Privacy Policy
Version v0 — effective
This policy explains what RankTurbo collects, why we collect it, how long we keep it, who helps us process it and what you can ask us to do with it. We have tried to write it in plain English. If anything is unclear, email privacy@rankturboseo.com.
RankTurbo is in development. Small pilots are planned for December 2026, and some features described here are not available yet. We describe them now so you know in advance how they will handle your data, and we will update this policy if that changes.
The short version
- We use your data only to run the features you use, to keep the service secure and to bill you.
- We do not sell personal information, show ads or use your data to train AI models.
- Nothing is posted to Google or to your website until you approve that specific item.
- Data we receive from Google is used only for features you can see. Review text, from Google or any other source, is deleted from the live service within 30 days; access-restricted recovery copies expire about 4 weeks after that.
- You can ask for a copy of your data, ask us to correct it, or delete your account and its data.
Who we are
RankTurbo (https://rankturboseo.com) is operated by Subhan LLC, a company in the United States ("we", "us", "our").
- Privacy questions and requests: privacy@rankturboseo.com
- Security reports: security@rankturboseo.com
- Everything else: support@rankturboseo.com
What this policy covers
This policy covers this website and the RankTurbo app. It does not cover Google, our payment provider or other services you use alongside ours; their own privacy policies apply to them.
What we collect
When you visit this website
This website sets no cookies of its own and uses no analytics, tracking pixels or scripts. Our hosting and network provider (Cloudflare) processes technical details such as your IP address and browser type to deliver the pages and protect them from abuse, and it may set a strictly necessary security cookie while doing so. We do not use those details to identify you.
Your account
- Your email address, your name if you give it, and your password. We store the password only as a secure one-way hash.
- Your workspace name, the members you invite and their roles.
- Sign-in sessions and security records, such as when you signed in and which versions of our Terms and this policy you accepted. Where we record an IP address for security, rate limits or acceptance records, we store a keyed one-way hash of it, not the address itself.
Billing
Payments are handled by our payment provider (Stripe). You enter card details directly with Stripe, and we never receive or store your full card number. We keep your plan, billing status and the identifiers Stripe gives us. Stripe keeps your billing details, including the billing address needed to calculate sales tax.
Your business
Information you enter or import about each business: name, address, phone number, website, categories, service areas, hours, the keywords you track, the competitors you choose, samples of your writing style, notes, drafts and the items you approve.
Public data about businesses
To audit a listing and track rankings, we buy publicly available search data from our data provider (DataForSEO): search results and map results for your keywords, public listing details for your business and its competitors, and public reviews. Public reviews include the reviewer's display name as Google shows it. We delete review text and reviewer names within 30 days of fetching them.
Google user data
The Google connection is not available yet. When it is, you will be able to connect your Google account and choose what to share. We ask only for the access listed below, and only when you turn on the feature that needs it.
| Google access (scope) | What we access | What we use it for |
|---|---|---|
business.manage (Google Business Profile) |
The accounts and business locations you manage; profile details such as name, address, hours, categories, description and attributes; changes Google suggests or makes to your profile; whether each location is verified; reviews and existing replies; the status of posts and photos we publish for you; performance figures such as calls, direction requests, website clicks and views; who manages each location; and your Google account's notification setting. | Showing your profiles, reviews and performance in the app; posting a review reply, post, photo or profile change only after you approve that specific item, and removing a reply or post when you ask; following each item we publish until Google shows or rejects it; confirming that you are an owner or manager of a location before you connect it; and, if you turn notifications on, setting our notification topic on your Google account so we can alert you about new reviews and profile changes. That setting covers every location in the Google account: messages about locations you have not connected are discarded without being stored, and we remove the setting when you disconnect or your access ends. |
webmasters.readonly (Google Search Console) |
The list of Search Console properties you can access and, for the site you choose, search performance data: search queries, pages, clicks, impressions and average position. | Showing which searches lead people to your website and how that changes over time. This access is read-only: we cannot change anything in your Search Console account. |
openid (Google account identifier) |
A unique identifier for your Google account. | Recognizing which Google account a connection belongs to. |
We do not ask for access to your Gmail, contacts, calendar, Drive files or any other Google data. You can disconnect at any time in the app, or from your Google Account's third-party connections page.
