Privacy Policy

RankMeFast (https://rankme.fast) is operated by Abderrahim Selmi. Contact: privacy@rankme.fast

This Privacy Policy explains what RankMeFast collects, why, how it is protected, and the choices you have. It applies to the hosted Service at rankme.fast and to self-hosted instances running the same software.

For self-hosted deployments, RankMeFast the organization has no access to your data: everything runs on your own infrastructure. The information below describes the hosted Service.

Account data. Name, email address, password (scrypt hash only), preferred language, role, and email-verification state. If you sign in with Google: your Google account ID, name, email address and profile picture. See Google user data

Session data. Session token, IP address, and user agent stored with each session for security and abuse prevention.

Usage data. Per-account monthly counters for tracked keywords, audits, audit pages, backlink rows, AI summaries, and seats. These counters enforce plan limits.

Product data. Domains you add, tracked keywords, rank history, audit reports, backlink rows, competitor sets, and keyword-research results. This is the working data the Service produces for you.

Billing data. Subscription tier, invoices, and credit-ledger entries. Card details are handled by Polar; RankMeFast does not store full card numbers.

Vendor credentials. Google OAuth refresh tokens (for Search Console and Analytics) and configured DataForSEO credentials are encrypted at rest with AES-256-GCM under a master key. See Google user data

Contact-form messages. If you use the contact form, the message content and your email address are delivered to our support inbox via Resend.

We use the data above to:

• Provision and operate your account, sites, and audits.
• Enforce plan limits and prevent abuse through rate limiting and cross-account isolation.
• Process payments through Polar and maintain an invoice and credit-ledger history.
• Send transactional email: verification, password reset, audit completion, rank-drop alerts, and deletion warnings. Marketing email is opt-out and only sent if the corresponding preference is enabled.
• Generate AI summaries when the feature is enabled. Only the generated rule copy and site domain are sent to the AI model — never raw HTML, vendor payloads, or your personal data.
• Maintain audit logs for security. Audit logs never record email addresses, request bodies, headers, or sensitive parameters.

This section explains how RankMeFast accesses, uses, stores, shares and deletes information received from Google APIs. It applies to the hosted Service at rankme.fast.

Data we access

• Google Sign-In: your Google account ID, email address, name and profile picture. Scopes: openid, email, profile.
• Google Search Console, only if you connect it: accessible properties, search analytics (queries, pages, countries, devices, search appearance, clicks, impressions, CTR and average position), sitemaps and URL Inspection results for sampled public URLs on linked properties. Scope: https://www.googleapis.com/auth/webmasters.readonly.
• Google Analytics, only if you enable it: accessible GA4 properties and web streams, plus traffic, engagement and conversion (key-event) reports for linked properties. Properties may be matched to your site automatically or selected by you. Scope: https://www.googleapis.com/auth/analytics.readonly.

You can revoke access at myaccount.google.com/permissions. For deletion requests, contact privacy@rankme.fast. See Your rights for account deletion.

Limited Use disclosure

RankMeFast's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Session cookie. A single httpOnly, SameSite=Lax cookie (better-auth.session_token) keeps you signed in. It is marked Secure in production.

CSRF cookie. A double-submit token (x-csrf-token by default) protects forms. It is SameSite=Strict and Secure in production.

Language cookie. A lang cookie stores your interface-language preference for one year.

When the hosted site is configured with Google Analytics, Google receives browser and usage information and may set analytics identifiers. RankMeFast does not use advertising cookies.

RankMeFast shares data only with the sub-processors required to run the Service:

• Polar — payment processing and subscription management. Receives product IDs, customer references, and webhook events. Does not receive your audit or rank data.
• DataForSEO — keyword, rank, backlink, competitor, and Lighthouse lab-speed signals. Receives the domains, keywords, and public audit URLs you submit.
• Google APIs (OAuth, Search Console, and Analytics; optional PageSpeed Insights and CrUX when configured): receive connected-property data. Search Console URL Inspection sends sampled public site URLs when a property is connected; PageSpeed sends public audit URLs only when Google is selected for page speed. If the hosted site is configured for Google Analytics, Google also receives browser and site-usage events. PageSpeed Insights and CrUX use service API keys for public URL and field-performance data, not access to your Google account. See Google user data for how we handle information received from Google.
• Firecrawl (Cloud) — public-page crawling for audit, monitoring, and Content Intelligence. Receives only the public URLs you select.
• AI providers process AI summaries and Content Intelligence briefs or drafts through the operator-approved provider list: GLM, DeepSeek, Kimi, OpenAI, Gemini, and Anthropic Claude. Requested AI features process bounded excerpts, findings and report data, including Google-derived data as described in Google user data. Raw HTML is never sent. Provider data-use terms depend on the operator's current agreement and configuration.
• Resend — transactional and notification email delivery.

