Skip to content

Privacy Policy

This privacy policy explains how Klarplan AG (operating as “RankScan”) processes personal data collected when you visit our website, contact us, or use our services. We comply with the Swiss Federal Act on Data Protection (revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Data Controller #

The controller responsible for data processing is:

Klarplan AG (RankScan)
Sälihalde 11
6005 Lucerne
Switzerland
Email: hello@rankscan.ai
Phone: +41 41 511 29 43

For any privacy-related enquiries, please contact us at hello@rankscan.ai.

2. Scope #

This policy applies to our website and to the RankScan platform accessible via a user account. External websites we link to are the sole responsibility of their respective operators.

Processing on behalf of customers. For data you have processed in RankScan, for example the content of your website, data from your Search Console or the management of your team, you are the controller and we are the processor. Our Data Processing Agreement (DPA) with the Standard Contractual Clauses of the European Commission (Implementing Decision (EU) 2021/915) applies to this. Annex II of the DPA defines which operations this covers. For user accounts, login, billing, usage analytics and our own emails, we are the controller ourselves. This Privacy Policy applies to those.

3. What Data We Process #

Server log data. When you visit our website, technical data sent by your browser is automatically recorded: IP address, date and time of access, pages visited, volume of data transferred, referrer URL, and information about your browser and operating system. This data is required for the secure and stable operation of the site. All requests to our website, to Mautic (m.rankscan.ai) and to the RankScan platform pass through the Cloudflare network. Cloudflare protects them against attacks and automated abuse and collects the same data for this purpose.

Contact and form data. When you submit a form or contact us by email, we process the information you provide (e.g. name, email address, message) in order to handle your request.

Account and usage data. To use the RankScan platform, we process account and contract data (e.g. name, email address, organisation, chosen subscription, payment status) as well as the configuration data you enter (e.g. monitored domains, keywords, competitors, prompts).

Processed measurement and content data. To deliver our service, we retrieve and analyse publicly accessible content of the websites you specify (e.g. page content, HTML structure, metadata, technical metrics, search and AI visibility).

Referral by partners. Partners, such as agencies, recommend RankScan and receive a commission for it. When you open a partner link in the app, the app keeps the partner's code in your existing session until you register. When you open a partner link on our website, we store the partner's code in the cookie «rankscan_ref». We only set this cookie if you have consented to «Marketing» in the cookie banner. The cookie applies to all addresses under rankscan.ai, including the app, and expires after 60 days. If you open another partner link during this time, its code replaces the earlier one. If you withdraw your consent, we delete the cookie. When you register, we store with your customer account which partner referred you. If a partner referred you in another way, we assign your customer account manually.

We calculate the partner's commission from your paid invoices. For the settlement, the partner receives a monthly report. The report shows the name of your customer account, the plan, the date and net amount of each payment and each refund, and the resulting commission. The partner does not receive any other data, such as email addresses, billing addresses or data from your projects. Partners have no access to RankScan. We process this data to settle accounts correctly with our partners. This is our legitimate interest (revFADP; Art. 6(1)(f) GDPR where the GDPR applies). We keep the assignment as long as your customer account exists. We need the settlement records for our accounting and keep them as required by law (Art. 6(1)(c) GDPR). If you delete your customer account, we remove all names from these records.

We process personal data for the following purposes: providing and securing the website, handling enquiries, delivering and billing our services, communication, and safeguarding our legitimate business interests (e.g. product improvement and abuse prevention).

Where the GDPR applies, we rely on contract performance (Art. 6(1)(b)), consent (Art. 6(1)(a)), our legitimate interests (Art. 6(1)(f)), and legal obligations (Art. 6(1)(c)). Under the revFADP, we process data lawfully, in good faith, and proportionately.

5. Cookies and Similar Technologies #

Our website uses technically necessary cookies required for operation and security (e.g. session cookies set by the content management system). No consent is required for these. Optional cookies for web analytics and advertising are set only after you have agreed to them in the cookie banner. The RankScan application adopts the choice you made in the cookie banner of the website. Without your consent, it sets no analytics or advertising cookies. Section 6 describes these services, section 9 our own usage analytics in the application.

6. Web Analytics and Advertising on the Website #

On our website (rankscan.ai) we use Google Tag Manager to load analytics and advertising services. These services run only after you have agreed to them in the cookie banner. Until then, no analytics or advertising cookies are set.

