Privacy policy.

1. Data controller

The controller of the data collected on rankfeed.io is TheGoodSeat SAS, registered with the Paris Trade and Companies Register under number 104 204 532, with its registered office at 47 rue Vivienne, 75002 Paris, France.

For any question relating to your personal data, you can contact our privacy officer at privacy@rankfeed.io.

2. Personal data collected

We collect only the data strictly necessary to provide the Rankfeed service. The categories of data concerned are as follows:

• Identification data: last name, first name, professional email address.
• Account data: user identifier, password (encrypted), language preferences.
• Billing data: company name, billing address, intra-EU VAT number, billing history (credit card data is collected and stored exclusively by Stripe, certified PCI-DSS level 1).
• Project data: URL of the analyzed site, tracked keywords, selected AI models, tracked languages.
• Technical data: IP address, browser type, operating system, pages viewed, access logs.
• Communication data: content of messages sent via the contact form.

3. Purposes and legal bases

Your data is processed for the following purposes, on the legal bases indicated:

• Provision of the Rankfeed service (account creation, contract performance) — legal basis: contract performance (art. 6.1.b GDPR).
• Billing and accounting management — legal basis: legal obligation (art. 6.1.c GDPR).
• Customer support and communication — legal basis: legitimate interest (art. 6.1.f GDPR).
• Audience measurement and product improvement — legal basis: legitimate interest, after consent for tools that are not strictly necessary (art. 6.1.f and 6.1.a GDPR).
• Fraud prevention and service security — legal basis: legitimate interest (art. 6.1.f GDPR).
• Marketing communications (newsletter, product news) — legal basis: consent, revocable at any time (art. 6.1.a GDPR).

4. Retention period

We keep your data for the period strictly necessary for the purposes for which it was collected:

• Account data: for the entire duration of the subscription, then 3 years from the last activity (commercial prospecting, art. 6 LCEN).
• Billing data and accounting records: 10 years from the close of the financial year (art. L.123-22 of the French Commercial Code).
• Access logs and technical data: 12 months maximum (CNIL recommendation and LCEN obligations).
• Prospecting data: 3 years from the last inbound contact.
• Cookies and trackers: 13 months maximum (CNIL recommendation).

5. Recipients and subprocessors

Your data is never sold to third parties. It is only accessible to our authorized staff and to our subprocessors bound by a processing agreement (art. 28 GDPR):

• Vercel Inc. (United States) — application hosting. Transfer framed by the European Commission's Standard Contractual Clauses (SCC).
• Supabase Inc. (Singapore, data stored in the EU) — database, authentication, file storage.
• Stripe Payments Europe Ltd. (Ireland) — payment processing and billing.
• OpenAI, Anthropic, xAI, DeepSeek, Google — AI model providers queried on behalf of the user. No personal user data is shared with these providers beyond the queries necessary for the service.
• Resend Inc. (United States) — sending of transactional emails. Transfer framed by the SCCs.
• PostHog Inc. (United Kingdom) — product audience measurement (EU instance).

6. Transfers outside the European Union

Some of our subprocessors are established outside the European Union. Any transfer is framed by the Standard Contractual Clauses adopted by the European Commission (decision 2021/914) or by an equivalent mechanism guaranteeing an adequate level of protection.

The up-to-date list of our subprocessors and their guarantees is available on request at privacy@rankfeed.io.

7. Your rights

In accordance with articles 15 to 22 of the GDPR, you have the following rights over your personal data:

• Right of access to and a copy of your data.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten").
• Right to restriction of processing.
• Right to portability of your data in a structured, machine-readable format.
• Right to object to processing, in particular for prospecting purposes.
• Right to withdraw your consent at any time, without affecting the lawfulness of prior processing.
• Right to set directives regarding the fate of your data after your death.

You can exercise these rights at any time by writing to privacy@rankfeed.io. We will respond within a maximum of one month.

You also have the right to lodge a complaint with the French Data Protection Authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris CEDEX 07 (www.cnil.fr).

8. Security

We implement appropriate technical and organizational measures to protect your data against any unauthorized access, loss, alteration or disclosure: TLS encryption in transit, encryption at rest, strict access control, logging, regular audits.

In the event of a data breach likely to create a risk to your rights and freedoms, we undertake to notify the CNIL within 72 hours and, if necessary, to inform you as soon as possible.

9. Policy changes

This privacy policy may be updated to reflect changes in our services or regulations. The date of the last update appears at the top of this page. In the event of a substantial change, you will be informed by email or via the dashboard.