Emails we send
We send account emails (such as sign-in links and security notices), billing emails, and the alerts and summaries you turn on. We keep a log of what was sent to whom for 90 days; any review text or reviewer name kept with a notification or in that log is deleted within 30 days, like other review content. Our emails do not track opens or clicks.
When you contact us
If you email us, we keep the conversation so we can help you and refer back to it.
How we use information
We use the information above only to:
- provide the features you use, such as audits, rank tracking, review drafts and reports;
- keep the service and your account secure, and prevent abuse;
- bill you for paid plans, once there are any;
- send the emails described above and answer your messages;
- find and fix errors, using error reports that have personal details removed; and
- meet our legal obligations.
We do not sell personal information, use it for advertising, or share it with advertisers. We do not record your screen or your sessions in the app.
How we use AI
Some features use our AI provider (Anthropic) to draft text for you to review: review replies and, as they become available, Google posts, business descriptions, local web pages and articles, a content calendar, the wording of your weekly plan, report summaries, keyword ideas, competitor insights and a short profile of your writing style. For each draft we send only what it needs, such as your business's name, services, service area and hours, the tone you choose, your writing samples, and public search data about your keywords and competitors.
For a review reply, we send the review's text and star rating, and any private notes you add, except that notes for health-related businesses are never sent. We do not send reviewer names, photos or account identifiers, and we remove email addresses and phone numbers from the review text first. Anything else a reviewer wrote in the review itself is sent as written.
Of the data we receive from Google, only review text and ratings (for reply drafts) and profile details such as your business's name, categories, hours and description (for post and description drafts) are sent to the AI provider. Search Console data is never sent to it.
The AI provider uses this content to produce the draft. Under its commercial terms, it does not train its models on the content we send, it deletes that content after the limited period those terms set, and it may keep content flagged for breaking its usage policies longer so it can be reviewed for safety. We do not use your data, or data from Google, to train AI models either. We keep the drafts in your account so you can review them; we do not keep a separate copy of what we sent.
AI drafts can be wrong. Each one is labelled as a draft, facts only you know are left as placeholders for you to fill in, and nothing is posted until you approve it.
Google API Services User Data Policy
RankTurbo's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
In practice, for data we receive from Google:
- We use it only to provide and improve the features you can see in the app, as described in the table above.
- We do not use it for advertising, and we do not sell it or use it to decide anyone's creditworthiness or for lending.
- We transfer it only to the service providers that run those features: Railway (hosting and the database), Cloudflare (network, file storage and encrypted backups), Anthropic (AI drafts, as described above) and Resend (the notices and alerts you turn on). We also transfer it when you ask us to, for example in your own data export, or when the law requires it. No other provider receives data from Google: not DataForSEO, Stripe, Sentry, our business email provider or any analytics tool.
- No person at RankTurbo reads it unless you give us permission in the app (for example, to help with a support request), it is needed to investigate security issues or abuse, or the law requires it.
- We do not use it to train AI models.
- Data from your Business Profile is shown only to you and the members of your workspace, including in reports you create. We do not pass it to other systems through an API or a feed. If you request a copy of your data, it includes Business Profile content only while that content is within the retention limits below.
- We keep it only as long as the retention limits below allow.
How long we keep data
| Data | How long we keep it |
|---|---|
| Review text and reviewer names, from any source | Up to 30 days after we fetch them |
| Other data from your Business Profile (ratings, dates, reply status, profile snapshots, performance figures) | Up to 30 days. Only identifiers and our own records, such as your drafts, approvals and the log of what was posted, are kept longer. |
| Google access tokens | Until you disconnect, or 7 days after your plan stops including the Google connection |
| Search Console data | Detailed rows for up to 16 months, then monthly totals. Deleted within 7 days of a disconnect or of your plan no longer including it. |
| Notification message ids from Google | 7 days |
| Free audit results | 30 days |
| Rank results, public competitor and listing snapshots, audits, drafts (including your private notes), approvals, the log of what was posted, reports and your writing samples | For the life of your account |
| Files you upload | Until you delete them, or delete the business they belong to |
| Security and audit logs, and records of which versions of our Terms and this policy you accepted | For the life of your workspace. If you delete your user account, they keep only a keyed one-way hash of your email address, not your name or the address itself. |
| Notifications and the email log | 90 days. Any review text or reviewer name in them is deleted within 30 days. |
| Background job history | 90 days |
| Data exports you request | 7 days |
| Sign-in sessions and invitations | Until they expire; invitations are deleted 30 days after they expire or are used |
| Billing event records from our payment provider | 1 year |
| Addresses that unsubscribed or bounced | A one-way hash of the address, kept so we never email it again |
These limits apply to the live service. Access-restricted recovery copies of the database, which the app never reads, can hold data for up to about 4 more weeks before they expire; if we ever restore one, expired data is deleted before the service uses it.
