Legal
Privacy policy
What personal data Ranktide collects, why, who we share it with, how long we keep it and how to use your rights.
Last updated: 11 November 2026
1. Who we are
MASDE Agency ("we", "us") runs Ranktide: the website at ranktide.io, the app at app.ranktide.io, the Ranktide API and MCP server, and the free SEO tools. We are the controller of the personal data this policy describes.
When you or your organisation put other people's personal data into Ranktide, such as teammates or your clients' staff, your organisation decides what happens to it. We process that data on your behalf under our Terms of service. If you need a data processing agreement, email legal@ranktide.io.
2. What we collect
Account details. Your name, email address and password. We never store your password in readable form. If you sign in with Google, we receive your name, email address and profile picture. We also keep your organisation's name, its members and their roles, invitations, and your settings, including your email preferences.
Billing details. Your plan, invoices, billing address and tax ID if you give one. Stripe collects your card details. We do not store full card numbers. If you redeem an AppSumo licence, AppSumo shares your licence details and the email address you use to redeem it.
Project data. What you add or create in Ranktide: websites, competitor domains, keywords, locations, tracked AI prompts, audit settings and results, ranking history, reports, uploaded logos, and messages you send to the in-app AI assistant with its replies.
Google data you connect. See section 4.
Usage and device data. When you use Ranktide, our servers record your IP address, browser, device, the requests you make and when, security events and credit usage. If you allow product analytics, we also record how you use the app and masked session replays (see section 5). We record errors to keep the service working; these reports leave out error messages that could contain your content.
Sign-up source. When you sign up, we record the campaign tags in the link you arrived from (such as utm_source), so we know which channels bring people to Ranktide.
Messages to us. What you send to support or to our legal and security addresses.
Website visitors. Plausible counts visits to ranktide.io without cookies (see section 5). When you use a free tool, we process the domain or keyword you enter, and your IP address to apply daily limits and block bots. If you subscribe to product updates on the website, we keep your email address.
3. How we use it
| Purpose | Data | Legal basis (GDPR and UK GDPR) |
|---|---|---|
| Run Ranktide: accounts, organisations, projects, reports and AI features | Account, project and Google data | Performing our contract with you |
| Billing, credits and tax records | Account and billing details, credit usage | Contract; legal obligation for tax and accounting records |
| Service emails such as email verification, password resets, invitations and billing notices | Name, email, plan details | Contract |
| Product update emails | Name, email | Consent where the law requires it; otherwise our legitimate interest, with an unsubscribe link in every email |
| Security, fraud and abuse prevention, including bot checks and rate limits | IP address, device data, usage and security logs | Legitimate interests in keeping Ranktide and its users safe |
| Fixing errors and keeping the service running | Error reports, server logs | Legitimate interests |
| Product analytics and session replay in the app | Usage events, masked replays, device data | Consent in the EEA, UK and Switzerland; legitimate interests elsewhere, with an opt-out |
| Website visit counts (Plausible) | Page, referrer, browser, device type, country | Legitimate interests; no cookies are used |
| Support and replying to you | Messages, account details | Contract or legitimate interests |
| Meeting legal duties and handling claims | Any of the above, as needed | Legal obligation; legitimate interests |
We do not use your data to train AI models. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Google user data
You can sign in with Google and connect Google Search Console and Google Analytics 4 to Ranktide. This section explains how we handle data we receive from Google APIs.
What we access.
- Google sign-in: your name, email address and profile picture.
- Search Console (read-only scope
webmasters.readonly): search performance for the properties you choose, such as queries, pages, clicks, impressions and average position, and URL inspection results. - Google Analytics 4 (read-only scope
analytics.readonly): reports for the property you choose, such as traffic, landing pages, key events and audience breakdowns, plus your list of properties and their settings. - The email address of the Google account you connect, so we can show which account is linked.
Every Google scope we request is read-only. Ranktide cannot change anything in your Google account.
How we use it. Only to provide features you use and ask for: dashboards and reports, keyword ideas from your Search Console data, answers from the in-app AI assistant, and data you request through AI assistants you connect over MCP. We do not use Google user data for advertising, we do not sell it, and we do not use it to train or improve AI or machine learning models.
Who receives it. Google user data leaves Ranktide only:
- when you ask an AI assistant you connected over MCP for it, in which case the results go to that assistant;
- when you ask the in-app AI assistant about it, in which case the relevant data goes through OpenRouter to the AI model that writes the answer, without being used for training;
- to Cloudflare, which hosts Ranktide;
- when the law requires it, or with your explicit consent.
