1. Introduction & Who We Are

RankBull ("we," "us," or "our") operates the website rankbull.io and the shared interface you sign in to. RankBull is AI-powered SEO software sold as a one-time lifetime license.

The most important thing on this page: the RankBull backend does not run on our servers. It runs on a Convex deployment that you own. Your sites, articles, keyword research, brand profiles, tracking results, provider API keys, and CMS credentials are stored there, on your infrastructure, under your control. We do not hold a copy and cannot read them.

What we do hold is small: a license registry that records who bought a license and where their deployment lives, plus ordinary website and support data. This policy is about that.

RankBull is operated by its individual founders and is not currently incorporated as a legal entity. For any question about this policy, contact support@rankbull.io.

By using the Service you acknowledge that you have read and understood this Privacy Policy. We aim to comply with applicable data-protection law, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). Where the GDPR applies to the data described in Section 2.1, the data controller is RankBull, reachable at support@rankbull.io.

2. Information We Collect

2.1 License Registry Data

When you redeem a license key and set up your deployment, we store the following in our license registry:

Your email address: used to identify the license holder, route you to your deployment when you sign in, and contact you about your license.
Your license key and tier: which license you hold and whether it has been redeemed.
Your deployment address: the URL of the Convex deployment you own, so the interface knows where to send you.
Your Convex deploy key: supplied by you during setup so we can install RankBull on your deployment for you. It is encrypted with AES-256-GCM before it is written, and the decryption key is held only by the installer, not by the website.
Installation status: the release version installed and the progress and error records of your setup or update jobs, so we can help when an install fails.

2.2 Data in Your Own Deployment

Everything the product does day to day — crawled site content, generated articles and their versions, content briefs, quality reports, brand profiles, keyword research, SERP snapshots, tracking results, job logs, provider spend, user accounts and workspace members, and all encrypted credentials — is created and stored inside your deployment.

For that data, youare the controller. We are not a processor of it, because it never reaches us. If you process other people's personal data in your deployment, meeting the obligations that come with it is your responsibility. See our Data Processing Addendum for how this splits.

2.3 Website & Support Data

Separately from your deployment, we process data generated by our public website:

Free tools and the site scanner: if you run a URL or text through a public tool without signing in, we process that input to produce the result and may keep it in short-lived caches and logs. Do not put confidential information into public tools.
Support and sales email: whatever you choose to send us — your message, your address, and any screenshots or files you attach.
Purchase records: the payment provider or marketplace you bought through handles your payment details. We receive a purchase reference and your email; we never see your full card details.

2.4 Device & Log Data

Like most websites, we automatically collect limited technical information when you visit:

IP address: used for security, abuse prevention, and approximate geolocation (country or region level).
Browser type and version: to ensure compatibility and troubleshoot issues.
Device type and operating system: desktop, mobile, tablet, and OS information.
Referring URL and pages visited: to understand how people find and navigate the site.
Timestamps: date and time of access, for security auditing and analytics.

2.5 Cookies & Tracking Technologies

We use cookies and similar technologies (such as local storage) to keep you signed in, remember your preferences, and understand aggregate usage.

Essential cookies: required for authentication and core functionality. These cannot be disabled.
Analytics cookies: we use PostHog for product analytics to collect aggregate usage data such as page views and feature usage. You can opt out through our cookie preferences or your browser settings.
No marketing or advertising pixels: we do not use marketing pixels, retargeting cookies, or advertising trackers.

For more detail, see our Cookie Policy.

3. How We Use Your Information

We use the limited data described in Section 2 to:

Validate and record your license: check a license key, mark it redeemed, and hold the tier it grants.
Install and update your deployment: use the deploy key you supply to install RankBull on the Convex deployment you own, and to install later releases when you ask for them.
Route you to your deployment: match your email to your deployment address when you sign in through our interface.
Support you: answer your questions, diagnose failed installs, and fix bugs.
Run the public website: serve the marketing pages and the free tools, and return the result you asked for.
Keep things secure: prevent abuse, fraud, and unauthorized use of license keys.
Improve the product: analyze aggregate usage of the website and interface, and fix what is broken.
Communicate with you: send license, setup, and security messages, and — with your consent — product updates.
Comply with the law: meet legal obligations and respond to lawful requests.

We do not use your product data to train models or to build profiles, because we do not have your product data.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following legal bases:

Performance of a contract (Article 6(1)(b)): processing needed to sell you a license, install your deployment, route you to it, and support you. This is the main basis for the license registry.
Legitimate interests (Article 6(1)(f)): security, abuse prevention, and improving the website and interface, where those interests are not overridden by your rights.
Consent (Article 6(1)(a)): optional analytics cookies and marketing email. You may withdraw consent at any time by changing your cookie preferences or emailing support@rankbull.io.
Legal obligation (Article 6(1)(c)): processing required to comply with a legal obligation, such as tax records or a lawful government request.

5. How We Share Your Information

We do not sell, rent, or trade your personal data. We share it only in the limited circumstances below.

5.1 Providers We Use

These providers process data on our behalf to run the website, the shared interface, and the license registry:

Convex(Convex, Inc., USA): hosts the small deployment that holds the license registry. Convex's privacy policy: convex.dev/privacy.
Our web host: serves rankbull.io and the shared interface, and keeps standard request logs.
PostHog(PostHog, Inc., USA): product analytics for the website and interface. PostHog's privacy policy: posthog.com/privacy.
Payment providers and marketplaces: whoever processed your purchase handles your payment details under their own privacy policy and shares a purchase reference with us.

5.2 Providers You Connect Yourself

The AI, SEO, image, email, and CMS providers the software talks to — Gemini, OpenAI, DataForSEO, Fal, Resend, WordPress, Shopify, Framer, and others — are reached from your deployment using your own API keys. They are your providers, not our subprocessors. Your data goes to them under the terms and privacy policies of your accounts with them, and we are not party to that.

5.3 No Sale of Personal Data

We do not sell your personal data to any third party. For the purposes of the CCPA, we confirm that we do not "sell" or "share" (as those terms are defined under the CCPA) the personal information of California residents.

5.4 Law Enforcement & Legal Requirements

We may disclose information we hold if we believe in good faith that disclosure is necessary to:

Comply with applicable law, regulation, or legal process (for example a subpoena or court order).
Protect the rights, property, or safety of RankBull, our users, or the public.
Detect, prevent, or address fraud, security, or technical issues.
Enforce our Terms of Service.

Where legally permitted, we will make reasonable efforts to notify you before disclosing your data in response to a legal request. Note that a request for your product data would have to be served on you, not on us: we do not hold it.

5.5 Business Transfers

If RankBull is involved in a merger, acquisition, reorganization, or sale of assets, the license registry may be transferred as part of that transaction. We will notify you by email or a prominent notice before your data becomes subject to a different privacy policy.

6. Data Retention

License registry: we keep your license record — your email, license key and tier, deployment address, encrypted deploy key, and install history — for as long as the license exists, because it is what proves you own it and what routes you to your deployment.
On request: you can ask us to delete your license record. We will, but be aware that removing it ends sign-in through our interface. Your deployment and its data are unaffected.
Backups: residual copies in automated backups are purged within 30 days of deletion.
Website and support data: request logs, tool inputs, and support email are kept only as long as they are useful for security, debugging, and answering you.
Aggregated data: anonymized, aggregated statistics that cannot identify you may be kept indefinitely.
Legal obligations: we may retain records longer where the law requires it, for example purchase and tax records.
Your deployment: retention there is set by you. We cannot delete, export, or recover anything in it on your behalf.

7. Data Security

What we do on the parts we operate:

Encryption in transit: traffic between your browser, our website, and the license registry is encrypted with TLS.
Encryption at rest: registry data is protected by the encryption-at-rest mechanisms of our infrastructure provider (Convex).
Deploy keys are sealed: the Convex deploy key you supply during setup is encrypted with AES-256-GCM before it is stored. The master key that decrypts it lives only with the installer, never on the public web server.
Minimal collection: the registry holds only what setup and routing need. There is no copy of your product data to lose.

What the software does on the deployment you run:

Provider API keys and CMS credentials are encrypted with AES-256-GCM before storage, decrypted only at the moment of use, and never logged in plaintext.
Passwords are cryptographically hashed. Plaintext passwords are never stored.
Role-based access control (owner, admin, editor, viewer) scopes every workspace action.

