console and publish to Blogger)
With the members of your rankpeak organization, who can see your Search Console data in the dashboard
When required by law, court order, or government request, or to protect the rights, property, or safety of rankpeak, our users, or the public
As part of a merger, acquisition, or sale of assets, with notice to you

We do not send Google user data to the AI providers that generate rankpeak's content (Anthropic and OpenAI).

3.6 Human Access and AI Training

rankpeak staff do not read your Google user data unless you ask us to (for example, to help with a support request), it is necessary for security purposes such as investigating abuse, it is required by law, or the data has been aggregated and anonymized for internal operations. We do not use Google user data to develop, improve, or train generalized or non-personalized AI or machine-learning models.

3.7 Limited Use

rankpeak's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3.8 Revoking Google Access

You can stop rankpeak's access to your Google data at any time:

In rankpeak: Open Integrations, choose Google Search Console or Blogger, and click Disconnect
In your Google account: Remove rankpeak on your Google Account Permissions page (https://myaccount.google.com/permissions). This revokes rankpeak's tokens at Google, so they can no longer be used

Revoking access does not automatically delete your rankpeak account or the data already stored. To delete them, contact us at hello@rankpeak.co.

4. Website, Store, and Other Integrations

rankpeak publishes your articles to your website and can import your store's products through the integrations you connect: WordPress and WooCommerce, Shopify, Webflow, HubSpot, Ghost, Wix, Contentful, Strapi, Drupal, Odoo, Umbraco, Shopware, BigCommerce, GoHighLevel, Blogger, the rankpeak Framer plugin, and custom webhooks. This section describes how we handle the data of these integrations.

4.1 Integration Credentials

When you connect a platform, rankpeak stores the credentials it needs to work with it, such as API keys, access tokens, application passwords, usernames and passwords, or OAuth tokens (Webflow, HubSpot, and Google). They are encrypted with AES-256-GCM before they are stored, in a database table that only rankpeak's servers can read. For the Framer plugin and for AI assistants connected through the rankpeak MCP server, we store only hashes of their keys and tokens. Credentials are used only to verify the connection, to publish and update your articles, and, for Shopify, WooCommerce, Shopware, and BigCommerce, to import your product catalog. They are never sent to AI providers.

4.2 Data We Read and Write

We read only what publishing needs: your site, blog, or collection details and field structure, and the IDs and URLs of the posts rankpeak creates
For stores, we import product names, descriptions, prices, images, and links so that articles can feature your products
rankpeak creates new posts or CMS items for your articles and updates only the ones it created, when you edit and republish them. It does not delete your existing content
Publishing happens when you click "Publish" or on the schedule you set with automatic publishing

4.3 Webflow

When you connect your Webflow account via OAuth, we request access to the following:

Sites (sites:read): Find the Webflow site to publish to
CMS Collections (cms:read): Read your blog collection's fields so that article content maps to them correctly
CMS Items (cms:write): Create, update, and publish the CMS items for your articles

Webflow tokens are stored encrypted in our database as described in Section 4.1, together with your site and collection selection and field mapping. We do not store copies of your other Webflow content.

4.4 Integration Data Sharing

Your articles, images, and credentials are sent only to the platform you connected, to perform the publishing or import you request. They are never shared with advertisers, data brokers, or other external services.

4.5 Disconnecting an Integration

You can disconnect an integration at any time from rankpeak's Integrations page. rankpeak then stops using its credentials immediately. The encrypted credentials stay in our database, unused, until you connect again, your account is deleted, or you ask us to delete them. You can also revoke access on the platform itself, for example in Webflow's Apps & Integrations settings or by deleting the API key you created. Articles already published stay on your website.

5. AI Processing

rankpeak uses AI models to research and write your content. To do so, we send the following data to these AI providers through their APIs:

Anthropic (Claude): Used for keyword research, article briefs and writing, AI edits, translations, quality checks, image prompts, and AI visibility checks. We send your website URL and text from its public pages, your brand profile and competitors, keywords, the products you choose to feature, article briefs and reference documents, article drafts, and your edit instructions.
OpenAI: Used to draw cover images and illustrations (we send an image prompt based on the article, with its headline and your website's name, domain, and brand colors), to ask ChatGPT the questions used in AI visibility checks when that check is enabled, and to process the input of some free SEO tools.

We do not send Google user data or integration credentials to AI providers, and rankpeak does not use your content to train AI models. AI output can be inaccurate, so please review articles before they are published.

6. How We Use Your Data

We use the data we collect for the following purposes:

To provide, maintain, and improve our services
To authenticate your identity and manage your account and organization
To research keywords, generate articles and images, and publish them to your website or to a blog hosted by rankpeak
To show you analytics: search performance, keyword positions, backlinks, AI visibility, and visitors of your hosted blog
To run the backlink exchange if you join it
To process payments and send invoices
To communicate with you about your account and our services
To detect, prevent, and address technical issues, abuse, and security threats
To comply with legal obligations

Google user data is used only as described in Section 3.

