Legal
Privacy policy
What we collect, why, who else sees it, and how to make us delete it.
Last updated 7 September 2026
The short version
- We collect what we need to run your account and nothing for resale.
- We never sell your data and never train models on your projects.
- Analytics record what was clicked, not what was typed.
- Ask us to delete your account and we delete it.
What we collect
| Data | Why |
|---|---|
| Email address, name, profile image | To sign you in and address you correctly |
| Organisation, projects, keywords, tags, trackers | They are the service |
| Credit ledger and subscription state | Billing, and so you can audit what you were charged |
| Server logs with a request id, organisation id and user id | Diagnosing failures; retained 30 days |
| Product analytics events | Working out which parts of the product are confusing |
What we deliberately do not collect
Analytics events never carry keyword phrases, project domains or email addresses. Session replay, where enabled, masks every input and all text content. The keyword you researched is your business intelligence, and it stays in your account rather than in an analytics product.
We do not process card details. Payment happens on Polar’s systems, not ours.
Google Search Console
If you connect Google Search Console, we request read-only access (the webmasters.readonly scope) to the properties you choose. We use it only to show your clicks, impressions, queries and pages inside Nextrank and to surface quick-win keyword opportunities. We never request write access, never modify your Search Console settings, and never share this data with DataForSEO, PostHog or any other third party listed below. You can disconnect at any time from your project settings, which revokes our access immediately.
Who else sees it
- DataForSEO — receives the keyword and market of each query in order to answer it. It does not receive your identity or your account.
- Polar — merchant of record; holds your billing details and issues receipts.
- Resend — sends transactional email such as sign-in links and rank reports.
- PostHog — product analytics and error tracking.
- Our hosting provider — runs the servers and the database.
That is the whole list. Nobody else, and no advertising networks.
Cookies
A session cookie so you stay signed in, a preference cookie for light or dark mode, and a first-party analytics cookie shared between this site and the app so a visit and a signup are recognisably the same person. No third-party advertising cookies, which is why there is no consent wall in your way.
How long we keep things
- Account and project data: until you delete it or close the account
- Ranking history: 30 days to forever, depending on your plan
- Credit ledger: seven years, because it is a financial record
- Server logs: 30 days
Your rights
You can export your data from the product at any time. Email support@trynextrank.com to request access, correction, deletion or a machine-readable copy, and we will act within 30 days. If you are in the UK or EU you also have the right to complain to your data protection authority.
Security
Everything travels over TLS. The database is encrypted at rest and backed up nightly to separate storage. The application runs with a restricted database role that cannot rewrite the credit ledger. Access to production is limited to the people who need it.
Contact
support@trynextrank.com — or read the terms of service.