Privacy Policy
Last updated: 3 November 2026
This Privacy Policy explains how The Ranking Factory ("we", "us", "our") collects, uses, stores, shares and deletes information when you use our website at therankingfactory.com and the services, tools and integrations we provide (together, the "Service"). The Ranking Factory is operated by The Ranking Store LLC, 395 SW Quail Heights Terrace, Lake City, FL 32025, United States.
By using the Service you agree to this Privacy Policy. If you do not agree, please do not use the Service.
Our principles
- We tell you why we collect information before or when we collect it.
- We use information only for the purposes we describe, or compatible ones, unless you agree otherwise or the law requires it.
- We keep information only as long as we need it for those purposes.
- We protect information with reasonable security safeguards, and we make this policy available to everyone.
- We do not sell personal data.
Information we collect
- Account details: your name, email address, company, and the password you choose (stored only as a one-way hash).
- Your projects: the websites, brands, topics, questions, writing voices and settings you enter, and the content we generate or publish for you.
- Data from services you connect: described service by service below.
- Billing information: your plan, licence and payment status, handled by our payment providers (see Payments).
- The free site check: the website address you check and the email address we send the access code to.
- Where you came from: when you ask for the free site check's report or open an account, we keep the tag on the link that brought you to our website in the previous 30 days (for example
?src=g2) or, if there was none, the name of the website that linked to us (never the page address), the page you first landed on, and the date. Until then it is held in your browser's local storage, not a cookie. We keep it with your report request or account and delete it with them. - Technical data: server logs of requests to the Service (for example time, address requested and response), used to keep the Service running and secure.
How we use information
- To provide the Service: measure how AI engines and search engines answer questions about your business, find gaps, write and publish content you approve or schedule, and report results.
- To keep the Service secure, prevent abuse, and fix problems.
- To send you service emails, such as access codes, reports, approvals waiting for you, and support replies.
- To handle billing and your subscription.
- To comply with the law.
We do not use your data, or data from your connected accounts, for advertising, and we do not use it to train AI models.
Connecting other services
The Ranking Factory works by connecting to services you already use. You choose which ones to connect. Each connection gives us only the access you approve on that service's own screen, and we use it only to provide the features you use in The Ranking Factory.
- We read only what the feature you are using needs.
- We store the credentials needed to keep the connection working, and the results the feature shows you. OAuth tokens, publishing passwords and keys, cloud storage keys and AI provider keys are stored encrypted. Access keys we issue to you are stored only as a one-way hash.
- We write to your account only where the feature exists to do so, such as publishing a post or uploading a video you asked for. Analytics and search-data connections are read-only.
- We never sell data from your connected accounts, use it for advertising, or use it to train AI models.
Disconnecting. You can disconnect any service on the Connections page or in your project's settings. Disconnecting deletes the stored credential or makes it unusable. Results we already collected, and records of what we published for you, stay in your account until you delete them or ask us to delete your account, except where a section below says otherwise.
Staff access. Our staff look at data from your connected accounts only when you ask us to help, when it is needed for security or to investigate abuse, or when the law requires it.
Ranking Factory Software Privacy Policy
Google User Data
The Ranking Factory software uses various Google APIs to provide its core functionalities. Specifically, Ranking Factory accesses the following Google user data:
- Blogger API:
Ranking Factory uses the Blogger API to allow users to create and manage blogs and blog posts directly within the application. This includes publishing new posts and editing existing content. - Google Business Profile API (Business.Manage):
Ranking Factory uses the Business.Manage API to manage Google Business Profile posts. This allows users to create, edit, and publish posts to their Google Business Profile, helping them manage their online presence. - Google Drive API:
Ranking Factory uses the Google Drive API to help users find file and folder information and upload files to Google Drive. This facilitates the organization and management of documents and media files directly through the application. - Google Photos Library API:
Ranking Factory uses the PhotosLibrary API to create and edit photo albums and to upload photos to Google Photos. This feature allows users to manage their visual content effectively. - Google Calendar API:
Ranking Factory uses the Google Calendar API to create and manage calendars and events. This allows users to schedule, organize, and modify their events within the application. - Google Slides API (Presentations):
Ranking Factory uses the Presentations API to create and edit slide presentations. Users can build and modify slideshows directly through the application, facilitating the creation of professional presentations. - YouTube Data API:
The Ranking Factory software uses an API Client that allows you to connect with your YouTube accounts using the YouTube API. Authorized access to the YouTube API for any of your accounts can be revoked by visiting the Google security settings page at https://security.google.com/settings/security/permissions
Use of Google User Data
- Blogger Data:
The data accessed via the Blogger API is used exclusively for creating, managing, and publishing blog posts. - Google Business Profile Data:
The data accessed via the Business.Manage API is used solely for managing Google Business Profile posts. - Google Drive Data:
The data accessed via the Google Drive API is used to locate and upload files and folders within the application. - Google Photos Library Data:
The data accessed via the PhotosLibrary API is used for managing photo albums and uploading photos. - Google Calendar Data:
The data accessed via the Google Calendar API is used for creating and managing calendars and events within the application. - Google Slides Data:
The data accessed via the Presentations API is used for creating and editing slide presentations.
