Privacy Policy
Last updated: 11 July 2026
1. Who We Are
ShiftRanks ("we", "us", "our") is an AI-powered local SEO automation platform operated by ShiftRanks Ltd. Our registered contact email is info@shiftranks.com. This Privacy Policy explains how we collect, use, and protect information when you use our platform at shiftranks.com (the "Service").
2. Information We Collect
2.1 Account Information
When you register, we collect your email address, username, and a hashed password. If you sign in with Google OAuth, we receive your Google account email and profile name — we do not receive or store your Google password.
2.2 Client & Business Data
You may enter business information for clients you manage, including business name, address, phone number, website URL, and industry. This data is stored securely and used solely to provide the SEO tools you request.
2.3 Third-Party Platform Tokens
When you connect third-party accounts (Google Business Profile, Facebook, Instagram, LinkedIn), we store access tokens encrypted at rest using AES-256 (Fernet). These tokens are used only to perform actions you explicitly authorise within the platform.
2.4 WhatsApp & Telegram Messaging Data
ShiftRanks lets you manage your account by sending WhatsApp or Telegram messages to our business number/bot. When you do, we receive and store: your phone number or messenger ID, the text, voice notes, or photos you send us, and any AI-generated content or confirmation messages we send back. This data is used solely to carry out the action you requested (generating and publishing content, running a scan, answering a question) and to maintain a record of what was posted on your behalf. Voice notes are transcribed to text for processing and are not retained as audio after transcription. We do not use your messaging data for advertising or share it with anyone other than the AI/processing providers listed in Section 4.
2.5 Usage & Log Data
We collect structured logs of feature usage (audit runs, content generation, scan triggers) for debugging and service improvement. Logs do not include passwords or payment card numbers.
2.6 Payment Information
Payments are processed by Stripe. We do not store card numbers on our servers. Stripe's privacy policy applies to payment data: stripe.com/privacy.
3. How We Use Your Information
| Purpose | Lawful Basis (UK GDPR Art. 6) |
|---|---|
| Provide the Service (AI content, SEO audits, rank tracking, social posting) | Contract performance (Art. 6(1)(b)) |
| Authenticate your account and maintain session security | Contract performance (Art. 6(1)(b)) |
| Send transactional emails (verification, password reset, billing receipts) | Contract performance (Art. 6(1)(b)) |
| Process billing and manage subscriptions via Stripe | Contract performance (Art. 6(1)(b)); Legal obligation (Art. 6(1)(c)) |
| Call third-party APIs on your behalf (DataForSEO, OpenAI, GBP, Meta, LinkedIn) | Contract performance (Art. 6(1)(b)) |
| Debug issues and improve service reliability (structured logs) | Legitimate interests (Art. 6(1)(f)) — ensuring service quality |
| Send marketing communications and newsletters | Consent (Art. 6(1)(a)) — opt-in only; withdraw any time |
| Record cookie consent events for compliance audit | Legal obligation (Art. 6(1)(c)) — GDPR Art. 7 accountability |
4. Third-Party Services We Use
The Service integrates with the following third parties to provide functionality:
| Service | Purpose | Data Shared |
|---|---|---|
| OpenAI | AI content generation | Business name, industry, city, content prompts |
| DataForSEO | Keyword rank tracking, backlink analysis, brand mentions | Domain names, search keywords |
| Google (OAuth + GBP) | Sign-in and Google Business Profile management | Google account email; business location data |
| Meta (Facebook/Instagram) | Social media posting | Page access tokens; post content you approve |
| WhatsApp Business Platform (Meta) | Sending and receiving your commands, confirmations, and approval requests | Your phone number; message text, voice, and image content |
| Telegram | Sending and receiving your commands, confirmations, and approval requests | Your Telegram chat ID; message text, voice, and image content |
| Professional network posting | Organisation ID; post content you approve | |
| Stripe | Payment processing | Email address; billing address |
| Webflow | CMS content publishing | API token; generated content |
| Mailchimp (Intuit Inc.) | Email marketing and subscriber management | Email address; marketing consent status |
5. Data Retention
We retain your account data for as long as your account is active. If you delete your account, all associated data (clients, content, scan results, tokens) is permanently deleted within 30 days. You may request deletion at any time by emailing info@shiftranks.com.
6. Data Security
We implement the following security measures:
- All passwords hashed with scrypt (never stored in plaintext)
- OAuth tokens and API keys encrypted at rest with AES-256 (Fernet)
- All data in transit encrypted via TLS/HTTPS
- CSRF protection on all state-changing forms
- Parameterised database queries (no SQL injection risk)
- Session tokens are server-side and rotated on login
7. Your Rights (UK GDPR)
If you are located in the UK or European Economic Area, you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — request deletion of your data ("right to be forgotten")
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interests
- Restriction — request we restrict processing while a dispute is resolved
To exercise any of these rights, email info@shiftranks.com or use our Data Deletion page. We will respond within 30 days.
8. Cookies & Similar Technologies
We use cookies and browser-side storage (localStorage) in three categories. Your consent is obtained via a banner before any non-essential cookies are activated. You may review or change your preferences at any time using the "Cookie Settings" link in the footer. For a full list of every cookie, its purpose, and expiry see our Cookie Policy.
- Strictly Necessary — session management, CSRF protection, Stripe security. Cannot be disabled.
- Functional — remembers your display preferences and onboarding progress. Requires your consent.
- Marketing — anonymous session key used for campaign analytics; Mailchimp subscriber tagging (only for logged-in users who consented to marketing). Requires your explicit consent.
8a. International Data Transfers
ShiftRanks is operated from the United Kingdom. Some of our third-party sub-processors are based in the United States (OpenAI, Stripe, Mailchimp, DataForSEO). Transfers of personal data outside the UK/EEA are made under appropriate safeguards including:
- UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs) where applicable
- Adequacy decisions where the destination country is deemed to provide equivalent protection
You may request a copy of the transfer mechanism in place for any specific processor by emailing info@shiftranks.com.
8b. California Residents (CCPA / CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to Know — request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months
- Right to Delete — request deletion of your personal information, subject to certain exceptions
- Right to Correct — request correction of inaccurate personal information
- Right to Opt-Out of Sale/Sharing — we do not sell your personal information to third parties. Sharing email addresses with Mailchimp for marketing is done only with your explicit consent and you may opt out at any time
- Right to Non-Discrimination — we will not discriminate against you for exercising any CCPA rights
To exercise your California rights, email info@shiftranks.com with subject line "CCPA Request". We will respond within 45 days.
9. Children's Privacy
The Service is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have collected data from a child, contact us immediately at info@shiftranks.com.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by displaying a notice within the platform. The "Last updated" date at the top of this page reflects the most recent revision.
11. Contact Us
If you have any questions about this Privacy Policy or how we handle your data, please contact us: