Privacy Policy

1Who we are

This Privacy Policy describes how Searchpilot B.V., a private limited company under Dutch law (KvK 99806673, registered office in Amsterdam), trading as “Rankbird” (“we”, “us”), collects and uses personal data. Our full company details are on Company details. For privacy questions, contact support@rankbird.com.

2Scope

This policy applies to personal data we process as a controller: visitors to rankbird.com, people who contact us, and contacts at our (prospective) clients. Where we process personal data on a client’s behalf via the Rankbird platform, the client is the controller and we act as processor under our Data Processing Agreement.

Section 4 describes how we handle Google user data when a client connects Google to Rankbird, as required by Google.

3What we collect, why, and on what basis

• Website and contact form — name, email address, company, store URL, your message, and technical data such as IP address and browser details. Purpose: answering your request and securing the website. Basis: Art. 6(1)(b) GDPR (pre-contractual steps) and Art. 6(1)(f) GDPR (legitimate interest in security).
• Client and prospect administration — name, role, business email, phone number, company, store URL, communication history and chosen plan. Purpose: onboarding, support and account management. Basis: Art. 6(1)(b) GDPR for clients; Art. 6(1)(f) GDPR for prospects.
• Connected Google services (only if you connect Google) — see section 4. Basis: Art. 6(1)(b) GDPR.
• Billing — name, company, billing address, VAT number, payment and invoice data. Purpose: billing and accounting. Basis: Art. 6(1)(b) and 6(1)(c) GDPR. Invoices are issued directly by Rankbird.
• Marketing (if you opt in) — name, email, company. Purpose: product updates and newsletters. Basis: consent, or legitimate interest for existing clients, with an opt-out in every message.
• Logs — IP address, browser details, timestamps, error and event logs. Purpose: availability, troubleshooting and security. Basis: Art. 6(1)(f) GDPR.
• Job applicants — the data in your application. Purpose: recruitment. Basis: Art. 6(1)(b) and 6(1)(f) GDPR.

We do not ask for special categories of personal data. Please do not send them via the contact form.

4Google Search Console and Google Analytics

Connecting Google is optional. Rankbird accesses Google data only after an authorised user connects their Google account and grants the permissions shown on Google’s consent screen. For Google data in a client’s workspace, the client is the controller and Rankbird acts as processor.

Permissions we request. Read-only access to the Google Search Console and Google Analytics properties the connecting user has access to, and the email address of the connected Google account so we can identify the connection. Rankbird cannot change, add or delete anything in your Google account and does not access other Google services such as Gmail, Drive or Calendar.

Data we access.

• Search Console: properties, search queries, clicks, impressions, click-through rates, positions, landing pages, URL inspection and sitemap information.
• Google Analytics (GA4): aggregated reporting data such as sessions, engagement, conversions, landing pages and traffic channels. We do not request user-level identifiers or data that identifies individual visitors of your website.

How we use it. Only to provide and improve user-facing Rankbird features for the connected workspace: search-performance insights, reporting, technical website health checks, keyword and content opportunities, AI-assisted content features and AI-visibility monitoring.

Sharing. We share Google user data only as needed to provide these features, with our hosting provider, third-party AI providers and a keyword-data provider, all under data processing agreements; to comply with law; or as part of a merger, acquisition or sale of assets with notice to users. Search Console keywords, performance figures and search queries may be sent to AI providers to generate content and to run AI-visibility monitoring. Google Analytics data is not sent to AI providers. Under our agreements, AI providers do not use this input to train their models.

We do not sell Google user data, do not use it for advertising, and do not use it to develop, train or improve generalised AI or machine-learning models. Rankbird staff do not read Google user data unless you consent, it is needed for security (such as investigating a bug or abuse), it is required by law, or the data is aggregated for internal operations.

Storage and security. Google-derived data and the credentials needed to keep the connection working are stored encrypted on servers in the EU, with access limited to what is strictly necessary.

Revoking access and deletion. You can revoke access at any time in your Google Account (myaccount.google.com/permissions) or by emailing support@rankbird.com. After revocation, Rankbird can no longer retrieve new data and the stored credentials are deleted or invalidated. To delete Google-derived data, email support@rankbird.com; we delete it, together with the stored credentials, within 30 days of a verified request, unless the law requires us to keep specific information.

Limited Use. Rankbird’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5Cookies

rankbird.com uses only strictly necessary cookies by default. Other cookies are placed only with your consent via the cookie banner. See our Cookie Policy.

6Who we share data with

We share personal data only with service providers that process it on our behalf under a data processing agreement, such as hosting, email delivery, error monitoring, AI and keyword-data providers; with professional advisers (such as our accountant) where needed; and with authorities where legally required. We do not sell personal data. The categories of sub-processors are on Sub-processors.

7Transfers outside the EEA

Our main data storage is in the EU. Some providers are based outside the EEA, mainly in the United States. For those transfers we rely on the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

8How long we keep data

• Contact form messages: up to 24 months, unless a client relationship follows.
• Client administration: the duration of the relationship plus 7 years (tax obligation); prospects without follow-up: up to 24 months.
• Billing data: 7 years.
• Marketing: until you unsubscribe or withdraw consent.
• Logs: up to 90 days, unless needed longer for a security investigation.
• Job applications: 4 weeks after the procedure, or up to 1 year with your consent.
• Google credentials and Google-derived data: for the duration of the agreement or until access is revoked. They are not deleted automatically when the agreement ends: deletion is a support action, carried out within 30 days of a verified deletion request to support@rankbird.com. Copies in secured backups are overwritten in the normal backup cycle.

9Your rights

You have the right to access, rectify and erase your personal data, to restrict processing, to data portability, and to object to processing based on legitimate interest. You can withdraw consent at any time. To exercise a right, email support@rankbird.com; we respond within one month and may need to verify your identity. You may also complain to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

10Automated decisions and AI

We do not make decisions with legal or similarly significant effects based solely on automated processing. The platform uses third-party AI models to draft content and run AI-visibility monitoring on a client’s instruction. Clients are responsible for reviewing AI-generated content; with auto-publish enabled, content may be published without prior human review.

11Security

We take appropriate technical and organisational measures, including encryption in transit and at rest, access restrictions with multi-factor authentication where available, protection against spam and attacks, and a data-breach procedure that includes notifying the Autoriteit Persoonsgegevens within 72 hours where required.

12Children

The Service is intended for business use and is not directed at children.

13Changes

We may update this policy. Material changes are communicated where appropriate, and the date above is updated.

14Contact

Questions: support@rankbird.com. Company details are on Company details.