In the RankScan application. The application (app.rankscan.ai) also loads Google Tag Manager. It shows no cookie banner of its own; it reads your choice from the cookie rankscan_consent that the website sets. With your consent to the category "Analytics", the application reports to Google Analytics 4 that you have registered or taken out a subscription. For a subscription, it transmits the subscription identifier, the plan, the billing interval and the amount excluding VAT. It does not transmit names, email addresses or the content of your projects to Google Analytics 4. With your consent to the category "Marketing", it transmits your email address as a hash value to Google Ads when you register and when you take out a subscription (see "Conversion measurement by Google Ads"). Without your consent, all analytics and advertising signals stay denied. You withdraw your consent via "Cookie settings" in the footer of the website; the application adopts the new choice the next time it loads.

Google Analytics 4. With your consent to the category "Analytics", we use Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). It records which pages you visit, where you came from and which links to the RankScan application you click. Google Analytics sets cookies with the prefix _ga that are valid for up to two years. IP addresses are shortened before storage. We use this information to understand how the website is used and to improve it.

Marketing automation (Mautic). With your consent to the category "Marketing", we use the open-source software Mautic, which we operate ourselves on our servers (m.rankscan.ai). Mautic records which pages of the website you visit and sets the cookies mtc_id and mtc_sid. If you start a free trial or open a link in one of our emails, Mautic links these visits to your email address. We use this to tailor our emails during the trial period to your interests. Mautic itself does not transfer any data to third parties. As with the website, traffic with m.rankscan.ai passes through Cloudflare (section 7).

Conversion measurement by Google Ads. With your consent to the category "Marketing", we use conversion measurement by Google Ads (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) on our website and in our app. It records whether a visit after a click on one of our ads on Google led to a registration or a subscription. For a subscription, it also transmits the amount. So that Google can match the measurement to a Google account, we use "enhanced conversions": when you register and when you take out a subscription, the app transmits the email address you use to sign in to RankScan. The app converts it into a hash value (SHA-256) on our server and sends it to Google only as a hash value. We do not transmit any other addresses, such as a billing address, addresses of team members or data from your projects. Google Ads sets the cookies _gcl_au and _gcl_aw. We use this information to measure the success of our advertising.

Conversion measurement by OpenAI (ChatGPT Ads). With your consent to the category "Marketing", we use the pixel of OpenAI (OpenAI OpCo, LLC, USA) on our website and in our app. The pixel records whether a visit after a click on one of our ads in ChatGPT led to a registration, a confirmed email address or a subscription. For a subscription, it also transmits the amount. So that OpenAI can match the measurement to a ChatGPT account, the pixel reads your email address, phone number and name where they appear on the page. It converts them into a hash value (SHA-256) in your browser and sends this information to OpenAI only as a hash value. The pixel sets the cookies __oppref, __obref and __oaiq_consent. We use this information to measure the success of our advertising.

Conversion measurement by Meta. We also run ads on Facebook and Instagram. With your consent to the category "Marketing", we may use conversion measurement by Meta (Meta Platforms Ireland Ltd.) for these ads. It records whether a visit after a click on one of our ads led to a registration or a subscription. Before we activate it, we will describe here which data it transmits and which cookies it sets.

Transfer to third countries. Google, Meta and OpenAI may process data in the USA. Google and Meta are certified under the Data Privacy Framework for Switzerland and the EU. For the transfer to OpenAI, we rely on the standard contractual clauses of the European Commission, as recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Legal basis. We process this data on the basis of your consent (revFADP; Art. 6(1)(a) GDPR where the GDPR applies).

Withdrawal. You can change or withdraw your choice at any time via "Cookie settings" in the footer of the website. Withdrawal does not affect the lawfulness of processing before the withdrawal.

YouTube videos. Our home page shows a product video that is hosted on YouTube (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). Until you click "Play video", the page shows only a preview image from our own server and sends no request to YouTube. When you click, your browser loads the YouTube player from youtube-nocookie.com. YouTube then receives your IP address, the page you came from and technical data about your browser, and may store information on your device. Google may process this data in the USA. Google is certified under the Data Privacy Framework for Switzerland and the EU. We load the player only because you start the video (revFADP; Art. 6(1)(a) GDPR where the GDPR applies). If you do not want this, do not start the video. You can also watch it directly on YouTube.

