Skip to content
RankFox

Privacy policy

Last updated 24 October 2026.

This policy explains what personal data RankFox handles, why, who else handles it and what your rights are. RankFox ("we", "us") checks websites for search engines and AI assistants, at rankfox.eu, app.rankfox.eu and api.rankfox.eu. You can reach us any time through the contact form.

1. The short version

  • We collect what we need to run your account and answer your questions, and nothing to sell or to show you ads.
  • RankFox mostly works with public information: the public pages of your website and public answers of AI assistants.
  • Our servers are in Paris, France. Where a provider outside the European Economic Area is involved, we use the safeguards the law requires.
  • You can ask us at any time to see, correct or delete your data.

2. Two roles

  • As controller, for the data of people who visit our website, write to us, create an account or pay. We decide why and how this data is used.
  • As processor, for personal data that may be part of what our customers put into RankFox, such as the names of team members they invite. The customer decides why this data is used. We process it only on their instructions, as described in the terms.

3. What we collect and why

  • Website visitors. We count page views, clicks on our buttons, how far people scroll and the country and device they use, with our own analytics tool, EventsLake. We do not use advertising cookies, we do not follow you across other websites and we do not sell this data. Our servers also keep short technical logs (IP address, time, page) to keep the service secure. Legal basis: our legitimate interest in understanding how our website is used and keeping it secure.
  • Contact form. Your name, email address, company or website and your message, so we can answer you. We also keep the IP address the message came from, to stop abuse. Legal basis: our legitimate interest in answering you, or steps you ask for before a contract.
  • Your account. Your email address, your name if you give it, your settings, the projects (websites) you add and the people you invite. You log in with a one-time link or code sent to your email: we have no passwords to store. Legal basis: performing our contract with you.
  • What you use RankFox for. The addresses of your websites, the results of scans, the pages we found, what was sent to search engines and when, the questions you track in AI visibility, the competitors you name and the link opportunities and draft replies. This is mostly about websites and companies, not about people. Legal basis: performing our contract with you.
  • Connections. When you connect Google Search Console, Bing Webmaster Tools or Yandex Webmaster, we store the keys or access tokens needed to work with them for you. We use them only to read the status of your pages and to send your pages to those search engines. Legal basis: performing our contract with you.
  • Product use. We record what happens in your account, such as starting a scan or pushing pages, together with your account and project, so we can keep the service working, help you when something goes wrong and improve it. Legal basis: our legitimate interest in running and improving the service.
  • Payments. When paid plans start, a payment provider (Stripe) handles your card details. We never see or store your card number. We keep the invoices and the VAT details the law requires. Legal basis: contract and legal obligation.

4. Scanning websites

When you add a website, RankFox visits its public pages the way a search engine does. It reads what any visitor can see, such as page titles, texts, links and images, and does not log in or fill in forms. Only add websites you own or may work on. If someone else's site was added without permission, tell us through the contact form and we will stop scanning it.

5. AI providers

To check AI visibility, we send the questions you track and your web address to ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google) and Perplexity, and store their answers. To write report summaries, suggest questions and draft replies, we send the relevant parts of your scan results to Gemini through Google Cloud. Please do not put personal data in your questions. Under the business terms of these providers, data sent through their API is not used to train their models.

6. Who else handles data (sub-processors)

  • Amazon Web Services, hosting and database, in Paris (France).
  • Cloudflare, DNS and network protection in front of our website, app and API.
  • SendGrid (Twilio), delivery of our own emails, such as login codes and answers to your messages.
  • Google, Gemini through Google Cloud, the Search Console and Indexing services you connect, and page speed measurements.
  • OpenAI, Anthropic and Perplexity, the AI assistants we ask your questions.
  • Brave Search and Reddit, to find public threads and pages for link opportunities.
  • Microsoft (Bing) and Yandex, when you connect them, to send your pages to their search engines.
  • EventsLake, our analytics, hosted in the European Union.
  • Stripe, payments, once paid plans start.

When data leaves the European Economic Area, for example to an AI provider in the United States, we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or on its standard contractual clauses. If we add or change a sub-processor, we update this list.

7. How long we keep data

  • Account and project data: as long as your account is active. When you delete a project or your account, we remove its data within 30 days, apart from backups that expire within a further 30 days.
  • Scan results and AI answers: as long as the project exists; you can delete them with the project.
  • Invoices and payment records: 7 years, as the law requires.
  • Contact form messages: up to 2 years.
  • Analytics of our website: up to 2 years. Technical logs: normally no more than 90 days.

8. Security

All traffic is encrypted. Access keys for your connections are stored securely and are never shown again in full. Access to our production systems is limited to the people who need it, and logging in uses one-time links and codes instead of passwords. No system is perfectly secure, but we take care to protect your data and we tell you and the authorities when a breach requires it.

9. Your rights

You can ask us for access to your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Use the contact form and tell us which right you want to use. We answer within one month. If you are not happy with our answer, you can complain to your data protection authority. In Belgium, that is the Gegevensbeschermingsautoriteit / Autorité de protection des données (dataprotectionauthority.be).

10. Children

RankFox is a tool for businesses. It is not meant for people under 16 and we do not knowingly collect their data.

11. Changes

When we change this policy in a way that matters, we update the date at the top and tell customers by email or in the app.