Privacy Policy

Last updated: January 2025

1. Introduction

OmniRank ("we", "us", or "our") operates the website omnirank.net and the OmniRank platform (collectively the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and your rights as a data subject under the General Data Protection Regulation (GDPR) and applicable data protection law.

By accessing or using the Service you acknowledge that you have read and understood this policy. If you disagree with any part of this policy, please stop using the Service and contact us at hello@omnirank.net.

2. Data controller

OmniRank is the data controller for personal data processed through the Service. Contact us at:

Email: hello@omnirank.net

3. Data we collect

3.1 Account data

When you register for an account we collect your full name, email address, password (stored as a bcrypt hash), and optional profile photo. If you sign in with Google OAuth, we receive your name, email address, and Google profile picture.

3.2 Usage data

We automatically collect information about how you use the Service, including pages visited, features used, audit results generated, keywords tracked, and timestamps of key actions. This data is used to improve the Service and is never sold to third parties.

3.3 Technical data

We collect your IP address, browser type and version, operating system, referring URL, device identifiers, and time zone. This data is used for security, fraud prevention, and aggregate analytics.

3.4 Payment data

We do not store your payment card details. All payments are processed by Stripe (or PayPal where applicable). We receive a billing reference, the last four digits of your card, expiry date, and billing address for display purposes only. See Section 7 for details of our sub-processors.

3.5 Communication data

If you contact us via our contact form, support email, or live chat, we retain a copy of the correspondence including your name, email address, and the content of your message.

3.6 Website data you provide

When you add a website to the Service, we collect the URL, verify ownership, and process the site's publicly available content (HTML, meta tags, structured data, performance metrics) to generate SEO audits. This analysis data is stored in your account and is not shared with third parties except as necessary to provide the Service.

3.7 Cookies

We use cookies and similar tracking technologies. See Section 10 for a full list of cookies and your opt-out options.

4. How we use your data

We use your personal data for the following purposes and on the following legal bases under GDPR:

You may withdraw consent for marketing emails at any time by clicking "Unsubscribe" in any email or by updating your notification preferences in the dashboard.

5. Who we share your data with

We share personal data with the following categories of recipients. All sub-processors are bound by data processing agreements:

5.1 Infrastructure and authentication

Supabase — our database and authentication provider. User accounts, website data, audit results, and all application data are stored in Supabase's managed PostgreSQL service (EU region). Privacy policy: supabase.com/privacy.

5.2 Payments

Stripe — processes all card payments and manages subscriptions. Stripe is PCI-DSS Level 1 certified. We pass your email and billing address to Stripe but never store raw card data ourselves. Privacy policy: stripe.com/privacy.

PayPal — available as an alternative payment method. When you pay via PayPal we redirect you to PayPal's interface and they process the transaction under their own privacy policy: paypal.com/privacy.

5.3 SEO data providers

DataForSEO — provides backlink data, keyword metrics, and SERP data. We send your website's domain to DataForSEO to retrieve metrics for your audit reports. No personal data is shared. Privacy policy: dataforseo.com/privacy-policy.

Google — we integrate with Google Search Console and Google Analytics 4 (when you authorise the connection from your dashboard). Data exchanged is limited to the search performance and analytics data for your connected website. Privacy policy: policies.google.com/privacy.

5.4 Email delivery

Resend — sends all transactional emails (receipts, audit reports, onboarding emails, etc.). We pass your name and email address to Resend for delivery purposes only. Privacy policy: resend.com/privacy.

5.5 Monitoring and observability

Sentry — captures application errors and performance data to help us fix bugs quickly. Error reports may include your user ID and the page you were on when the error occurred. We configure Sentry to scrub passwords and payment data from all reports. Privacy policy: sentry.io/privacy.

PostHog — product analytics (page views, feature usage, conversion funnels). PostHog is configured in EU mode. We do not send personally identifying information to PostHog; events are tied to a pseudonymous session ID. Privacy policy: posthog.com/privacy.

5.6 No selling of data

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

6. Data retention

We retain your personal data for as long as your account is active or as needed to provide the Service, subject to the following schedules:

• Active accounts: All data retained while your account is open.
• Account deletion: When you request deletion, a 7-day cooling-off period applies. After the 7 days, all your data is purged from our database via cascade deletes. Your email address is replaced with an anonymised token for accounting and legal records.
• Unverified websites: Websites added but not verified are auto-archived after 8 days and permanently deleted after 30 days.
• Audit reports: Retained for 12 months per plan limits. Older reports are automatically purged.
• Payment records: Invoice and billing records are retained for 7 years to comply with tax and accounting obligations.
• Server logs: IP address logs are retained for 30 days for security purposes, then deleted.
• Contact form submissions: Retained for 12 months, then deleted unless an ongoing support relationship exists.

7. Your rights under GDPR

If you are located in the European Economic Area (EEA) or the UK, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): You may request that we delete your personal data. Exceptions apply where we are required to retain data by law.
• Right to data portability: You may request an export of your data in a machine-readable format. Use the "Download my data" button in Dashboard → Settings to generate a ZIP export at any time.
• Right to object: You may object to processing of your data where we rely on legitimate interests as our legal basis.
• Right to restrict processing: You may ask us to restrict processing of your data in certain circumstances.
• Right to withdraw consent: Where we rely on consent (e.g., marketing emails), you can withdraw consent at any time.

To exercise any of these rights, email us at hello@omnirank.net with the subject line "Data Request — [Your Right]". We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or the relevant supervisory authority in your EEA country).

8. International transfers

OmniRank's primary infrastructure is hosted in the EU. Some sub-processors (listed in Section 5) may process data outside the EEA. Where this occurs, we ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA).

9. Security

We implement industry-standard technical and organisational measures to protect your personal data, including TLS encryption in transit, AES-256 encryption at rest, bcrypt password hashing, multi-factor authentication options, role-based access control, and regular security reviews. Despite these measures, no system is completely secure. If you discover a security vulnerability, please disclose it responsibly to hello@omnirank.net.

10. Cookie policy

We use the following categories of cookies:

• Strictly necessary cookies: Session cookies required for authentication and basic site functionality (e.g., Supabase auth token). These cannot be disabled.
• Analytics cookies (PostHog): Help us understand how users interact with the platform. Can be opted out via our cookie banner or by setting posthog_opt_out=true in your browser.
• Payment cookies (Stripe): Stripe sets cookies during the checkout process for fraud prevention. These are subject to Stripe's privacy policy.
• reCAPTCHA (Google): Used on public forms to prevent spam. Google sets cookies as part of the reCAPTCHA v3 verification. Subject to Google's privacy policy.

For full details on managing cookies, see our Cookie Policy.

11. Children

The Service is not directed to children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@omnirank.net and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and by posting a notice on the dashboard. The "Last updated" date at the top of this page reflects when the policy was last revised. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

13. Contact us

For data-related requests, questions, or complaints regarding this Privacy Policy, contact us at:

hello@omnirank.net

Subject line: "Privacy enquiry"