7. Data Storage and Security

Your data is stored on secure servers provided by Supabase (database, authentication, and file storage, hosted on AWS infrastructure) and processed by our application on Vercel and our background jobs on Trigger.dev. We implement industry-standard security measures including:

Encryption of data in transit (TLS/SSL) and at rest
Additional AES-256-GCM encryption of integration credentials and OAuth tokens
Row Level Security (RLS) policies to ensure data isolation between organizations
Secure authentication using OAuth 2.0 protocols
Breached-password checks: new passwords are checked with the Have I Been Pwned Pwned Passwords service, which receives only the first five characters of a hash of the password, never the password itself
Limited employee access to production data on a need-to-know basis

8. Data Sharing and Third Parties

We use the following service providers to run rankpeak. They process data only to provide their service to us:

Supabase: Database, authentication, file storage, and the functions behind the free SEO tools
Vercel: Hosting of the rankpeak application
Trigger.dev: Background jobs for article generation, publishing, keyword research, analytics sync, and product imports
Stripe: Payments, subscriptions, and invoices
Resend: Transactional email, such as team invitations, invoices, and support messages
Anthropic: AI text generation (Claude), as described in Section 5
OpenAI: AI image generation, ChatGPT visibility checks, and some free SEO tools, as described in Section 5
DataForSEO: Keyword metrics, search results, and backlink and domain data (receives keywords and domain names)
Cloudflare Turnstile: Bot protection on some free SEO tools
Have I Been Pwned: Breached-password checks (receives only a partial password hash)
Google: Google Sign-In, and the Search Console and Blogger APIs when you connect them

The support chat runs on our own chat server (chat.looplyhq.com), not a third party's (see Section 12).

We may also share data in the following cases:

Integration Partners: The articles, images, and product links you publish are sent to the platforms you connect
AI Assistants You Connect: An AI assistant you connect through the rankpeak MCP server can read your websites, articles, keywords, and AI visibility results, and, if your role allows it, update your articles
Backlink Exchange: If you join the backlink exchange, links to other members' websites are placed in your articles and links to your website in theirs, and the members involved can see the linking domain, page, and anchor text
Your Team: Members of your rankpeak organization can see its websites, content, and analytics
Legal Requirements: When required by law, subpoena, or other legal process
Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal data to third parties for advertising or marketing purposes.

9. Third-Party Integrations

Our service integrates with various third-party platforms. When you connect these services, you are subject to their respective privacy policies:

Google: Google Sign-In, Search Console (read-only search performance data), and Blogger (publishing)
Shopify, WooCommerce, Shopware, and BigCommerce: Publishing articles and importing product catalogs
WordPress, Webflow, HubSpot, Ghost, Wix, Contentful, Strapi, Drupal, Odoo, Umbraco, and GoHighLevel: Publishing articles to your website
Framer: Articles pulled into your Framer site by the rankpeak Framer plugin
Custom Webhook: Articles sent to an endpoint you control, including for websites built with Lovable, Bolt, v0, Replit, Base44, Rocket, Next.js, or Vercel
AI Assistants: Claude, ChatGPT, Cursor, and other assistants you connect through the rankpeak MCP server
Stripe: For payment processing and subscription management

10. Your Rights and Choices

You have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you
Correction: Request correction of inaccurate or incomplete data
Deletion: Request deletion of your account and associated data
Portability: Request your data in a machine-readable format
Objection: Object to certain processing of your data
Withdrawal: Withdraw consent for data processing where applicable, including by disconnecting integrations and AI assistants from your dashboard

To exercise these rights, please contact us at hello@rankpeak.co.

11. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you services. Accounts are deleted on request: email us at hello@rankpeak.co.

Deleting your account deletes your profile, the organizations you own and their websites, articles, keywords, integration connections and encrypted credentials, and imported analytics from our database
Disconnecting an integration stops its use immediately; its encrypted credentials are kept, unused, until you connect again, delete your account, or ask us to delete them
Articles already published to your website stay there
Support chat conversations are kept until you ask us to delete them
Deleted data may remain in our database provider's backups until those backups expire
Billing and legal records may be retained as required by law

12. Cookies and Tracking

We use cookies to keep you signed in and to secure your session, and browser storage for some interface settings. Blogs hosted by rankpeak use browser storage for the random visitor and session identifiers described in Section 2. The support chat adds its own cookie only once you open it (described below). rankpeak does not currently load advertising or third-party analytics trackers. You can control cookie settings through your browser preferences. Essential cookies required for the service to function cannot be disabled.

To count visits to rankpeak.co's own public pages (not the dashboard and not the blogs we host for customers), we use our own audience measurement: two first-party cookies holding random identifiers, one for the visitor (13 months from the first visit, never extended) and one for the visit (30 minutes). We record the pages viewed, links that leave the site, where the visit came from (the referring site or campaign tags), an approximate location (country, region and city) and the device, browser and system family. Your IP address and full browser details are never stored, these counts are not linked to any account, are not shared with anyone, and are kept for 25 months.

Support chat: The chat button at the bottom right of rankpeak.co's pages and the dashboard opens a support chat that runs on our own chat server (chat.looplyhq.com), not a third party's. It never appears on the blogs we host for customers. Nothing of it loads until you click the button. From then on it keeps your conversation with its own cookie, remembers in your browser that you opened it (with a random identifier for the chat), and tells us the page you are on, never the site or campaign that brought you. If you are signed in, it shows us your account's email address and name (and profile picture, if you have one) so we can help you; signing out clears the conversation from your browser. An AI assistant may answer first, using only our published help: it sends the conversation to our AI provider to write each reply, and hands it to a person whenever it is unsure or you ask. We keep the messages you send there until you ask us to delete them: say so in the chat or write to hello@rankpeak.co.

13. Children's Privacy

Our services are not directed to children under 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

14. International Data Transfers

Your data may be transferred to and processed in countries outside your jurisdiction. We ensure appropriate safeguards are in place for such transfers, including standard contractual clauses and compliance with applicable data protection laws.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Effective Date" above. Your continued use of the service after changes constitutes acceptance of the updated policy.

16. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices:

Email: hello@rankpeak.co

Website: rankpeak.co

Address: GBFS Holding, Apt 106, 74 Rue Danton, 35700 Rennes, France

Quick Links

Home Pricing Free SEO Tools Terms of Service