7. Third-Party Providers and Processors #

We use carefully selected service providers that process data on our behalf:

  • Amazon Web Services – Simple Email Service (Amazon). Used to send emails (e.g. notifications, transactional messages). Processing takes place in the EU region (Frankfurt, eu-central-1).
  • Hosting / content management. Our website and form submissions are stored with our hosting provider. We operate the RankScan platform (application and database) with Amazon Web Services in the EU region (Frankfurt, eu-central-1).
  • Cloudflare (Cloudflare, Inc., USA). Cloudflare forwards all requests to the website, Mautic and the platform to our server and protects them against overload and attacks (reverse proxy, DDoS protection, web application firewall). The encrypted connection terminates at Cloudflare and is re-encrypted from there to our server. For this purpose, Cloudflare processes the IP address, browser information, pages requested and the content transmitted, in the data centre closest to you, including outside the EEA and Switzerland. We do not use Cloudflare for advertising or analytics.
  • Stripe (Stripe, Inc. / Stripe Payments Europe). Used for processing payments of paid platform subscriptions.
  • External platform interfaces. For the analyses, we access third-party services: Google (Search Console, Google Analytics 4, see section 8; Chrome UX Report; Gemini), DataForSEO and Serper (search results), and the AI providers OpenAI, Anthropic, Perplexity and Groq. We query Microsoft Copilot through the service cloro. As a rule, we only transmit the query data you configure (e.g. domains, keywords, prompts) and no special categories of personal data. The providers that process personal data on your behalf in doing so are listed with their registered office and the basis for the transfer on the Sub-processors page.

8. Google User Data #

This section explains how RankScan handles data that we receive through Google APIs. It applies in addition to the other sections of this policy.

Google Search Console (scope https://www.googleapis.com/auth/webmasters.readonly). You can connect a RankScan property to your Google Search Console. To do so, you sign in with Google and grant RankScan read-only access. RankScan reads the list of your Search Console properties to find the one that matches your website. For that property, RankScan reads clicks, impressions, click-through rate and average position per page and day, the top search queries per page, and URL inspection results (e.g. indexing status, canonical URL, last crawl). RankScan never changes anything in your Search Console.

Purpose. We use this data only to provide features to you inside RankScan: search performance reports for your pages, recommendations for pages with optimisation potential, and the selection of pages for the Website Health scan. For the automatically generated summary of your property, individual page metrics (page URL, clicks, impressions, click-through rate, position) may be sent to an AI provider (OpenAI or Anthropic). We send them only to create this summary for you. The providers process the data as our processors via their API and do not use it to train their models.

Storage. We store the access token and refresh token in encrypted form in the RankScan platform database, one per connected property. We store the retrieved metrics in the same database, which runs at our hosting provider Amazon Web Services. When you connect, we retrieve the last 90 days. After that, we update the data daily. We overwrite the search queries per page and the URL inspection results with each update and keep no history of them.

Retention and deletion. When you disconnect Google Search Console in RankScan, we delete the stored tokens immediately and stop retrieving data. Metrics already retrieved remain visible in your property until you delete the property or your account. When you delete a property or your account, we permanently delete the tokens and all Search Console data of that property without a waiting period. You can ask us at any time to delete this data earlier by writing to hello@rankscan.ai. You can also revoke RankScan's access in your Google account at myaccount.google.com/permissions.

Google Analytics 4 (scope https://www.googleapis.com/auth/analytics.readonly). You can connect Google Analytics 4 to RankScan. We then read only totals: sessions, page views, visit duration and the number of events you choose, per landing page, day and source, for example ChatGPT or Perplexity. We do not read data of individual visitors and do not change anything in your account. We store the totals for at most 365 days. When you disconnect Google Analytics 4, we delete the totals and the access immediately and end RankScan's access at Google. We do not pass these figures on to providers of language models.

Looker Studio connector (scope https://www.googleapis.com/auth/script.external_request). The RankScan connector for Looker Studio runs as a Google Apps Script in your Google account. This permission only allows it to send requests to the RankScan API. The connector authenticates with your RankScan API key, which Google stores in the script's user properties in your Google account. The connector does not read any Google user data and sends none to RankScan. It only loads your RankScan data into your Looker Studio reports. When you reset the connector's authentication, it deletes the stored key. You can revoke the API key in RankScan at any time.

