Privacy Policy

1. Who we are

RankAutomatic (rankautomatic.com) is a local SEO service for local businesses and the agencies that serve them. It is operated by CouncilSoft Inc., Holland, PA 18966 (“RankAutomatic”, “we”, “us”).

This policy covers our website, the RankAutomatic app, the free audit, the Citation Builder order form and our WordPress plugin. It explains what we collect, how we use it and the choices you have.

We play two roles. For your own account details we decide how the data is used. For the business data you or your agency put into a workspace (your locations, reviews, website content and so on) we process it on the workspace owner's behalf, to run the service for them. If an agency manages your business in RankAutomatic, the agency decides what goes into your workspace; please contact them first about that data.

2. What we collect

• Account details. Your name, email address, password (stored only as a one-way hash), your role on each account, and, if you sign in with Google, your Google account email and ID.
• Workspace data. What you add or approve: businesses, websites and locations, your brand details (services, service area, voice), keywords, drafts and published articles, local pages, posts and replies, audits, rank and map scans, AI visibility checks, reports, tasks and settings.
• Google Business Profile (GBP). If you connect a GBP, we read your listing details (name, address, phone, website, hours, categories, services, attributes, description), its posts, photo counts, verification state, rating and reviews, and we write the posts, review replies and profile changes you approve or switch on autopilot for.
• Reviews and the people who wrote them. Reviews come from your own Google listing. They include the reviewer's public display name, rating, review text and date, and any owner reply. We use them to draft replies and to show your review trends. We do not send review requests to your customers; we give you a direct Google review link and QR code that you share yourself.
• Google Search Console. If you connect it, we read search performance for your chosen property (queries, pages, clicks, impressions, click-through rate and position) with read-only access, and keep a monthly summary for your reports.
• Your website. We crawl the public pages of your website for audits. If you install our WordPress plugin (or connect another CMS), we store the connection details, a list of your pages, the content we publish, and, for each website fix, the value we changed and what was there before, so the fix can be undone.
• Facebook and Instagram. Posting to Facebook and Instagram is coming soon. If you connect a Facebook Page, we store the Page's name and ID, the linked Instagram business account, your Meta user ID and the access tokens Meta issues.
• Citation Builder orders. The business details you submit for listings (name, address, phone, website, hours, description, categories, logo and photos), the email used for listing logins, and the listing logins our citation partner creates for you.
• Free audit and contact form. The business name, website, city and email you enter, and any message you send us.
• Payments. Payments are handled by Stripe. We receive your billing name, email, plan and payment status, and Stripe's customer and subscription IDs. We never see or store your full card number.
• Usage and device data. Sign-in times, the last time a session was used, IP address (also used to rate-limit public forms), browser and device type, and the actions you take in the app, kept in logs and an audit trail for security.

3. How we use it

• To run the service: audits, drafts, approvals, publishing, rank and AI visibility checks, reports and website fixes.
• To publish to the platforms you connect, only what you approve or switch on autopilot for.
• To keep accounts secure: sign-in, session checks, fraud and abuse prevention, rate limits.
• To bill you and handle refunds.
• To send service emails: sign-in and password emails, report and order emails, and replies to your messages.
• To improve the service, for example by learning which business directories keep listings live, using aggregated figures that do not identify you.
• To meet legal obligations and enforce our Terms.

Where privacy laws ask for a legal basis, we rely on our contract with you, our legitimate interest in running and securing the service, your consent where we ask for it (you can withdraw it at any time), and legal obligations.

4. AI processing

RankAutomatic uses AI model providers to draft articles, local pages, posts, review replies and website fixes, to score drafts for quality, to compare drafts for similarity, and to check generated images for safety. To do that we send them only what the task needs: your brand details, the relevant page or review text, keywords and audit findings. Image generation receives a short scene description, never your customers' details.

We use these providers through their business APIs. Under the terms we use them on, they do not use what we send to train their models. Every draft records which AI model wrote it, and nothing goes live on your website or GBP without your approval unless you switch on autopilot for that channel.

To check whether AI assistants recommend your business, we ask them questions about businesses like yours in your area and store their answers. Those questions do not include personal data.