No one at Ranktide reads your Google data unless you ask us to for support, we need to for security or abuse investigations, or the law requires it.
How we store it. The OAuth tokens that give Ranktide access are encrypted at rest. We cache recent reports for a short time so dashboards load quickly, and keep Google data that is part of saved reports or AI assistant chats until you delete them or your account.
Disconnecting. You can disconnect Search Console or Analytics in Ranktide at any time. Once no project uses a connection, we delete its stored tokens and revoke our access. You can also remove Ranktide's access at myaccount.google.com/permissions. Deleting your Ranktide account revokes our Google access.
Limited Use. Ranktide's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Cookies and analytics
The Cookie policy lists every cookie and storage item we use. In short:
- Plausible counts website visits without cookies or IDs stored in your browser. You can opt out in "Your privacy choices".
- PostHog records product analytics and session replays in the app. Replays hide all text and form inputs. It runs only if you allow product analytics.
In the EEA, the UK, Switzerland and when we cannot tell where you are, product analytics stays off until you opt in. Elsewhere it is on until you opt out. If your browser sends Global Privacy Control, it stays off until you opt in, wherever you are. Change your choices with "Your privacy choices" in the website footer, or in the app under Settings.
6. Who we share it with
- Service providers. We use providers to host Ranktide, take payments, fetch SEO data, run AI features, send email and measure usage. They process personal data for us under contract. The Subprocessors page lists them.
- Your organisation. Members of your organisation can see the projects, reports and activity in it.
- People and tools you choose. Anyone you send a report share link to, and AI assistants you connect.
- AppSumo. If you bought through AppSumo, we exchange licence status with AppSumo.
- Legal reasons. Authorities or others when the law requires it, or to protect our rights, our users or the public.
- Business transfers. A buyer or successor if we are involved in a merger, acquisition or sale of assets. This policy will still apply to your data.
We do not sell personal information, and we do not use it for targeted advertising.
7. International transfers
Our providers process data in the United States and other countries. When we transfer personal data out of the EEA, the UK or Switzerland, we rely on an adequacy decision (such as the EU-US Data Privacy Framework, for providers certified under it) or on the European Commission's Standard Contractual Clauses with the UK addendum where needed.
8. How long we keep it
- Account and project data: while your account is open. When you delete your account, we wait 14 days, then erase it from our systems and from our analytics and email providers. Audits and reports you created in an organisation shared with others stay with that organisation but are no longer linked to you, and their share links are revoked.
- Google OAuth tokens: until you disconnect the account or delete your Ranktide account.
- Billing records: for as long as tax and accounting law requires.
- Server logs: for a short period, for security and troubleshooting.
- Product analytics and session replays: for a limited period, and deleted with your account.
- Support messages: as long as we need them to help you and keep a record of what we agreed.
- Product update subscriptions: until you unsubscribe or ask us to delete your email.
Copies in backups can remain until those backups expire on their normal schedule.
9. Your rights
Depending on where you live, you can:
- see the personal data we hold about you and get a copy;
- correct it;
- delete it;
- object to or restrict how we use it;
- get it in a portable format;
- withdraw consent at any time, without affecting what we did before;
- complain to your data protection authority. In South Africa that is the Information Regulator (inforegulator.org.za), under the Protection of Personal Information Act (POPIA).
We will not treat you differently for using these rights.
How to use them. You can edit your profile, change your privacy choices and delete your account yourself in the app. For anything else, email legal@ranktide.io with "Privacy request" in the subject line. We will confirm your identity, usually by checking you control the email on your account, and reply within one month (45 days for California requests). You can use an authorised agent, who will need your signed permission.
10. Children
Ranktide is not meant for children. We do not knowingly collect personal data from anyone under 16. If you think a child has given us personal data, email legal@ranktide.io and we will delete it.
11. Security
We protect personal data with encryption in transit and at rest, access controls and encrypted storage of connected credentials. The Security page has the details and explains how to report a vulnerability.
12. Changes to this policy
When we change this policy, we update the "Last updated" date above. For material changes, we will email account owners or show a notice in the app before the changes take effect.
13. Contact
MASDE Agency, 113 Loop Street, Cape Town, 8001, South Africa
Email legal@ranktide.io with any question about this policy or your data. This address also reaches our Information Officer under POPIA.