1. In short
- We collect only what the Service needs: your account, your order, and the product details you ask us to publish.
- We use Google Analytics to see how the website is used. We never sell data.
- Every processor we use is under a data processing agreement, and transfers outside the EEA are covered by Standard Contractual Clauses or an adequacy decision.
- You can access, correct, export or delete your data by emailing [email protected].
2. Our role
RankSolid is the controller for the personal data in your account, your orders and your messages. When we submit your product details to a directory, that directory becomes an independent controller of the data it publishes.
3. Lawful bases
We rely on contract (running your account and delivering what you bought), legal obligation (keeping invoices), and legitimate interests (security, fraud prevention, answering messages). We don't rely on consent for anything today, because we send no marketing. The table in section 3 of the Privacy Policy maps each purpose to its basis.
4. Your rights, and how to use them
| Right | What it means |
|---|---|
| Access (art. 15) | Get a copy of the personal data we hold about you |
| Rectification (art. 16) | Have inaccurate data corrected |
| Erasure (art. 17) | Have your data deleted, except what we must keep by law (such as invoices) |
| Restriction (art. 18) | Have us pause processing while a question is resolved |
| Portability (art. 20) | Receive your data in a machine-readable format |
| Objection (art. 21) | Object to processing based on legitimate interests |
Email [email protected] from the address on your account, saying which right you want to use. We answer within one month, and may ask you to confirm your identity first. It's free, unless a request is manifestly unfounded or excessive.
You can also complain to the data protection authority in the EU country where you live or work.
5. Processors
Stripe (payments), Resend (email delivery), Google (optional sign-in), and our hosting and database providers. Section 5 of the Privacy Policy lists what each one does and where.
6. Data breaches
If a personal data breach is likely to put your rights at risk, we notify the competent supervisory authority within 72 hours of becoming aware of it and, where the risk is high, we tell you directly without undue delay.
7. Data processing agreement
Customers who need a data processing agreement for their own records can request one at [email protected].