Privacy policy
Last updated:
This policy explains how Rankrake handles personal data: on this website, for the people who contact us, for our customers, and for the visitors of the stores and websites that use Rankrake.
Who we are
Rankrake is run by Oriol Castander, a self-employed professional, with tax id (NIF) 48271448Z and address at Carrer Torrent del Llorer 1, 08192 Sant Quirze del Vallès, Barcelona, Spain. For anything about your personal data, write to [email protected].
Rankrake has two roles, depending on whose data it is:
- Controller for the data of the visitors of this website, of the people who contact us and of our customers’ accounts. We decide why and how that data is used.
- Processor for the data of the visitors of our customers’ stores and websites. Our customer (the store or website) is the controller; we handle that data only on their behalf and on their instructions.
Visitors of this website
This website sets no cookies and uses no analytics or advertising tools. It only keeps your choice of light or dark theme in your browser’s local storage, which never leaves your device.
As any web server does, ours records each request (IP address, browser user agent, page requested and time) in its logs, to keep the website secure and working. These logs are deleted after 14 days. The website is delivered through Cloudflare, which processes the same request data to protect and speed up the website.
Legal basis: our legitimate interest in keeping the website secure and available (article 6.1.f of the GDPR).
People who contact us
When you use the contact form or write to us, we receive your name, email address, your company and website if you give them, the reason for your message and the message itself.
| Purpose | Answering you, and arranging and running a demo if you ask for one |
| Legal basis | Your consent, given when you send the form (article 6.1.a of the GDPR), and the steps you ask us to take before a possible contract (article 6.1.b) |
| Retention | As long as the conversation goes on, and up to two years after our last exchange, unless you become a customer or ask us to delete it earlier |
You can withdraw your consent at any time by writing to us; this does not affect what was done before.
Our customers
For the stores and websites that use Rankrake, we hold the account details needed to provide the service: the account’s name, its contact email, its sites, and the keys that connect them. We use them to provide the service and to contact the customer about it (legal basis: the contract, article 6.1.b of the GDPR), for as long as the account is active and afterwards as long as the law requires us to keep records.
Visitors of our customers’ stores and websites
When a store or website uses Rankrake, its pages send us what visitors do there, so that Rankrake can recommend items to them and show the store or website how its recommendations perform. We handle this data as a processor, only for that store or website, never for anyone else, and we never sell it.
What we receive:
- identifiers created for the visit and for the browser (a session id and an anonymous visitor id), and a user id only if the website chooses to identify its logged in users;
- the IP address and the browser user agent of each request;
- the pages and items viewed, the recommendations shown and clicked, and items added to the cart;
- for orders: the order id, and for each line the item, variant, quantity, price and currency;
- where the visit came from (referring website and campaign parameters).
What we do not receive: names, email addresses, phone numbers, postal addresses or payment details of shoppers.
Consent: nothing is recorded, stored or sent until the visitor has agreed to it, through the store’s or website’s own consent banner. On Shopify, Rankrake follows the visitor’s choice as recorded by Shopify’s customer privacy settings. Once the visitor agrees, Rankrake keeps the visitor and session ids in the browser’s local storage, so a visit is recognised across pages; if the visitor withdraws, they are erased.
Retention: for as long as the store or website uses Rankrake. When a Shopify store uninstalls the app and Shopify asks for the store’s data to be erased, we delete its data. When a store asks us to erase a shopper’s data, we anonymise it: the identifiers, IP address and user agent are removed, so the remaining figures can no longer be linked to a person.
If you visited one of our customers’ stores or websites and want to exercise your rights, please contact that store or website first, as they are the controller. We will help them answer you.
Who we share data with
We do not sell personal data. We share it only with the providers we need to run Rankrake, under agreements that protect it:
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting of our servers and databases | Germany (EU) |
| Cloudflare, Inc. | Delivery and protection of our websites and APIs | Global network; transfers outside the EU covered by the EU–US Data Privacy Framework and standard contractual clauses |
| Shopify | Running the Rankrake app for stores that install it | As set out in Shopify’s own privacy policy |
We may also disclose data when the law requires it.
Your rights
You have the right to access your personal data, correct it, delete it, restrict or object to how it is used, receive it in a portable format, and withdraw your consent at any time. To exercise any of these rights, write to [email protected].
If you think your data has not been handled properly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos.
Security
Data travels encrypted, is stored on servers in the European Union, and only the people who run Rankrake can access it.
Changes
We may update this policy as Rankrake changes. The date at the top shows when it was last updated; for important changes, we will tell our customers in advance.