No sale, no advertising, no AI training. We do not sell Google user data. We do not share it with third parties, except with the processors named above where this is necessary for the feature, or where the law requires it. We do not use Google user data for advertising, for credit assessments or to train AI models, neither our own nor third-party models. Our staff only read this data with your consent, to fix errors or for security reasons, or where the law requires it.

RankScan's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. Usage Analytics in the RankScan Application #

When you are logged in to the RankScan application, we record how you use the application. This lets us see which features are helpful and where problems occur. We use these insights to improve RankScan and to fix errors.

Data we record.

  • which pages of the application you open,
  • which functions you use, for example starting a scan or marking an action as done,
  • whether an action succeeded; for invalid form entries, only the name of the affected field,
  • technical errors of the application that occur in your browser,
  • repeated clicks on the same element that indicate a usability problem,
  • the size class of your screen (smartphone, tablet, desktop) and the version of the application.

We link this information to your user account, your customer account and, where applicable, the website concerned.

What we do not record. We do not store any content you enter, any form values or any button texts. We do not use third-party cookies for this, and we do not share the data with third parties. No usage analytics takes place on the login page and on the password pages.

Registration. On the registration page, we record anonymously that the page was opened and whether the registration succeeded. For invalid entries, we store only the name of the field, never the entry itself. We do not store your IP address in this process. After a successful registration, the paragraphs above apply to your new user account.

Storage location and retention. The data is stored in the RankScan database, on the same servers as your other data. We delete it automatically after 12 months. When you delete your user account or your customer account, we delete the related usage data at the same time.

Who has access. Only a few employees of Klarplan AG with administrator rights see the evaluations. The evaluations show aggregated counts, no names and no email addresses.

Legal basis. We process this data to improve our product and to ensure error-free operation. For persons in Switzerland, we rely on the Swiss Federal Act on Data Protection (revFADP). Where the GDPR applies, we rely on our legitimate interest under Art. 6(1)(f) GDPR.

Your rights. You can object to usage analytics at any time. To do so, write to hello@rankscan.ai. We then exclude your user account from recording. Your other rights (access, rectification, erasure) are described in section 14.

10. Support Requests #

When you write to us via the support page of the application, we store the subject, message, attached screenshots, the website concerned and the page of the application you are writing from. We link the request to your user account and your customer account. All members of your customer account can see the requests of this account.

To classify requests faster, a language model from OpenAI suggests a category, an urgency and a draft reply. For this, OpenAI receives the subject, message, website, page, plan and language, but no screenshots. The model never replies on its own: a RankScan employee reviews and sends every reply. OpenAI processes the data as a processor, see section 11.

We keep requests and screenshots until you delete your customer account. At your request, we delete an individual request earlier.

The legal basis is the performance of the contract with you. Where the GDPR applies: Art. 6(1)(b) GDPR.

11. Disclosure Abroad #

We process your data in Switzerland and in the EU. According to the decision of the European Commission, Switzerland provides an adequate level of data protection.

Some service providers also process data outside Switzerland and the EEA, in particular in the United States. For these transfers, depending on the service provider, we rely on its certification under the EU-U.S. and the Swiss-U.S. Data Privacy Framework or on the standard contractual clauses of the European Commission. For web analytics and advertising on the website, section 6 states the basis. For the service providers that process personal data of our customers, it is stated on the Sub-processors page.

12. Retention #

We retain personal data only for as long as necessary for the stated purposes or as required by statutory retention obligations. Thereafter, the data is deleted or anonymised. Account and project data is generally retained for the duration of the contractual relationship. We keep support requests and screenshots until you delete your customer account. We keep totals from Google Analytics 4 for at most 365 days.

13. Data Security #

We take appropriate technical and organisational measures to protect your data against loss, misuse, and unauthorised access, for example through encrypted transmission (TLS) and access restrictions.

14. Your Rights #

Subject to applicable law, you have the right to access, rectify, erase, and restrict the processing of your data. Where the GDPR applies, you also have the right to data portability, the right to object to processing, and the right to withdraw any consent given at any time with effect for the future.

To exercise your rights, simply send a message to hello@rankscan.ai.

15. Right to Lodge a Complaint #

You have the right to lodge a complaint with a data protection supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC); in the EU, it is the supervisory authority responsible for you.

16. Automated Decision-Making #

We do not engage in automated decision-making that produces legal effects concerning you.

17. Changes to This Privacy Policy #

We may amend this privacy policy at any time. The version published on this page at any given time applies.

Last updated: 4 November 2026