Privacy policy

This website (rankpilot.solutions) and the "rankpilot" service are operated by Detrix Digital (detrixdigital.com), legal entity: [full legal name and entity type of the contracting company, to be added by the owner]. In this document "we", "us" and "our" mean that company. "You" means the person or organisation using the website or buying our services.

Registered address: [registered business address, to be added by the owner]. General contact: [email, to be added by the owner].

This policy explains what personal data we collect through rankpilot.solutions, why, who receives it, how long we keep it, and what rights you have. It is written for visitors and prospective clients in the United States, the European Economic Area (EEA), the United Kingdom, Japan and elsewhere. It does not cover the data we process on behalf of clients while delivering services; our Data processing terms cover that.

1. Who is responsible for your data

For personal data collected through this website, the company named above is the "controller" (GDPR and UK GDPR), the "business" (California Consumer Privacy Act, "CCPA") and the "business operator handling personal information" (Japan's Act on the Protection of Personal Information, "APPI"). Privacy contact: [privacy contact email, to be added by the owner].

EU and UK representative: [name and address of an EU and UK representative under GDPR Article 27 and UK GDPR Article 27, if the owner appoints one; see the owner's launch checklist].

2. What we collect

Information you give us

• Audit and contact form: your name, email address, website address, the service you are interested in, and anything you write in the message box.
• Emails and calls: the contents of messages you send us, and details you share in meetings.
• Engagement information: if you become a client, your business details, billing contact and payment-related details. Card payments are handled by our payment provider; we do not store full card numbers.

Information collected automatically

• Our hosting provider logs standard technical data when pages are requested: IP address, date and time, pages requested, browser and device type, and referring page. We use this for security, abuse prevention and keeping the site running.
• This site does not currently use advertising trackers, social media pixels or analytics cookies. See our Cookie policy. If this changes we will update this policy and, where the law requires, ask for your consent first.

What we do not want

Please do not send us sensitive data through the form (for example health, financial account, government ID or biometric data, or data about children).

3. Why we use it, and our legal bases

The list below uses the terminology of the GDPR and UK GDPR. Where those laws do not apply, we rely on the same purposes under the law that does.

• Reply to you and prepare the audit you asked for. Legal basis: taking steps at your request before a contract, and our legitimate interest in answering enquiries; and, for the consent checkbox on the form, your consent.
• Provide and manage services, invoicing, tax and accounting. Legal basis: performing a contract, and legal obligation.
• Keep the website secure, prevent abuse and fraud. Legal basis: legitimate interest.
• Improve our services and communications. Legal basis: legitimate interest, balanced against your rights.
• Send you information about our services. Only if you ask us to or, where the law allows, to business contacts in relation to our services, always with an easy way to opt out. Legal basis: consent, or legitimate interest where permitted.
• Comply with law and respond to legal requests, and establish or defend legal claims. Legal basis: legal obligation and legitimate interest.

Where we rely on legitimate interests you can object (see section 9). Where we rely on consent you can withdraw it at any time as easily as you gave it; this does not affect earlier use. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not use the content of your messages to train AI models.

4. Who we share it with

We do not sell your personal data and we do not share it for cross-context behavioural advertising. We disclose it only to:

• Service providers (processors / service providers / contractors) acting on our instructions: our database provider (Supabase), our hosting and form-handling provider (Netlify), our email and communications tools, our payment and invoicing providers, and professional advisers such as accountants and lawyers. [Owner to add or remove providers to match what is actually used at launch.]
• Authorities and others where we are required to by law, regulation, court order or to protect rights, safety and security.
• A successor in a merger, acquisition or sale of business, subject to this policy continuing to apply.

Providers are bound by contracts that limit their use of the data to the services they provide to us and require appropriate security.

5. International transfers

We are based outside the EEA, the UK and Japan, and our providers may store or process data in the United States and other countries. Where personal data of people in the EEA, UK or Japan is transferred to a country without an adequacy decision or equivalent recognition, we use a lawful transfer mechanism, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or the UK Addendum to those clauses, or a provider's certification to the EU-US Data Privacy Framework and its UK and Swiss extensions where available. For personal information of people in Japan, we take the steps the APPI requires for transfers to foreign countries, including ensuring the recipient maintains a system conforming to the standards the APPI sets, and giving you information about the foreign country's data protection system on request. You can ask us for details of the safeguards we use through the privacy contact above.

6. How long we keep it

• Audit requests and enquiries that do not become a client relationship: [retention period, to be confirmed by the owner, for example 12 months from last contact], then deleted or anonymised.
• Client and billing records: for the duration of the engagement and then as required by tax, accounting and other law (commonly several years, depending on the country).
• Server logs: [retention period, to be confirmed against the hosting provider's settings, for example 30 days].
• Marketing opt-out records: kept so that we can honour your opt-out.

We may keep data longer where needed for a legal claim or legal duty.

7. Security

We use measures appropriate to the risk: encryption in transit (HTTPS), access controls and authentication on our administration area, limiting access to people who need it, and providers that maintain recognised security practices. No system is perfectly secure and we cannot guarantee absolute security. We will notify you and the relevant authorities of a personal data breach where the law requires us to.

8. Children

Our website and services are for businesses and are not directed to children. We do not knowingly collect personal data from anyone under 16 (or under 18 where the law of the person's country sets that age). If you think a child has given us data, contact us and we will delete it.

9. Your rights

To use any right, email the privacy contact in section 1. We may need to verify your identity before acting, and we will not charge a fee unless the law allows it for manifestly excessive requests. We aim to respond within one month (45 days for California requests, extendable as the law allows).

People in the EEA and the UK (GDPR and UK GDPR)

You may ask for access to your data and a copy of it; correction; erasure; restriction of processing; portability of data you provided in a machine-readable format; and you may object to processing based on legitimate interests or used for direct marketing, and withdraw consent at any time. You have the right to complain to your local supervisory authority, for example your national data protection authority in the EEA, or the Information Commissioner's Office in the UK. We would appreciate the chance to resolve your concern first.

People in California and other US states (CCPA and other state privacy laws)

We handle personal data of US residents as described in this policy. Depending on where you live, you may have the right to know and access the categories and specific personal information we hold; to delete it; to correct inaccurate information; to opt out of the sale or sharing of personal information and of targeted advertising and profiling; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. You may use an authorised agent, and where a state law gives you the right to appeal a refusal, you can reply to our decision to ask for an appeal.

• Categories collected in the last 12 months: identifiers (name, email, IP address); internet activity from server logs; business and professional information you give us; and commercial information if you become a client. We do not knowingly collect sensitive personal information.
• Sources: you, and your browser or device when you visit the site.
• Purposes: as set out in section 3.
• Disclosure: to the service providers in section 4 for business purposes.
• Sale and sharing: we have not sold or shared personal information for cross-context behavioural advertising in the last 12 months, and we do not do so. We do not knowingly sell or share personal information of people under 16. Because we do not sell or share, we do not display a "Do Not Sell or Share My Personal Information" link; if our practices change we will add it and will honour opt-out preference signals such as the Global Privacy Control.

Some US state privacy laws apply only to businesses above certain size or data-volume thresholds. We apply the rights above to all US residents who ask, as a matter of policy, whether or not the law strictly requires it.

People in Japan (APPI)

You may request disclosure of the personal information we hold about you, and its correction, addition, deletion, suspension of use or suspension of third-party provision, and disclosure of records of third-party provision, in the cases and to the extent the APPI provides. Our purposes of use are those in section 3. We use personal information only within those purposes, and we provide it to third parties only with your consent or as the APPI permits (including entrusting it to providers under supervision). Personal information may be handled in countries outside Japan as described in section 5. To make a request, contact us at the privacy contact above; we will respond without delay.

People elsewhere

Many countries give similar rights. Contact us and we will help to the extent the law of your country requires.

10. Marketing emails and calls

We send marketing email only where permitted. Every marketing email includes a clear way to opt out, our valid physical postal address and truthful sender and subject information, and we honour opt-outs within 10 business days, as the US CAN-SPAM Act requires, and sooner where other laws demand. In the EU, UK and Japan, we send electronic marketing to individuals only with the consent or other basis the local law requires. We do not buy email lists. Service messages about an engagement you have with us are not marketing.

11. Links to other sites

We link to other websites. They have their own privacy practices and this policy does not cover them.

12. Changes to this policy

We will publish changes here with a new "last updated" date, and where a change is material and we have your email address, we will tell you.

13. Contact and complaints

Privacy contact: [privacy contact email, to be added by the owner]. Postal address: [registered address, to be added by the owner].