Authorized access to the Google APIs for any of your accounts can be revoked by visiting the Google security settings page at https://security.google.com/settings/security/permissions
- We do not sell Google user data to third-parties.
- We do not transfers Google user data to third parties for reasons other than providing or improving your application’s functionality.
- We do not use Google user data for reasons other than providing or improving your application’s functionality.
We confirm that Google Workspace APIs are not used to develop, improve, or train generalized AI and/or ML models.
More about how we use Google and YouTube data
- YouTube. When you connect a Google account with a YouTube channel, we list the channels you can upload to so you can choose one, upload the videos The Ranking Factory makes for you to that channel with the visibility your settings choose, store each video's ID and link so we can show and embed it, and, where a feature you use asks for it, search YouTube for videos on a topic. We re-check each stored video on YouTube at least every 7 days and remove our record of any video YouTube no longer returns. We never delete videos from your channel.
- Deleting YouTube data. When you disconnect the Google account in The Ranking Factory, we delete our records of the videos uploaded through it at once. If you revoke our access in your Google security settings instead, we delete them within 30 days. If you ask us to delete your account, it is deleted 14 days after your request (you can undo it in that time), and our YouTube records with it. The videos stay on your channel.
- Google Search Console. With read-only access, we read the searches your verified sites appear for, and their impressions, clicks and pages, to show which questions you are found for, and Google's index status of pages we published for you. We never change your Search Console settings.
- Your Google name and email address. We read these to show which Google account is connected and to tell your connected accounts apart.
- Google Drive. We create Google Docs, Sheets, Slides and Sites in your Drive for the campaigns you run, make those files viewable by link where the campaign needs them to be public, update them, and move them to your Drive's bin if you withdraw them. We read files and folders only as these features need, such as the folders we file your campaign documents in.
- Limited Use. The Ranking Factory's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Cloudflare
To show which AI crawlers fetch your pages, you can give us read access to a Cloudflare zone by creating a Cloudflare API token limited to that zone, with Zone Analytics Read and Zone Read permissions, and pasting it into your project's settings.
What we read: once a day, the number of requests from known AI crawlers (such as GPTBot or ClaudeBot) to each page of your site, and whether your site answered them. We filter on the crawler's user agent, so requests from people are never read. We also read how far back your zone keeps data, and the date your site started being served by Cloudflare.
What we store: your token, encrypted, which no screen ever shows again; and, for each day, crawler and page, the number of requests and how many were served. We do not store IP addresses, user-agent strings, cookies or anything about your human visitors.
What we write: nothing, unless you switch on the Detailed crawler feed for a project. That press makes one Logpush job in your Cloudflare account, which sends us AI crawler visits. Switching it off removes the job. We never change your DNS, firewall, rules or cache. Each visit's IP address is used to check the crawler is who it says it is, and is then dropped.
Disconnecting. Clear the Zone ID in your project's settings and save; this deletes the stored token. You can also delete the token in Cloudflare under My Profile, API Tokens. Crawler counts already collected are deleted when you delete the project or your account, unless another project still covers the same site.
Signing in instead (Connect Cloudflare). You can sign in to Cloudflare from Connections, Cloudflare instead of pasting a token. Cloudflare asks which account to share and shows what we ask for: read your zones, read analytics, read logs, and, if you allow it, edit logs, which is used only for a crawler log feed you switch on yourself; nothing is set up without you. We store the sign-in encrypted and use it only for the reads described above. Disconnecting: press Disconnect under Connections, Cloudflare. We ask Cloudflare to withdraw our access, and you can choose to remove the crawler counts of the projects that read through it. You can also revoke us in Cloudflare under your profile, Manage OAuth authorizations.
Separately, if you use Cloudflare R2 storage as a publishing destination, we store its access keys encrypted and use them only to upload the files you publish there.
