Privacy policy

The protection of your personal data is of particular concern to us. We process your data on the basis of the statutory provisions (GDPR, TDDDG). In this privacy policy we inform you transparently about the data processing in connection with our website and services.

1. Controller

The controller for the data processing on this website is:

Rankion GmbH
Weidenweg 12
74321 Bietigheim-Bissingen
Germany

Managing Director: Alexander Weipprecht
Email:info@rankion.ai
Phone: +49 7142 9170511

Data protection officer:datenschutz@rankion.ai

2. What data do we collect?

2.1 Contact and account data

• Name, email address (on registration)
• Password (stored encrypted)
• Profile picture (optional)
• Language preference
• Payment information (via Stripe, see 4.2)

2.2 Usage data

• Created projects, articles and content
• Keyword research and SEO/GEO scores
• Style Profiles, Knowledge Base entries
• Content storylines and publication plans
• Generated images
• Chat histories with the AI assistant
• Feedback submissions (free text, category, resolution status and optionally up to three screenshots you upload yourself): deleted automatically when the submission or your account is deleted, image files included. The screenshots are not publicly accessible, only you and our administrators can retrieve them; on upload they are re-encoded on the server, which removes embedded metadata such as EXIF or GPS data. We also store the page you submitted the report from (path and query string only, without the domain), your browser's identifier (user agent), the project that was selected in your account when you submitted the report, and the area of the application (module) you were in. The sole purpose is troubleshooting: without the page a report such as “the button does nothing” cannot be found again, without browser and operating system it cannot be reproduced, and without project and area it cannot be matched to the work it belongs to. Values of address parameters that may be confidential (token, signature, secret, api_key, password, key) are replaced with *** before we store them. All of these are deleted together with the report and are not passed on to third parties
• Credit usage and transaction history
• Team memberships and permissions

2.3 Technical data

• IP address (anonymized after 7 days in session data and the administration log, deleted after 14 days in server and application logs); for the block log, section 2.4 applies
• Browser type and version
• Operating system
• Referrer URL (originating page)
• Time of access
• Cookies (see section 8)

2.4 Block log (disposable addresses)

If you register, sign up for the first time via Google, or submit a request through the free AI Reality Check form (publicly accessible, no login required) and the email address you provide belongs to a disposable email provider we recognize, we reject the request. We store this attempt in a block log: the IP address, the domain of the email address (the part after the @), the reason for rejection, and the time. We do not store the full email address. Entries are automatically deleted from the block log after 90 days.

The block log helps us detect abuse: disposable email addresses should not be used to claim the free starting credit or the free AI Reality Check more than once. It shows us how often a blocked domain is used and whether attempts pile up from the same IP address, so we can keep our block list up to date.

The legal basis is Article 6(1)(f) GDPR (legitimate interest). Our legitimate interest is to detect abuse of our free services and to maintain the block list. You may object to this processing under Article 21 GDPR for reasons arising from your particular situation. Information about our balancing of interests is available on request from datenschutz@rankion.ai.

3. Legal bases for processing

We process personal data on the following legal bases:

• Art. 6(1)(b) GDPR: Performance of a contract (provision of our services)
• Art. 6(1)(a) GDPR: Consent (e.g. for marketing, analytics)
• Art. 6(1)(f) GDPR: Legitimate interests (security, improvement of our services)
• Art. 6(1)(c) GDPR: Legal obligations (tax law, retention obligations)

4. Disclosure to third-party providers

To provide our services we use specialized third-party providers. All providers are contractually obliged to comply with the GDPR.

4.1 AI content generation (USA - transfer to a third country)

Important: AI content generation is carried out by US providers. Your text prompts are transferred to the USA. Since 2023 the USA has again been classified as a "safe third country" (EU-US Data Privacy Framework), but laws such as FISA 702 and Executive Order 12333 mean that US authorities theoretically have the possibility of access. Both providers are contractually committed to "Zero Data Retention" - that is, API requests are neither stored nor used for training.

Our recommendation: Do not enter sensitive personal data (names, addresses, health data, etc.) in text prompts. Anonymize your examples. For highly sensitive use cases, consult your data protection officer.

4.2 Payment processing

4.6 Authentication

Google Ads conversion tracking (only with consent)

Google services you connect yourself (Search Console, Analytics 4, Business Profile)

4.7 Hosting & infrastructure

For the complete list of all sub-processors with purpose, region, and legal basis, see /trust/sub-processors.

