Privacy Policy

This policy explains what data Rankveon collects, why, on what legal basis, how long we keep it, and the choices you have.

1. Who is responsible (data controller)

The controller for the processing described here is PING-YI CHOU (sole proprietor), operating from Taiwan. Contact: support@rankveon.com.

Exception — payments: when you buy a subscription or credits, you contract with Paddle, our merchant of record. Paddle is the data controller for checkout, payment, invoicing, and tax data; we never see your card number. Paddle shares limited buyer data (e.g. email, order details) with us solely for fulfilment, support, and fraud prevention — we do not use it for marketing without your separate consent. See Paddle's privacy policy.

2. What we collect, why, and on what legal basis

• Account data (email, name, or Google account identifier if you sign in with Google) — to create and secure your account. Legal basis: performance of a contract.
• Content data (projects, keywords, generated articles and images, and publishing credentials you connect, e.g. a WordPress application password, stored encrypted) — to provide the core features you use. Legal basis: performance of a contract.
• Usage and log data (pages visited, features used, IP address, browser type) — to keep the Service secure, prevent abuse, and fix failures. Legal basis: our legitimate interest in operating a secure service.
• Optional notifications (your Telegram chat ID, only if you connect it) — to send review and ranking alerts you asked for. Legal basis: consent — withdraw anytime by disconnecting Telegram in Settings.

We do not sell your personal data, we do not use your content to train AI models, and we make no automated decisions with legal or similarly significant effects about you.

3. How long we keep data (retention)

• Account and content data — for as long as your account is active, and deleted within 30 days of account deletion or your request to support@rankveon.com.
• Usage and server logs — up to 90 days, then deleted or anonymized.
• Billing records — held by Paddle as controller for the periods required by tax and accounting law.

4. Processors we rely on

These providers process data on our behalf under data processing agreements:

• Supabase — database, authentication, storage (hosted in the United States)
• Vercel — application hosting (United States)
• Anthropic — AI text generation (processes the content you submit for drafting)
• Google — sign-in (OAuth), image generation and, if you connect it, Search Console data
• DataForSEO — keyword and ranking data (we send keywords, not your personal details)
• Telegram — notifications, only if you connect it

Paddle (payments) acts as an independent controller as described in section 1.

5. International data transfers

We operate from Taiwan and our processors listed above store data primarily in the United States. Where data of EU/UK users is transferred outside the EEA or UK, it is protected by the European Commission's Standard Contractual Clauses (SCCs) incorporated in our processors' data processing agreements, together with UK and Swiss addenda where applicable. Vercel is additionally certified under the EU-US Data Privacy Framework (including the UK Extension and Swiss-US DPF).

6. Cookies

We use only strictly necessary cookies — no advertising or third-party analytics cookies. Because they are essential to deliver the service you request, no consent banner is required; we still list them here for transparency:

• Supabase auth cookies (names prefixed sb-) — keep you signed in to your account. Access token: short-lived (~1 hour, auto-refreshed); refresh token: until you sign out or the session expires.
• Locale preference — remembers your language choice. Kept up to 1 year.

If we ever add analytics or marketing technologies, we will ask for consent first.

7. Your rights

You may at any time request:

• access to the personal data we hold about you, and a copy in a portable format;
• correction of inaccurate data;
• deletion of your data ("right to be forgotten");
• restriction of, or objection to, processing based on legitimate interests;
• withdrawal of any consent you gave (e.g. Telegram notifications) — this does not affect processing before withdrawal.

Write to support@rankveon.com — we respond within 30 days. If you are in the EU or UK, you also have the right to lodge a complaint with your local supervisory authority (your national data protection authority, or the ICO in the UK). Taiwan users may exercise the rights provided by the Personal Data Protection Act (PDPA).

8. Security and breach notification

Data is encrypted in transit (TLS) and at rest. Publishing credentials are stored encrypted, and access is scoped per organization with row-level security. If a personal data breach creates a risk to you, we will notify the competent supervisory authority within 72 hours of becoming aware of it and inform affected users without undue delay.

9. Children

The Service is not directed at children under 16, and we do not knowingly collect their data.

10. Changes

We will post any changes to this policy on this page and update the date above. Material changes will be announced by email.

11. Contact

PING-YI CHOU (sole proprietor) — support@rankveon.com