The Ranking Factory Crawlers plugin for WordPress
If you install our WordPress plugin, it records visits to your site from known AI crawlers, so we can show which crawlers read which pages, even where your site does not use Cloudflare.
What it records: only requests whose user agent matches our list of AI crawlers. For each one, the time, the crawler's user agent, the page path (without any query string), the response status, and the requesting IP address. It records nothing until your site administrator presses Connect, and it never records cookies or form data.
What it sends to us: those records every 15 minutes, with your site's address, the plugin version and the names of any page caches it found. It deletes each record from your site as soon as we have received it.
Files it fetches from us: if your project has llms.txt and llms-full.txt switched on and nothing else on your site answers those addresses, the plugin fetches them from us when someone asks for them. It does the same for the Markdown copy of a page we published for you. It sends your site's address and its key and, for a page, that page's path. It sends nothing about who asked. It keeps each copy on your site for up to 12 hours, and waits an hour after a failed fetch.
What we keep: we use the IP address only to check whether the request came from the crawler operator's published addresses, then discard it. We store the daily count of requests for each crawler and page, whether they were verified, and the first and last time seen. We do not store IP addresses or user-agent strings.
Your key: the plugin uses a key that can only send crawler records and fetch these files for your one site. We store it only as a one-way hash.
Disconnecting. In WordPress, choose Disconnect or delete the plugin; either way the plugin deletes its stored records and key from your site. In The Ranking Factory, revoke the key in your project's settings. Counts already collected are deleted when you delete the project or your account, unless another project still covers the same site.
Publishing to your website and channels
You can connect places where The Ranking Factory publishes for you: WordPress, Shopify, Wix, Ghost, a webhook to your own system, LinkedIn, Reddit, Blogger, YouTube, Google Business Profile, and cloud storage such as Amazon S3, Google Cloud Storage, Azure, Bunny or Cloudflare R2.
What we store: the address and credential you give us (for example a WordPress application password, a Shopify, Wix or Ghost admin key, a webhook secret, or an OAuth token), encrypted.
What we read: only what publishing needs, such as your WordPress user's publishing permission, categories and existing posts (to avoid duplicates and to update our own posts), your Shopify shop name and blogs, or your Wix and Ghost categories and tags.
What we write: the posts, pages, articles, images, videos and files you or your settings ask us to publish, and later updates to those same items. When "Review before publishing" is on, items wait for your approval; when it is off, they are published when they are ready. Webhook deliveries are signed so your system can check they came from us.
What we never do: we never delete your posts or pages, and never change content we did not publish.
Disconnecting. Remove the site or destination in The Ranking Factory; this deletes the stored credential. Content already published stays on your site. We recommend also revoking the password, key or token on that platform.
Search data and AI providers
Public pages about your business. To check facts for answer accuracy, we read public pages about your business, such as directory and review pages, respecting robots.txt. We keep what they say about the business and the day we read them.
Your own accounts. Some features run on accounts you hold with other providers, at your cost: DataForSEO (Google AI Overviews, AI Mode, and the ChatGPT and Gemini apps), Serper (search results), and AI providers such as OpenAI, Anthropic, Google Gemini, Groq, OpenRouter, xAI, Perplexity and DeepSeek. You give us the key or login, and we use it only for your account's features. These keys and logins are stored encrypted. Our own Serper account is used only when you have not added your own.
What we send. The keywords, questions and prompts we track for you; your brand and website text; your topics; and, where Search Console is connected, the searches your pages are shown for. We do not send your account details or payment information.
What we store. The questions asked, the answers returned, which sources each answer cited, whether your brand was named, and the content we generated for you.
The free site check. When someone runs our public site check, or before an account has added an AI key, we send questions about the website being checked to Google Gemini and Groq using our own accounts.
Their terms. Each provider handles the requests under its own terms and privacy policy. We do not use your data, or the answers, to train AI models.
Removing a key. Delete it in Settings. Answers already collected stay in your account until you delete it.
AI agents and API keys
You can let an AI agent such as Claude read your Ranking Factory data, using a key you create or by signing in from the agent. You choose what it can see (for example visibility, gaps, evidence or your entity profile) and whether it covers one project or all of them. An agent can make changes only if you separately allow it, and every change it makes is recorded.
We show a key once and store only a one-way hash of it. Sign-in tokens expire after one hour and renew for up to 30 days. You can revoke a key or sign-in at any time in Settings, under Agent access.