Because that deployment is yours, securing it is ultimately your responsibility: keep your Convex account, deploy key, and encryption secrets safe, and use scoped credentials for integrations.

No method of electronic transmission or storage is completely secure. We cannot guarantee absolute security. If we become aware of a breach affecting data we hold, we will notify affected users and the relevant supervisory authorities as required by law.

8. International Data Transfers

The infrastructure behind our website and license registry is located in the United States. If you use the Service from elsewhere, the data described in Section 2 may be transferred to, stored in, and processed in the United States and other countries where our providers operate.

Those countries may have data-protection laws that differ from your own. For users in the EEA, UK, or Switzerland, we rely on appropriate safeguards for these transfers, including European Commission-approved Standard Contractual Clauseswith our providers, any applicable adequacy decision, and data processing agreements with the providers listed in Section 5.1.

Where your own deployment runs — and therefore where your product data lives — is set by your Convex account, not by us.

You may request details of the safeguards we have in place by writing to support@rankbull.io.

9. Your Rights

Depending on where you live, you have rights over the personal data we hold about you. These rights apply to the data described in Section 2 — the license registry, website, and support data. For data inside your own deployment we are not the controller and have no access, so a request to us cannot reach it; you handle those requests yourself.

9.1 Rights Under the GDPR (EEA, UK, Switzerland)

Right of access (Article 15): request a copy of the personal data we hold about you and information about how we process it.
Right to rectification (Article 16): have inaccurate or incomplete data corrected.
Right to erasure (Article 17): have your data deleted. We delete it from active systems on receiving a valid request and from backups within 30 days, unless the law requires us to keep it. Deleting your license record ends sign-in through our interface.
Right to data portability (Article 20): receive your data in a structured, commonly used, machine-readable format.
Right to restrict processing (Article 18): ask us to pause processing in certain circumstances, for example while we verify accuracy.
Right to object (Article 21): object to processing based on legitimate interests. We will stop unless we can show compelling legitimate grounds that override your interests.
Right to withdraw consent (Article 7(3)): where processing is based on consent, withdraw it at any time without affecting processing carried out beforehand.
Right to lodge a complaint: complain to the supervisory authority in your country if you believe our processing breaches the GDPR.

9.2 Rights Under the CCPA (California Residents)

Right to know: request the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties we share it with.
Right to delete: request deletion of your personal information, subject to the exceptions permitted by law.
Right to opt out of the sale of personal information: we do not sell your personal information, so there is nothing to opt out of, but we affirm the right for transparency.
Right to non-discrimination: we will not treat you differently for exercising your rights.

9.3 How to Exercise Your Rights

Email support@rankbull.io with the subject line "Privacy Rights Request." Please include:

Your full name and the email address on your license record.
Which right you wish to exercise.
Anything else that helps us verify your identity and find your records.

We respond to verified requests within 30 days, or within the period required by applicable law. If a complex request needs more time (up to 60 additional days), we will tell you why. We may need to verify your identity first, and we will never require you to create an account to make a request.

10. Children's Privacy

The Service is not intended for anyone under the age of 16, and we do not knowingly collect personal data from children under 16. If you are under 16, please do not use the Service.

If we learn that we have collected personal data from a child under 16, we will delete it. If you are a parent or guardian and believe your child has given us personal information, contact support@rankbull.io and we will remove it promptly.

11. Third-Party Links

Our website and the software link to third-party sites and services we do not operate, including links inside generated articles and SEO research results.

We are not responsible for the privacy practices or content of those sites. Review their policies before using them. A link is not an endorsement.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. When we do:

We will update the "Last Updated" date at the top of this page.
For material changes — changes that significantly affect how we collect, use, or share your data — we will email the address on your license record and/or post a prominent notice at least 14 days before they take effect.
For minor changes such as clarifications or corrections, we will update this page without separate notice.

Continued use of the Service after an update takes effect constitutes acceptance of it. If you disagree with an update, stop using the Service and ask us to delete your license record.

13. Contact Us

Questions, concerns, or requests about this policy or our data practices:

Email: support@rankbull.io
Website: rankbull.io

We aim to respond to privacy inquiries within 5 business days. Formal GDPR or CCPA requests are answered within the legally required timeframe (typically 30 days).