Privacy Policy
Last updated: 16 October 2026
1. Who We Are
ShiftRanks ("we", "us", "our") is an AI-powered local SEO automation platform operated by ShiftRanks Ltd. Our registered contact email is info@shiftranks.com. This Privacy Policy explains how we collect, use, and protect information when you use our platform at shiftranks.com (the "Service").
2. Information We Collect
2.1 Account Information
When you register, we collect your email address, username, and a hashed password. If you sign in with Google, we receive only your Google account email address (your username is taken from it); we do not receive your name or profile picture, and we never receive or store your Google password.
2.2 Client & Business Data
You may enter business information for clients you manage, including business name, address, phone number, website URL, and industry. This data is stored securely and used solely to provide the SEO tools you request.
2.3 Third-Party Platform Tokens
When you connect third-party accounts (Google Analytics, Google Search Console, Google Business Profile, Facebook, Instagram, LinkedIn), we store the access and refresh tokens encrypted at rest with Fernet authenticated encryption (AES-128-CBC with HMAC-SHA256). These tokens are used only to perform the actions you explicitly authorise within the platform. What we do with Google data in particular is set out in section 4a.
2.4 WhatsApp & Telegram Messaging Data
ShiftRanks lets you manage your account by sending WhatsApp or Telegram messages to our business number/bot. When you do, we receive and store: your phone number or messenger ID, the text, voice notes, or photos you send us, and any AI-generated content or confirmation messages we send back. This data is used solely to carry out the action you requested (generating and publishing content, running a scan, answering a question) and to maintain a record of what was posted on your behalf. Voice notes are transcribed to text for processing and are not retained as audio after transcription. We do not use your messaging data for advertising or share it with anyone other than the AI/processing providers listed in Section 4.
2.5 Usage & Log Data
We collect structured logs of feature usage (audit runs, content generation, scan triggers) for debugging and service improvement. Logs do not include passwords or payment card numbers.
2.6 Payment Information
Payments are processed by Stripe. We do not store card numbers on our servers. Stripe's privacy policy applies to payment data: stripe.com/privacy.
3. How We Use Your Information
| Purpose | Lawful Basis (UK GDPR Art. 6) |
|---|---|
| Provide the Service (AI content, SEO audits, rank tracking, social posting) | Contract performance (Art. 6(1)(b)) |
| Authenticate your account and maintain session security | Contract performance (Art. 6(1)(b)) |
| Send transactional emails (verification, password reset, billing receipts) | Contract performance (Art. 6(1)(b)) |
| Process billing and manage subscriptions via Stripe | Contract performance (Art. 6(1)(b)); Legal obligation (Art. 6(1)(c)) |
| Call third-party APIs on your behalf (DataForSEO, OpenAI, GBP, Meta, LinkedIn) | Contract performance (Art. 6(1)(b)) |
| Debug issues and improve service reliability (structured logs) | Legitimate interests (Art. 6(1)(f)), ensuring service quality |
| Send marketing communications and newsletters | Consent (Art. 6(1)(a)), opt-in only; withdraw any time |
| Record cookie consent events for compliance audit | Legal obligation (Art. 6(1)(c)), GDPR Art. 7 accountability |
4. Third-Party Services We Use
The Service integrates with the following third parties to provide functionality:
| Service | Purpose | Data Shared |
|---|---|---|
| OpenAI | AI content generation | Business name, industry, city, content prompts |
| DataForSEO | Keyword rank tracking, backlink analysis, brand mentions | Domain names, search keywords |
| Google (sign-in, Analytics, Search Console, Business Profile) | Sign-in; reading your Google Analytics and Search Console reports; Google Business Profile Optimization (see section 4a) | Google account email; the property, site or location you select |
| Meta (Facebook/Instagram) | Social media posting | Page access tokens; post content you approve |
| WhatsApp Business Platform (Meta) | Sending and receiving your commands, confirmations, and approval requests | Your phone number; message text, voice, and image content |
| Telegram | Sending and receiving your commands, confirmations, and approval requests | Your Telegram chat ID; message text, voice, and image content |
| Professional network posting | Organisation ID; post content you approve | |
| Stripe | Payment processing | Email address; billing address |
| Webflow | CMS content publishing | API token; generated content |
| Mailchimp (Intuit Inc.) | Email marketing and subscriber management | Email address; marketing consent status |
4a. Google User Data
When you connect a Google account to Shift Ranks, we request access only to the data needed for the feature you are connecting, and we ask Google for exactly these permissions: your email address (so we can show which account is connected), Google Analytics read-only (analytics.readonly), Google Search Console read-only (webmasters.readonly) and, for the Business Profile features, Google Business Profile (business.manage). Each permission is requested only when you click that product's connect button, never all at once.
- Google Analytics (read-only): we list the GA4 properties and web data streams your Google account can see so you can choose the right property and we can find its Measurement ID. For the property you choose, we read its Google Analytics reports for the last 30 days: sessions, users, page views, bounce rate and average session duration; sessions, users and page views per day; your ten most-viewed pages; and your sessions by traffic channel. We display this data on that client's GA4 Setup & Conversion Tracking page in your Shift Ranks SEO dashboard. We read it live each time you open the page and do not store the report data. If you type a Property ID by hand, we check it against the properties of the connected account before saving it.
