Privacy Policy

RankGhost is operated by Ctrldigit Technologies LLP, a limited liability partnership registered in India, at 312, Gera Imperium Gateway, S. No. 2656, P Metro Station, C.T, Nashik Phata Flyover, opp. Bhosari, Kasarwadi, Pimpri-Chinchwad, Maharashtra 411034, India. Under the DPDP Act we are the Data Fiduciary for the personal data described below; under the GDPR we are the controller.

For any privacy question, correction, or complaint, write to support@rankghost.net. That address is also our grievance contact under Section 13 of the DPDP Act.

Only what the product needs to work. Specifically:

• Account details. Your email address, and a display name if you set one. If you sign in with Google, we receive your basic Google profile (name, email, profile picture) from that sign-in.
• Your password — which we never see. Sign-in is handled by our authentication provider. Passwords are set and verified there and are never transmitted to, or stored on, our own systems.
• What you enter. Project names, the website domains you track, your keywords, and any AI queries you create or approve.
• What we measure for you. Google search positions, snapshots of the top results for your keywords (which include titles, URLs, and snippets belonging to third-party websites), the text of answers returned by AI engines, the citations in those answers, and timestamps for each check.
• Operational telemetry. Per-check latency, token counts, and estimated provider cost. We use this to enforce plan limits and control our own costs.
• Billing status. Your plan tier, subscription status, the PayPal subscription ID, when your plan renews or ends, and when you accepted the refund policy at checkout. We never receive or store your card number, CVV, or bank details — PayPal handles payment entirely and shares none of it with us.

RankGhost runs no analytics, advertising, or tracking scripts of any kind. There is no Google Analytics, no Meta pixel, no session recorder, no third-party ad network. We do not build advertising profiles, we do not sell or rent your personal data, and we do not share it for anyone else's marketing.

Under the DPDP Act we rely on the consent you give when you create an account and submit data. Under the GDPR, our lawful bases are:

• Performance of a contract — running the checks you asked for, and giving you the results.
• Legitimate interests — keeping the service secure, preventing abuse, and enforcing plan limits.
• Legal obligation — retaining billing records where tax or accounting law requires it.

You may withdraw consent at any time; see section 8.

We share data only with service providers that help us run RankGhost, and each receives only what its task needs:

• Database and sign-in provider — stores your account, projects and results, and handles sign-in.
• Search data provider — receives your keywords, market and language to run Google checks.
• AI service providers — receive your prompts, and the text of pages you ask GhostAI to analyse, to produce answers and suggestions. They do not receive your account details.
• Payment processor (PayPal) — handles subscription billing. We receive only your plan and subscription status.
• Hosting provider — serves the application.

Some of these providers operate outside India and the EEA. Where EU or UK personal data is transferred, we rely on Standard Contractual Clauses. We do not sell your data. We may also disclose data where the law compels it, or to establish or defend a legal claim.

RankGhost sets no advertising or analytics cookies. What we do use:

• Sign-in session storage. Strictly necessary. Keeps you signed in between page loads. Clearing it signs you out.
• A local copy of your dashboard data. Your browser keeps a copy of your projects and results so the dashboard opens quickly. It stays on your device, and signing out deletes it.
• Interface preferences. For example, whether the dashboard sidebar is collapsed. Stored only in your browser.
• PayPal cookies. Set by PayPal on its own checkout, governed by PayPal's privacy policy, not ours.

Because we set nothing beyond what is strictly necessary to sign you in, no cookie consent banner is required. If we ever add analytics, we will ask first and update this section.

Account and project data is retained while your account is open, because check history is the product — rank movement is meaningless without it. Delete a project or keyword and its stored results go with it.

Ask us to close your account and we will erase your personal data and tracked results within 30 days, except billing records we are legally required to keep. Backups age out within 90 days.

Whichever law applies to you, email support@rankghost.net and we will respond within 30 days.

Under the DPDP Act, 2023 you may:

• Access a summary of the personal data we hold and who we shared it with.
• Correct or complete anything inaccurate.
• Erase data we no longer need for the purpose you gave it for.
• Nominate someone to exercise these rights if you die or become incapacitated.
• Complain to us first, and then to the Data Protection Board of India.

If you are in the EU or UK, you additionally have the right to:

• Portability — receive your data in a machine-readable format.
• Restriction and objection — limit or object to certain processing.
• Complain to your national supervisory authority.

Traffic is served over HTTPS. Database access is constrained by security rules so one account cannot read another's projects, keywords, or results. Provider API keys are held server-side and are never exposed to the browser.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board of India as the DPDP Act requires.

RankGhost is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 18. Tell us if a child has registered and we will delete the account.

If we change this policy we will update the effective date above, and for any material change we will email account holders before it takes effect. Continuing to use RankGhost after that date means the revised policy applies.

See also our Terms of Service and Refund & Cancellation Policy.