Privacy Policy

We collect three categories of information:

(a) Account information. When you sign up we collect your name, email address, password (hashed), the name of your firm, and the office location(s) associated with your firm. This is the minimum needed to provide the Service.

(b) Marketing and CRM data you upload or connect. When you connect a Customer Relationship Management (CRM) export, a call tracking export, or enter marketing spend, RankWebs stores the uploaded data in your firm's private workspace. This data may include: lead identifiers, lead names, contact information, lead status, case type, source attribution, and case settlement amounts.

(c) Data accessed via third-party APIs. When you authorize RankWebs to connect to a third-party platform (Google Ads, Google Search Console, Google Analytics, Google Business Profile, Microsoft Ads, Meta Ads, Mailchimp, or similar), we store the OAuth refresh token and any data those platforms return in response to our queries. We describe our handling of Google user data specifically in Section 6 below.

We use the information we collect only to:

• Provide, maintain, and improve the Service.
• Compute the metrics that the Service displays: lead source attribution, conversion rates, cost-per-lead, cost-per-signed-case, return on ad spend (ROAS), and similar marketing-performance indicators for your firm only.
• Authenticate you, secure your account, and prevent fraud or abuse.
• Communicate with you about the Service (e.g., support replies).
• Comply with legal obligations and enforce our Terms of Service.

We do not sell, rent, or otherwise transfer your data to third parties for their independent marketing or advertising purposes. We do not train machine-learning models on your firm's data without your explicit consent.

Your firm's data is private to your firm. We share information only in the limited circumstances described here:

• Within your firm. Users associated with the same firm can see the firm's data subject to internal role permissions.
• Service providers. We use Supabase (database and authentication), Vercel (application hosting), and Anthropic (Claude-powered narrative summaries) to operate the Service. These providers process data only on our behalf under contracts that require confidentiality and security commitments. The Claude API does not retain or train on the data we send.
• Legal compliance. We may disclose information to comply with a valid legal request, protect our rights, or prevent harm.
• Business transfer. If RankWebs is acquired or merged, your information may transfer to the successor entity, subject to this Privacy Policy.

We retain your firm's data for as long as your account is active. You can delete uploaded CRM imports, marketing spend rows, and individual leads from within the Service at any time. To delete your entire account and all associated data, contact support@rankwebs.com; we comply within 30 days.

Backups may retain residual copies of your data for up to 90 days after deletion, after which they are permanently overwritten.

We protect your information using industry-standard practices, including TLS 1.3 encryption in transit, AES-256 encryption at rest (via Supabase managed infrastructure), and row-level security policies that prevent any user from accessing another firm's data. OAuth refresh tokens are stored encrypted and are never exposed to your browser.

No system is perfectly secure. If we learn of a data breach affecting your information, we will notify you without undue delay, consistent with applicable law.

When you connect a Google account to RankWebs, we receive access to specific Google user data via Google APIs. RankWebs's use of information received from Google APIs adheres to Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• What we access. We access marketing performance data via the Google Ads API (campaign-level monthly spend by campaign type), the Search Console API (site search query performance), the Analytics Data API (website traffic data), and the Google Business Profile API (location performance metrics) — but only the specific scopes you explicitly authorize during the OAuth flow. We do not access Gmail, Drive, Calendar, Contacts, Photos, or any other Google product.
• What we do with it. We use Google user data solely to populate the reports and dashboards displayed inside your firm's RankWebs workspace. We do not use it for any other purpose.
• What we don't do. We do not transfer Google user data to third parties except (i) as necessary to provide the Service (e.g., to Supabase as our database provider, under strict confidentiality), (ii) to comply with applicable law, or (iii) as part of a merger, acquisition, or sale of assets with notice. We do not use Google user data to serve advertisements, including retargeted, personalized, or interest-based advertising. We do not allow humans to read your Google user data unless we have your affirmative agreement for specific instances, it is necessary for security purposes, or we are required by law.
• How to revoke access. You can disconnect any Google connection at any time from the Data Sources page inside RankWebs. You can also revoke access directly from your Google Account at myaccount.google.com/permissions. Once revoked, we stop syncing immediately. Previously synced data remains in your RankWebs workspace until you delete it.

Depending on where you live, you may have rights with respect to your personal information, including the right to access, correct, delete, or port your data, and the right to object to or restrict certain processing.

To exercise these rights, contact support@rankwebs.com. We will verify your identity and respond within the time required by applicable law (typically 30 days).

California residents: The California Consumer Privacy Act (CCPA) provides specific rights. We do not sell or share your personal information as those terms are defined under the CCPA.

The Service is not directed to children under 13 and we do not knowingly collect information from them. If you believe we have, contact us and we will delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by prominent notice inside the Service before the change takes effect. The “Last updated” date at the top reflects the current version.

Questions about this Privacy Policy or our data practices? Email support@rankwebs.com.