When you disconnect Google, we stop using that connection, delete the Business Profile data we received through it at once and delete Search Console data within 7 days. When your plan stops including the Google connection, we delete that data within 7 days. Our own records described above are kept.
When you delete your account or workspace, we delete its data. Copies in our backups expire on their own: database recovery copies within about 4 weeks and encrypted backup files within 30 days. Backups are used only to recover from an outage or data loss; the app never reads them. We keep a short deletion record that contains no personal information, and security logs keep a one-way hash of your email address instead of the address itself. Our service providers delete data under their own retention terms.
Who we share data with
We share data only with the service providers below, and only what each needs to do its job for us.
| Provider | What they do for us | Data involved |
|---|---|---|
| Cloudflare | Network, security, this website, bot checks on sign-up and free audit forms, file storage and encrypted backups | Technical request data such as IP addresses, and stored files |
| Railway | Hosting for the app and its database | Everything stored in the app |
| Resend | Sending email | Your email address and the content of the emails we send you |
| Stripe | Payments, billing and sales tax | Billing contact details and the card details you enter with Stripe |
| Anthropic | AI drafts | Review text, ratings and business facts, as described above |
| DataForSEO | Public search, map, listing and review data | The business names, locations and keywords we look up |
| Sentry | Error monitoring | Technical error details, with personal details removed |
| Business email provider | Our support, privacy, legal and security mailboxes | The emails you send us and our replies |
We do not use any analytics provider today. We add a provider to this list before it receives any data.
When you connect Google, we exchange data with Google to provide the features you use; Google's own privacy policy applies to Google.
We may also disclose information when the law requires it, or to protect the rights, safety or security of our users, the public or RankTurbo. For data we receive from Google, we disclose it only as described in the Google API Services User Data Policy section above. If Subhan LLC is merged, acquired or sells its assets, personal information may transfer to the new owner under the promises in this policy, and Google user data will transfer only with your explicit prior consent.
No health or patient information
RankTurbo is not built for health or patient information. Please do not enter it anywhere in the app, including notes and drafts. We are not a HIPAA business associate and do not sign business associate agreements. For health-related businesses, reply drafts are instructed not to confirm that a reviewer is a patient, and are checked for health terms before you can approve them.
Security
- All traffic uses HTTPS.
- Passwords are stored only as secure one-way hashes, and Google access tokens are encrypted at rest.
- Backups are encrypted, and access to production systems is limited to the people who need it, with two-factor authentication.
- Workspaces are kept separate, and every request is checked against what the signed-in user may access.
No system is perfectly secure. If you think you have found a security problem, please email security@rankturboseo.com.
Your rights and choices
You can ask us to:
- access the personal information we hold about you;
- export a copy of your data in a common format;
- correct information that is wrong; or
- delete your account or workspace and its data.
Some of this you can do yourself in the app as features become available. For anything else, email privacy@rankturboseo.com from the address on your account. We may need to confirm it is really you before we act, and we aim to respond within 30 days.
You can also disconnect Google at any time and turn off alert and summary emails. Account and billing emails are always sent while you have an account.
We do not sell or share personal information for advertising, so there is nothing to opt out of. We respect Global Privacy Control signals for any analytics.
Children
RankTurbo is a tool for businesses. You must be at least 18 to create an account, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, email privacy@rankturboseo.com and we will delete it.
United States only
RankTurbo is offered to businesses in the United States. We operate from the United States, and your data is processed in the United States and wherever our service providers operate.
Changes to this policy
Each version of this policy has a version number and an effective date, shown at the top. If we make a significant change, we will tell account owners by email or in the app before it takes effect, and we may ask you to accept the new version before you continue. Before we use data from Google in a new way or for a new purpose, we will ask for your consent first.
Contact
Subhan LLC
Email: privacy@rankturboseo.com