Each sub-processor is bound by its own data-protection terms. RankMeFast does not sell your data.

Content Intelligence is opt-in per analysis. When you run it we process the following:

• Firecrawl Cloud crawls the public URLs you select — your owned page and up to three public competitor pages you accept. It never sees authenticated pages or takes screenshots.
• Sanitized, bounded page excerpts and derived facts are stored to build the scorecard, brief, and citations.
• If, and only if, you opt in for the AI brief or first draft, sanitized excerpts are sent through the operator-approved provider list: GLM, DeepSeek, Kimi, OpenAI, Gemini, and Anthropic Claude. The list comes from a reviewed legal authority, never from live environment settings.
• No raw HTML is retained. Sanitized excerpts expire after 7 days. Derived facts, hashes, briefs, drafts, citations, and usage stay under the account retention policy.
• Public competitor content is used as short, cited evidence and is not substantially republished. Provider data-use terms are governed by the operator's current agreements; this Policy does not make a broader training promise.

Nothing is published automatically. Briefs and drafts live inside RankMeFast as editable working copies; export or delete them at any time.

Google user data is not excluded from all AI processing. Requested audit summaries can include findings derived from Google data. Schema generation can send Search Console rich-result facts to an AI provider, and the AI Assistant can receive Google data in permitted audit-report tool results. Content Intelligence also uses stored Search Console evidence for deterministic analysis. Provider retention and data-use terms depend on the applicable provider agreement and configuration; this policy does not promise that all provider processing is excluded from training.

• Vendor secrets and connected Search Console/Analytics refresh tokens use AES-256-GCM under a master key. Sign-in tokens use Better Auth's separate authenticated encryption.
• Passwords are hashed with scrypt via Better Auth; plaintext passwords are never stored.
• Cross-account isolation: every product route verifies ownership and returns 404 (not 403) for foreign resources so existence never leaks.
• Rate limits on authentication and webhook routes reduce brute-force and volumetric abuse.
• Two-factor authentication (TOTP + backup codes) is available on all accounts and required for admins.
• CSRF is enforced via Origin and trusted-origins checks plus the double-submit cookie.

No system is perfectly secure. If you believe you have found a vulnerability, please contact security@rankme.fast before public disclosure.

Derived facts, hashes, scorecards, briefs, drafts, citations, recommendation history, monitor results, and usage records remain under your account retention policy until export or deletion. Raw HTML is not retained, and sanitized excerpts expire after 7 days.

Billing records (invoices, credit ledger) are retained for the period required by tax law in the operating jurisdiction.

Audit logs that carry security-relevant metadata are retained on a rolling basis and never contain email addresses or request bodies.

Depending on your jurisdiction (EU/EEA, UK, California, etc.) you may have the right to:

• Access a copy of your personal data.
• Correct inaccurate data.
• Export your account data, including audits, rank history, Content Intelligence analyses, inventory and competitor runs, monitors, recommendation history, outcomes, and related usage events.
• Delete your account. Deletion enters a 30-day grace period during which you can cancel. A final warning email is sent 24 hours before the purge. A legal hold may delay deletion where required by law.
• Object to or restrict certain processing, and withdraw consent for marketing email at any time via notification preferences.
• Lodge a complaint with your supervisory authority if you believe processing violates applicable law.

To exercise any of these rights, use the in-app data-rights endpoints (/api/legal/*) or contact privacy@rankme.fast.

Your data may be processed by RankMeFast and its sub-processors in jurisdictions outside your country of residence. Where the EU/EEA is involved, transfers rely on appropriate safeguards such as Standard Contractual Clauses or another lawful transfer mechanism.

Self-hosted deployments keep all data on your own infrastructure; no transfer to RankMeFast occurs.

The Service is not directed to children under 16. RankMeFast does not knowingly collect personal data from children. If you believe a minor has registered, contact privacy@rankme.fast and the account will be removed.

On a self-hosted instance you control the infrastructure, the encryption keys, and the vendor integrations. RankMeFast the organization does not receive data from your instance. You are responsible for compliance with this Policy's obligations (including data-subject requests) for data you process on your own deployment.

We may update this Privacy Policy from time to time. Material changes will be announced by email (to verified accounts) or in-app at least 30 days before taking effect. The “Last updated” date at the top of this page reflects the most recent revision.

Questions about this Privacy Policy or a data-subject request? Contact privacy@rankme.fast.