Privacy Policy
Last updated: 20.07.2026
This Privacy Policy explains what data is collected, how it is used and how it is protected when you use the rankzupAI service (rankzup.ai and app.rankzup.ai) operated by rankzupAI. For your rights under the KVKK, please also see the Personal Data Protection (KVKK) Disclosure Notice.
1. Types of Data Collected
- Account data: full name, email, hashed password.
- Usage data: the projects you view in the panel, the prompts you create, scan history, quota/usage counters.
- Technical data: IP address, browser information, session and CSRF cookies, access timestamps.
- Billing data: the name/legal title on the receipt when payment is made by bank transfer. No card data is retained.
- Free test data: the brand/industry/domain and (if you provided it) email address entered in the free AI visibility test used without logging in.
2. Cookies
rankzupAI uses only its own (first-party) cookies. There are NO advertising/retargeting cookies belonging to third-party ad networks (e.g. Google Ads, Meta Pixel), and your cookies are never sold/shared with any third party. The cookies used are as follows:
- Session cookie (geo_session): carries the identity of the logged-in user; HttpOnly, Secure and valid for at most 14 days. Mandatory — required for the service to function.
- CSRF cookie: protects form submissions against Cross-Site Request Forgery attacks. Mandatory.
- UTM attribution cookie (utm_data): remembers for 30 days which source/campaign (utm_source/utm_medium/utm_campaign) you arrived from; used only to measure which marketing channel works, not for personalized advertising, and not shared with third parties. It may also be set when you visit the site without logging in (e.g. the free test or the home page). Functional/marketing-attribution purpose.
- Sign-up bridge cookie (lead_data): when you use the free AI visibility test and leave your email, it carries your brand name/domain/industry/score information for 7 days to pre-fill your sign-up form (valid across the rankzup.ai and app.rankzup.ai subdomains). Functional — only to ease the sign-up wizard, not for advertising.
The session and CSRF cookies are mandatory for the basic security and function of the service; disabling them prevents the service from working. You can use the service without the UTM attribution and sign-up bridge cookies — only marketing measurement or automatic form pre-filling will not work. You can delete/block all cookies at any time from your browser settings.
3. Sharing with Third Parties
Your data is shared with the following third parties to the extent necessary to provide the service:
- AI providers (OpenAI, Google, Anthropic, xAI, DataForSEO): query texts are sent to measure your brand's visibility in AI answers. No personal data is sent to these providers — only brand/product/industry information is sent (see KVKK Disclosure Notice, Article 4 for details).
- SMTP email provider: your email address is used to send welcome, password-reset, trial and notification emails.
- Telegram: used only to send notifications via the Telegram alert channel you connect to your account at your own request; if you do not connect it, no data is transmitted.
Your data is never sold or rented to third parties for marketing purposes.
4. Data Security
- Passwords are stored irreversibly using the argon2 algorithm — plaintext passwords are never kept anywhere.
- All communication between the server and your browser is encrypted with HTTPS.
- Form submissions are protected with a CSRF token.
- Access is limited to persons authorized solely for operating the service.
5. Data Retention and Deletion
Your data is retained for as long as your account is active. To close your account or request deletion of your data, you can contact kvkk@rankzup.ai. Data subject to statutory retention obligations (e.g. invoice records) may additionally be retained for the period required by legislation.
6. Contact
For questions regarding this policy, you can reach us at kvkk@rankzup.ai or destek@rankzup.ai.