Privacy Policy

• Account information. Your name, email address, and password (stored only as a salted hash). RankPilot AI is invite-only, so accounts are created for you by an administrator.
• Project data. The websites, URLs, keywords, and connected platforms (e.g. WordPress or Shopify stores) you add so we can run audits and apply fixes.
• Connected-platform credentials. Access tokens for platforms you connect, stored encrypted at rest and used solely to read and apply the SEO changes you request.
• Usage data. Basic logs (timestamps, request paths, error information) used to operate and secure the service.

RankPilot AI uses the Gmail API strictly to send transactional and notification emails from a designated sender account — for example, new-account welcome messages and automation reports. We request only the https://www.googleapis.com/auth/gmail.send scope.

• We use the granted access only to send email on behalf of the connected account. We do not read, delete, or modify messages in the mailbox.
• We do not sell, rent, or share Google user data with third parties, and we do not use it for advertising.
• We do not use Google user data to develop, improve, or train generalized artificial-intelligence or machine-learning models.
• The stored OAuth refresh token is used only to obtain short-lived access tokens for sending, and can be revoked by you at any time from your Google Account permissions.

RankPilot AI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• To provide, maintain, and secure the RankPilot AI service.
• To run SEO audits and analyses, and to apply the fixes you explicitly request on your connected platforms.
• To send account, security, and automation-report emails you have opted into.
• To diagnose problems, prevent abuse, and comply with legal obligations.

We rely on trusted providers to operate the service, and share only the data needed for each to function:

• Google (Gmail API) — sending outbound email.
• OpenAI — generating SEO recommendations and content. Project text may be sent to the model to produce results.
• SEO data providers (e.g. PageSpeed Insights, SerpApi) — retrieving performance metrics and search-ranking data for the URLs and keywords you add.
• Hosting & infrastructure (Vercel, Hugging Face, Neon) — running the application and storing your data.

We retain your data for as long as your account is active or as needed to provide the service. Credentials and access tokens are encrypted at rest, passwords are stored only as salted hashes, and all traffic is served over HTTPS. You can request deletion of your account and associated data at any time.

• Disconnect a connected platform or revoke Gmail access at any time to stop further processing.
• Request access to, correction of, or deletion of your personal data by contacting us.
• Adjust or disable automation emails from your dashboard.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above, and where appropriate we will notify you.

If you have questions about this Privacy Policy or your data, reach us through our contact page.