Privacy Policy

Information you provide directly:

• Account information — email address when you register (via magic link or Google OAuth).
• Brand and product data — brand names, product names, keywords, and related content you enter to configure scans.
• Support communications — messages you send to our support team.

Information collected automatically:

• Usage data — pages visited, features used, scan frequency, and interaction patterns.
• Device and log data — browser type and version, operating system, referring URLs, and timestamps. IP addresses are anonymized at collection.
• Cookies — session cookies for authentication and first-party analytics cookies set by our analytics provider (see Section 7).
• Session recordings — anonymized recordings of how you interact with the Service, with sensitive inputs masked (see Section 7).

Scan result data:

When you run scans, we query third-party AI platforms (including Anthropic Claude, OpenAI ChatGPT, and Perplexity) using the brand and keyword inputs you provide. The AI responses and parsed visibility scores are stored on your behalf as your scan results.

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Send transactional emails — scan completion notifications, account alerts, and security notifications.
• Respond to support inquiries and troubleshoot issues.
• Monitor and analyze usage and trends to improve the Service.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Comply with legal obligations.

We do not use your brand or scan data to train AI models, sell to third parties, or build advertising profiles.

We do not sell your personal information. We share information only in these circumstances:

• Service providers: We share data with vendors who help us operate the Service, including Supabase (database and authentication, EU region), Vercel (hosting), Brevo (transactional email), and PostHog (product analytics, EU Cloud — see Section 7). These vendors are contractually required to use your information only to provide services to us.
• AI platform providers:Your brand keywords are sent to third-party AI APIs (including Anthropic, OpenAI, and Perplexity) to run your requested scans. These queries are subject to those providers' terms and privacy policies. We do not share your account identity with those providers.
• Keyword-volume data provider:To compute AI Exposure estimates, your tracked keywords (keywords only — no account identity, brand ownership, or personal data) are sent to DataForSEO to retrieve search-volume data. These requests are subject to DataForSEO's terms and privacy policy.
• Legal requirements: We may disclose your information if required by law, subpoena, court order, or other legal process, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers: If OUTRANKgeo is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website before your information is subject to a different privacy policy.

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate personal information.
• Deletion: Request that we delete your personal information, subject to certain legal exceptions.
• Portability: Request your data in a structured, commonly used, machine-readable format.
• Opt-out of analytics: You can opt out of analytics collection by enabling Do-Not-Track in your browser (we respect the DNT signal) or by contacting us to request opt-out.
• Opt-out of communications: Opt out of non-essential communications at any time by clicking "unsubscribe" in any email we send.

To exercise any of these rights or to request deletion of your analytics data, contact us at support@outrankgeo.com. We will respond within 30 days.

Analytics provider:

We use PostHog(EU Cloud) as our sole analytics provider. PostHog is the only analytics service on our site — we do not use Google Analytics, Vercel Analytics, or any other third-party analytics trackers. All analytics data is processed and stored in the European Union (EU) via PostHog's EU Cloud infrastructure.

Analytics traffic is routed through our own domain (first-party proxy) and is not sent through third-party tracking domains.

Session recordings:

We use PostHog's session replay feature to record how users interact with the Service. These recordings help us understand usability issues and improve the product. All text inputs are masked by default, and passwords, email fields, and other sensitive form elements are always masked — recordings never contain raw passwords or sensitive input content.

Cookies we use:

• Strictly necessary cookies: Required for authentication and session management. These cannot be disabled without breaking the Service.
• PostHog analytics cookies: First-party cookies used to identify your session and understand how you use the Service. These do not track you across other websites.

Opting out:

You can opt out of analytics collection (including session recordings) by enabling Do-Not-Track (DNT) in your browser — we respect this signal. You can also instruct your browser to refuse analytics cookies, though this may limit our ability to improve the Service for you. To request deletion of previously collected analytics data, contact us at support@outrankgeo.com.

Analytics data is processed and stored in the European Union by PostHog EU Cloud. IP addresses are anonymized at the point of collection.

Application data (your account, brands, and scan results) is stored in Supabase-hosted infrastructure. Hosting services (Vercel) may process requests through global edge networks but do not persistently store your personal data outside the hosting infrastructure.

By using the Service, you consent to the processing of your information as described in this policy. We take steps to ensure that appropriate safeguards are in place to protect your data in accordance with applicable law, including GDPR where applicable.