5. Storage period

• Account data: Until your account is deleted
• Content (articles, projects): Until manual deletion or deletion of the account
• Payment data: 10 years (statutory tax retention period)
• IP addresses: in session data and the administration log 7 days (security), then anonymized; for the block log, section 2.4 applies
• Server and application logs: 14 days (security, error analysis), then deleted; block lists of the intrusion defence at most 7 days
• Proof of waiver of the right of withdrawal: IP address and time of your consent to the immediate start of the service (Section 356(5) German Civil Code). The IP address is deleted as soon as the standard limitation period of 3 years has expired after your contract ended (Section 195 German Civil Code); it begins at the end of the year in which the contract ended (Section 199(1) German Civil Code). The record itself — the time and wording of your consent — remains in place. After your customer account has been deleted, the record is deleted as soon as the same period has expired
• Administration log after an account deletion: We record the deletion of your customer account and administrative actions concerning your account together with your name and email address (Art. 6(1)(f) GDPR: evidence of these actions). 3 years after the account was deleted, your name and email address are removed automatically; the entry remains without these details
• Community access after an account deletion: Deleting your customer account does not end a community membership; only the link between the two is removed. 3 years after the account was deleted, the name and email address of your community access are removed automatically; if you had a paid membership, this happens no earlier than 3 years after it ended. After that you can no longer sign in to the community, while your pseudonym and your posts remain
• Cancellation statements: The details of your cancellation statement (name, email address, contract, type of cancellation, requested end date, your additional text), the time of receipt and, where applicable, the link to your account and subscription. We keep them as proof of receipt for 6 years, even if your customer account is deleted earlier or no account exists for the address (Section 257(1) no. 2 and (4) German Commercial Code; Art. 6(1)(c) and (f) GDPR). The period begins at the end of the year in which the statement was received or the contract ended, whichever is later. The entry is then deleted automatically, unless your cancellation could not be carried out for technical reasons; in that case we resolve this first
• Reports (incidents, forum): the IP address is stored only as a hash (pseudonymized), together with the report
• Block log (rejected disposable addresses): 90 days, then automatically deleted (see section 2.4)
• Chat histories: 90 days (automatic deletion)
• Cookies: See cookie settings (max. 1 year)
• Backups: Database dump before every change to the database structure; the last 10 versions are kept, older ones deleted

6. Your rights under the GDPR

You have the following rights at any time:

• Right of access (Art. 15 GDPR): You can request information about the data we store about you
• Right to rectification (Art. 16 GDPR): Rectification of inaccurate data
• Right to erasure (Art. 17 GDPR): "Right to be forgotten"
• Right to restriction (Art. 18 GDPR): Restriction of processing
• Right to data portability (Art. 20 GDPR): Export of your data in a machine-readable format
• Right to object (Art. 21 GDPR): Objection to processing
• Right to withdraw consent (Art. 7 GDPR): Consent once given can be withdrawn at any time

To exercise your rights, please contact:datenschutz@rankion.ai

7. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority:

State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
Phone: 0711/615541-0
Email:poststelle@lfdi.bwl.de

8. Cookies

Our website uses cookies. You will find details in ourCookie Settings.

Necessary cookies: locale (language), session (authentication), csrf_token (security), theme (dark/light mode)
Term: session up to 1 year

Analytics software (Matomo)

On our public website (not in the logged-in customer area) we additionally use the self-hosted analytics software Matomo, run on our own infrastructure (provimedia.de). Matomo runs cookie-free — nothing is stored on your device, so no cookie consent is required under Section 25 of the German Telecommunications-Digital-Services-Data-Protection Act. The legal basis for this processing is our legitimate interest in analyzing website usage to improve our offering (Art. 6(1)(f) GDPR). Your IP address is anonymized and never shared with third parties. We respect your browser's "Do Not Track" setting — if it is enabled, no analysis takes place.

You may object to this processing at any time under Art. 21 GDPR; to do so, please contact us at datenschutz@rankion.ai.

Invoice mailbox

We run a separate mailbox for invoices addressed to us. Incoming mails are checked automatically for an invoice. For every mail we store one log line with sender address, subject, identifier and time. Content and attachments are stored in the application only if the mail is an invoice or an administrator confirms it as one.

Legal basis: For invoices, Art. 6(1)(c) GDPR in conjunction with § 147 of the German Fiscal Code (AO) and § 14b of the German VAT Act (UStG). For the log line, Art. 6(1)(f) GDPR; our legitimate interest is a complete and traceable invoice archive.

Retention: Log lines without an invoice are deleted after 90 days. Invoices are kept for eight years (§ 147(3) AO, § 14b(1) UStG). The mails themselves stay in the mailbox until we remove them there by hand.

Recipients: Once a month our accounting receives a provider's invoices — complete as well as incomplete ones; incomplete means that individual mandatory details are missing while the invoice itself is there. Documents where it is unclear whether they were addressed to us at all, and documents that reached us only as a link, do not go to accounting. Individual mails are forwarded to the responsible party; every forward is logged.

9. Data security

We employ comprehensive security measures:

• SSL/TLS encryption: All data transfers are encrypted (TLS 1.2/1.3)
• Password hashing: Bcrypt algorithm (never stored in plain text)
• Two-factor authentication: Optional, for increased security
• Firewalls & DDoS protection: Protection against unauthorized access
• Backups: Database dump before every change to the database structure; the last 10 versions are kept, older ones deleted; stored only on the server in Germany
• Security Audits: Regular security reviews
• Access Controls: Strict access restrictions for employees

10. Changes to this privacy policy

We reserve the right to amend this privacy policy in order to adapt it to a changed legal situation or to changes in our services. The version in force at the time applies to each new visit. In the event of substantial changes we will inform you by email.

Version of this privacy policy: 06.11.2026
Version: 2.6