5. Data from Google APIs (Limited Use)

RankAutomatic's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This covers data we receive through Sign in with Google (your email and Google ID), the Google Business Profile APIs and the Google Search Console API. In particular:

• We use Google user data only to provide and improve the features you see in RankAutomatic: signing you in, managing your GBP, drafting and publishing replies and posts, and showing your search performance in the app and in your reports.
• We transfer it to others only when that is needed to provide those features (for example, sending a review's text to our AI model provider so it can draft a reply for you to approve), to comply with the law, for security, or as part of a merger or sale with notice to you.
• We never use it for advertising, never sell it, and never use it to develop, improve or train generalized AI or machine-learning models.
• Our staff do not read it unless you ask us to (for example, in a support request, or when you choose done for you and our team reviews your drafts), it is needed for security or to comply with the law, or it has been aggregated and anonymized for internal operations.

You can disconnect Google at any time in Settings, Connections. Disconnecting stops our access and deletes the tokens we held. You can also remove our access from your Google Account's security settings.

6. Who we share it with

We do not sell personal information. We share it only with:

• Service providers who process it for us under contract: hosting, database and file storage; AI model providers; search, map rank and business-listing data providers (they receive business names, addresses, keywords and web addresses, not your account details); web crawling providers (they receive public page addresses); email delivery; and payment processing (Stripe).
• Our citation partner, for Citation Builder orders only: the business details you submit for the listings.
• The platforms you connect: Google, Meta and your website or CMS receive what you approve to publish there.
• Your agency or account team. People with access to your account see its data, according to the roles the account owner gives them. An agency sees its clients' workspaces.
• Legal and safety. When the law requires it, or to protect the rights, property or safety of our users, the public or us.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, with notice to you.

7. Emails we send

We send service emails about your account, orders and reports, including a monthly report to the account's contact email (you can switch it off in Settings). If you request a free audit we email you the report and may send a few follow-up emails about it; each one has an unsubscribe link. When an agency uses our free-audit page, the report email goes out under the agency's name on its behalf. We do not send marketing email to your customers.

8. Cookies and browser storage

We use a small number of cookies, all needed for the service to work: a secure, HttpOnly session cookie that keeps you signed in, and short-lived cookies that protect the Sign in with Google and Facebook connection steps. The app also keeps a few preferences in your browser's storage (for example, which sidebar groups are open). We do not use advertising cookies or third-party analytics cookies. Stripe sets its own cookies on its checkout pages, and the booking page we link to is run by a third party with its own policy.

9. How long we keep it

• We keep your account and workspace data while your account is open.
• If your subscription ends, your workspace is paused, not deleted, so you can come back to it. Ask us at any time and we will delete it.
• Disconnecting a Google, Meta or website connection stops our access and deletes its tokens. Data we already read (for example, past reviews or scan results) stays in your workspace until you delete it or ask us to.
• Billing records are kept as long as tax and accounting law requires.
• Deleted data can remain in encrypted backups for a limited time before it is overwritten.

You can download your monthly reports and audits as PDFs and your citation listings as a CSV from the app. For a copy of anything else, contact us.

10. Deleting your data

To delete your account or a workspace, email [email protected] from the address on the account. Account owners can also remove team members in the app.

Facebook and Instagram data. If you remove RankAutomatic from your Facebook settings, or ask Facebook to delete the data we hold, Meta tells us and we delete the Page name and ID, the linked Instagram account and every access token for your connection. Meta gives you a confirmation code, and you can check the status of the request at rankautomatic.com/meta/deletion-status/<your code>. You can also email us to ask.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, and to object to or restrict how we use it. To use these rights, email [email protected]. We will verify the request and answer within the time the law allows. You will not be treated differently for asking. You can also complain to your local data protection authority.

California residents: we do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you.

If your business is managed by an agency, the agency controls your workspace; we will pass your request to them and help them answer it.

12. Security

Data travels over encrypted connections. Passwords are stored only as one-way hashes, and the tokens and logins for connected services (Google, Meta, your website and Citation Builder listing logins) are encrypted at rest. Access inside an account follows the roles its owner sets, and staff access is limited. No system is perfectly secure, so if we learn of a breach that affects your data we will tell you as the law requires.

13. International transfers

We are based in the United States and our service is hosted in the United States, and our service providers may process data in other countries. Where the law requires it, we use safeguards such as standard contractual clauses for transfers out of the European Economic Area, the United Kingdom or Switzerland.

14. Children

RankAutomatic is a business service and is not meant for anyone under 16. We do not knowingly collect personal information from children. If you think a child has given us personal information, contact us and we will delete it.

15. Changes to this policy

We will post any change on this page and update the effective date. If a change is significant, we will also tell account owners in the app or by email before it takes effect.

16. Contact

Questions about this policy or your data: email [email protected] or write to CouncilSoft Inc., Holland, PA 18966. See also our Terms of Service.