Payments
Payments are handled by PayKickstart, with cards processed by Stripe. Your card details go directly from your browser to the payment processor. We never receive or store your full card number or security code; we may keep the last four digits and expiry date to show which card is on file.
Cookies and device storage
The Ranking Factory does not use advertising cookies. On our public website pages, and never in the app you use after signing in, we use Microsoft Clarity to see how visitors use those pages. Clarity records how a page displays and how you interact with it, such as clicks, scrolling and mouse movement, and builds heatmaps and session replays from it. What you type into a form on our site is masked in your browser and never sent to Clarity, and numbers and email addresses on the page are masked too. We tell Clarity that you have not consented to cookies, so it sets no cookies and treats each page you view as a separate visit. Microsoft keeps replay data for 30 days and heatmap data for 9 months. Microsoft collects and uses this data as described in the Microsoft Privacy Statement. You can opt out of Clarity through the Digital Advertising Alliance's opt-out page (https://optout.aboutads.info/), by turning on Global Privacy Control in your browser, or by blocking clarity.ms.
- Analytics on our public pages. Microsoft Clarity, as described above. It does not run when you are signed in, on the sign-in pages, or anywhere in the app.
- Browser storage. When you sign in, the app keeps your sign-in token and a few preferences (such as your active project, panel layout and which features are switched on for you) in your browser's local storage on your device. Signing out removes your sign-in token. You can clear this storage in your browser settings at any time.
- Security cookies. Our website is delivered through Cloudflare, which may set strictly necessary cookies to protect the site from abuse.
- Third-party content. Embedded YouTube videos on our blog use YouTube's privacy-enhanced player and set no YouTube cookies until you press play. Checkout pages load our payment providers' scripts, which may set their own cookies under their policies. Our pages load fonts from Google Fonts, which receives your IP address to serve them.
Service providers
We use these providers to run the Service: our hosting provider; Cloudflare, for our own website's delivery and security; Microsoft Clarity, for analytics on our public website pages (Microsoft acts as a controller of that data under the Microsoft Privacy Statement); PayKickstart and Stripe, for payments; our email delivery provider, to send email; Google (Gemini) and Groq, for the free site check; and Serper, for search results when you have not added your own account. Other services process your data only when you connect them, as described above. Each provider may use your information only to provide its service to us.
We may also disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a sale or reorganization of our business, in which case this policy continues to apply to your information.
How long we keep data, and deleting it
We keep your account data, connection results and published-content records while your account is open. Credentials are deleted when you disconnect the service. If your subscription or trial ends, your account becomes read-only, so you can come back to it. An account left read-only for 12 months can be deleted with everything stored with it; we email the account owner at least 30 days before. Choosing a plan before then keeps it.
Email addresses entered in our free site check are deleted 12 months after they were entered, or sooner if you ask.
Support messages you send us from the app, our replies, and any screenshots you attach are kept for 12 months after the last message in the conversation and then deleted automatically.
To delete your account and everything stored with it, the account owner can choose Delete account in Settings, or email [email protected] from the account's email address. The account becomes read-only at once and is deleted 14 days later; you can undo the request in that time by signing in. When it is deleted we also withdraw the access you gave us at Google, Cloudflare and WordPress where those services let us. Content we published to your own sites and accounts stays there, because it belongs to you. We may keep limited records where the law requires it, such as invoices.
Security
We protect your information with encryption of stored credentials, hashed passwords and access keys, encrypted connections (HTTPS), and access controls on our systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and will tell you about a breach affecting it as the law requires.
Your rights and choices
- You can see and update most of your information in the app.
- You can ask us for a copy of your personal data, to correct it, or to delete it, by emailing [email protected]. We will answer within 30 days.
- You can disconnect any connected service, and revoke our access on that service's own security page, at any time.
- Depending on where you live (for example California, or the European Economic Area and the United Kingdom), you may have further rights, such as objecting to or restricting processing, or complaining to your data protection authority. We do not sell or share personal information for cross-context behavioral advertising.
Children
The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.
International users
The Ranking Factory is a US business, and we store and process information in the United States. Connected services and providers may process information in other countries under their own policies. By using the Service, you understand that your information is processed in the United States.
Changes to this policy
We may update this policy as the Service changes. We will change the "Last updated" date above, and tell you by email or in the app before a material change takes effect.
Contact
Questions about privacy, or a request to access or delete your data? Email [email protected], or write to The Ranking Factory, The Ranking Store LLC, 395 SW Quail Heights Terrace, Lake City, FL 32025, United States.