Draft for review. Fill in the company details and have a solicitor check this page, then set LEGAL_REVIEWED=1 to remove this notice.

Privacy policy

Last updated 17 October 2026

This policy explains what personal data Ranka collects, why, and your rights. Ranka is run by Ala Africa Limited (16329652), Unit 9, Astra Centre, Edinburgh Way, Harlow, Essex CM20 1BN, which is the data controller. Contact us about privacy at support@getranka.com.

What we collect

• Account details: your email address, a securely hashed password (we never store your password itself), your time zone, and, if you turn on two-step login, an encrypted authenticator key and hashed recovery codes.
• Business details you give us: business name, website, what you sell, the areas you serve, offer links, and a reviewer's name and credentials if you add them.
• Content: text we read from your public website during setup, and the articles we create and you edit.
• Connection details: your WordPress username and application password, or a webhook address. We encrypt these when stored.
• Billing: handled by Stripe. We receive your plan and billing status; we never see or store your card details.
• Messages you send through our contact form.
• Usage events: which steps of sign-up and setup were completed. Before you sign up these are anonymous (no identifier, no IP address); afterwards they are linked to your business account.
• Security records: an audit log of sign-ins, security and settings changes, publishing, exports and any time our staff view or act on your account, with the time and IP address. It never contains passwords, codes or card details.
• Anti-abuse counters: short-lived counters that limit repeated attempts (for example sign-ins, password resets and sign-up steps), which can include an IP address or email address.
• Technical logs: our hosting provider records IP addresses and error details for security and reliability, kept for a limited time.

Why we use it, and our lawful basis

• To provide the service you signed up for: planning, writing and publishing articles, and billing (contract).
• To keep the service secure, prevent abuse and fix errors (legitimate interests).
• To understand where people get stuck during sign-up and improve the product, using the usage events above (legitimate interests).
• To send service emails such as password resets and billing notices (contract). We don't send marketing emails without your consent.
• To meet legal and tax obligations (legal obligation).

Who processes it for us

We share data only with providers who help us run Ranka, under contracts that require them to protect it:

• Render (Render Services, Inc., United States): hosts the app, the background worker and the database in its Frankfurt, Germany (EU) region.
• Anthropic (United States): the AI that reads your website and writes articles. It receives your business details and article drafts, never your password or payment details. Under Anthropic's commercial terms, data sent through its API is not used to train its models by default.
• Stripe (Stripe Technology Company Limited, Ireland, with processing by Stripe, LLC in the United States): payments and subscriptions.
• Resend (United States): sending emails. Resend stores email data in the United States.

Some of these providers process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, for providers certified under it) or the International Data Transfer Agreement or Addendum, as applicable.

How long we keep it

We keep your account and content while your account is open. From Settings you can download your account details, business details, articles and the messages you've sent us at any time. Other records we hold about you, such as security logs, are available on request: email support@getranka.com.

You can also delete your account in Settings. Your account, business details, articles, connection details, usage events, password reset links and contact messages are deleted straight away. Security log entries (which include your email address and IP addresses) are kept for 2 years, including a record of the deletion, so we can investigate abuse and establish or defend legal claims. Our database host's automatic backups roll off within 7 days, so deleted data is gone from them within 7 days.

• Invoices and payment records (held in Stripe): 6 years, to meet tax law.
• Usage events: 2 years.
• Security audit log: 2 years.
• Password reset links: deleted 7 days after they expire.
• Messages sent through our contact form: 2 years, or until you delete your account.
• Anti-abuse counters: deleted within about 40 days of their last use.
• Addresses that bounced or reported our emails as spam: kept so we don't email them again.

Cookies

We use two strictly necessary cookies: one keeps you signed in (for up to 30 days), and a short-lived one (10 minutes) remembers that your password was correct while you enter your two-step login code. We don't use advertising or analytics cookies, so there is no cookie banner. Stripe sets its own cookies on its checkout page to prevent fraud.

Your rights

You can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent where we rely on it. Email support@getranka.com and we'll respond within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Changes

If we make significant changes we'll tell account holders by email before they take effect.