- Google Search Console (read-only): for the site you select, we read search performance for the last 28 days: clicks, impressions, click-through rate and average position, in total and per day, plus your top queries and top pages, and we display it on the client page and the GA4 page of your dashboard. We also use up to three of those top queries as seed terms for the AI keyword suggestions behind your content briefs and content pipeline, and we use the URL Inspection API to check whether the pages found by your website audit are indexed; those index results are kept with the audit as technical issues.
- Google Business Profile: the Business Profile connection is not yet available in Shift Ranks (it says "coming soon"). Once it is, we will read your Business Profile accounts, locations, attributes, media and reviews, publish the Business Profile posts you approve and the review replies you ask for, and read a post's status back from Google, only as part of the features you use.
How we use it: Google user data is used only to provide and improve the features you see in Shift Ranks. We do not sell Google user data, use it for advertising, or share it with third parties except as needed to provide the service (the Search Console query terms used as keyword seeds are included in the prompt sent to our AI provider, OpenAI, for that feature) or as required by law. We do not use Google user data to develop, improve or train generalised AI or machine-learning models. Shift Ranks staff can view the same dashboards you see; they do so only to provide support, to investigate security or abuse, or where the law requires it.
How we protect it: access and refresh tokens are encrypted at rest with Fernet authenticated encryption (AES-128-CBC with HMAC-SHA256) and stored on our servers; they are used only to call Google's APIs over TLS and are never written to logs or shared with anyone.
Disconnecting and deletion: you can disconnect Google Analytics or Google Search Console at any time from the Integrations page in Shift Ranks or from that client's GA4 page. Disconnecting removes the property or site you selected and, when no other Shift Ranks feature of that client still uses the same Google sign-in, revokes our access at Google and deletes the stored tokens. Analytics and Search Console share one Google sign-in per client: if you disconnect one while the other is still connected, the page tells you that access is kept for the other, and "Disconnect Google" on the Integrations page removes both at once. Disconnecting Google Business Profile revokes our access at Google and deletes its tokens; location records already imported stay with the client until you delete the client. Analytics and Search Console report data is not stored, so nothing of it remains once the tokens are deleted. You can also remove Shift Ranks from your Google Account at myaccount.google.com/permissions; Shift Ranks then asks you to reconnect the next time it needs the data. To request deletion of any Google data we hold, email shiftranks@gmail.com or info@shiftranks.com.
Shift Ranks' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. Data Retention
We retain your account data for as long as your account is active. If you delete your account, all associated data (clients, content, scan results, tokens) is permanently deleted within 30 days. You may request deletion at any time by emailing info@shiftranks.com.
6. Data Security
We implement the following security measures:
- All passwords hashed with scrypt (never stored in plaintext)
- OAuth tokens and API keys encrypted at rest with Fernet authenticated encryption (AES-128-CBC with HMAC-SHA256)
- All data in transit encrypted via TLS/HTTPS
- CSRF protection on all state-changing forms
- Parameterised database queries (no SQL injection risk)
- Session tokens are server-side and rotated on login
7. Your Rights (UK GDPR)
If you are located in the UK or European Economic Area, you have the right to:
- Access, request a copy of the personal data we hold about you
- Rectification, ask us to correct inaccurate data
- Erasure, request deletion of your data ("right to be forgotten")
- Portability, receive your data in a machine-readable format
- Objection, object to processing based on legitimate interests
- Restriction, request we restrict processing while a dispute is resolved
To exercise any of these rights, email info@shiftranks.com or use our Data Deletion page. We will respond within 30 days.
8. Cookies & Similar Technologies
We use cookies and browser-side storage (localStorage) in three categories. Your consent is obtained via a banner before any non-essential cookies are activated. You may review or change your preferences at any time using the "Cookie Settings" link in the footer. For a full list of every cookie, its purpose, and expiry see our Cookie Policy.
- Strictly Necessary, session management, CSRF protection, Stripe security. Cannot be disabled.
- Functional, remembers your display preferences and onboarding progress. Requires your consent.
- Marketing, anonymous session key used for campaign analytics; Mailchimp subscriber tagging (only for logged-in users who consented to marketing). Requires your explicit consent.
8a. International Data Transfers
ShiftRanks is operated from the United Kingdom. Some of our third-party sub-processors are based in the United States (OpenAI, Stripe, Mailchimp, DataForSEO). Transfers of personal data outside the UK/EEA are made under appropriate safeguards including:
- UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs) where applicable
- Adequacy decisions where the destination country is deemed to provide equivalent protection
You may request a copy of the transfer mechanism in place for any specific processor by emailing info@shiftranks.com.
8b. California Residents (CCPA / CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to Know, request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months
- Right to Delete, request deletion of your personal information, subject to certain exceptions
- Right to Correct, request correction of inaccurate personal information
- Right to Opt-Out of Sale/Sharing, we do not sell your personal information to third parties. Sharing email addresses with Mailchimp for marketing is done only with your explicit consent and you may opt out at any time
- Right to Non-Discrimination, we will not discriminate against you for exercising any CCPA rights
To exercise your California rights, email info@shiftranks.com with subject line "CCPA Request". We will respond within 45 days.
9. Children's Privacy
The Service is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have collected data from a child, contact us immediately at info@shiftranks.com.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by displaying a notice within the platform. The "Last updated" date at the top of this page reflects the most recent revision.
11. Contact Us
If you have any questions about this Privacy Policy or how we handle your data, please contact us: