ScriboRank1. Who is responsible
The controller of your personal data is [Company name: to be completed], [Legal form: to be completed], registered under [Registration number: to be completed], with its registered office at [Address: to be completed] (“ScriboRank”, “we”, “us”). You can reach us at contact@scriborank.com.
2. What this policy covers
This policy applies to:
- this website, scriborank.com;
- the ScriboRank application at app.scriborank.com (the “Service”);
- the ScriboRank plugin for WordPress, once you install it on your site.
When you use the Service, you may also put personal data about other people into it, for example in an article you write. For that data you are the controller and we act as your processor; see section 12.
3. The data we collect
When you visit this website
This website sets no cookies and runs no analytics or advertising scripts. Our server records technical logs (IP address, date and time, page requested, browser user agent) to keep the site secure and working.
When you create an account and use the Service
- Account data: your name, email address, and a hashed password, or your Google profile (name, email address, picture) if you sign in with Google.
- Workspace data: the Workspaces you create or join, your role, invitations you send (the invitee’s email address), and your interface language.
- Your content and settings: the Sites you add and the pages we read from them, topics, the questions you track, the facts and sources in your ledger, articles and their versions, audit results and checklist answers.
- Usage data: the jobs you run, their steps, the credits they use and the cost of the external calls they make, so we can meter usage and fix errors.
- Session data: a session cookie that keeps you signed in, and the IP address and browser user agent tied to each session, to protect your account.
- Messages: what you write to us, and our reply.
When you connect the WordPress plugin
The plugin counts visits from known AI and search crawlers (for example GPTBot or PerplexityBot) per day, crawler and page, and sends those totals to us. It recognises a crawler from its user agent and stores no IP address, cookie or other data about your human visitors.
Billing
When paid plans open, payments will be handled by a payment provider listed on the Subprocessors page. We will not see or store your full card number.
4. Data from Google
If you choose to, you can connect Google services to the Service:
- Google sign-in gives us your name, email address and profile picture.
- Google Search Console (read-only scope
webmasters.readonly) gives us the search performance of the property you choose: queries, pages, clicks, impressions and positions. - Google Analytics (read-only scope
analytics.readonly) gives us traffic figures for the property you choose: sessions per page, date and source.
We use this data only to show you how your own pages perform in the Service, and to tie that performance to the articles you write with it. We never change anything in your Google accounts. We do not use Google user data to serve advertising, we do not sell it, we do not use it to train or improve general AI or machine-learning models, and no person at ScriboRank reads it unless you ask us to for support, it is needed for security, or the law requires it.
ScriboRank’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect a Google service at any time in the Service’s Settings, or revoke our access from your Google account permissions. When you disconnect, we delete the stored access tokens; you can ask us to delete the data already synced.
5. Why we use it, and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create your account, sign you in, run the Service you asked for | Performance of our contract with you (art. 6(1)(b)) |
| Connect Google services and the WordPress plugin | Contract, at your request; you can disconnect at any time |
| Meter usage and credits, bill, keep accounting records | Contract, and legal obligation (art. 6(1)(c)) |
| Keep the Service secure, prevent abuse, fix errors | Legitimate interest in a secure, working service (art. 6(1)(f)) |
| Answer your messages, send service emails (sign-in links, invitations, changes to these terms) | Contract, and legitimate interest |
| Send product news | Your consent (art. 6(1)(a)), which you can withdraw in one click |
6. AI processing
To research topics, extract facts and draft articles, the Service sends text to AI model and data providers: your topics and questions, pages it fetched, and the drafts it is working on. We send only what each task needs.
- ScriboRank does not use your content or your personal data to train AI models.
- We choose providers whose terms do not allow them to train on data sent through their API, and we list them on the Subprocessors page.
- The Service does not make decisions about you that have legal or similarly significant effects.
7. Who we share it with
We share personal data only with the service providers that run the Service for us, under contracts that bind them to our instructions and to confidentiality. They are listed on the Subprocessors page, with what each one does and where. We may also disclose data when the law requires it, or to a buyer of our business, who would be bound by this policy.
We do not sell personal data, and we do not share it for advertising.
8. Transfers outside Europe
Our servers are hosted by [Host: to be completed] in [Country: to be completed]. Some providers process data in other countries, including the United States. When personal data leaves the European Economic Area, we rely on an adequacy decision (such as the EU-US Data Privacy Framework, for certified companies) or on the European Commission’s Standard Contractual Clauses, with additional measures where needed.
9. How long we keep it
- Account and Workspace data: as long as your account is open.
- Your content: as long as your account is open, then deleted within 30 days of closing it, except backups, which are overwritten on their normal cycle.
- Tracked AI answers: for the history period of your plan.
- Server logs: up to 12 months.
- Invoices and accounting records: 10 years, as French law requires.
10. Your rights
You may ask us for access to your personal data, its correction or deletion, a copy in a portable format, or the restriction of its use. You may object to uses based on our legitimate interest, and withdraw consent at any time. You can also give instructions for what happens to your data after your death.
Write to contact@scriborank.com. We answer within one month, and may ask you to confirm your identity. If you think we have not respected your rights, you can complain to the CNIL (Commission nationale de l'informatique et des libertés) (cnil.fr) or to the authority where you live.
11. Security
Data travels over HTTPS. Each Workspace’s data is isolated in the database by row-level security, checked by automated tests. Passwords are stored as hashes. Access to production systems is limited to the people who run them and uses keys, not passwords. No system is perfectly secure: if a breach puts your data at risk, we will tell you and the authorities as the law requires.
12. Data in your content
If you put personal data about other people into the Service, for example a name in an article or the email of a colleague you invite, you are responsible for having a basis to do so. We process that data only on your instructions, to provide the Service, under the processor terms in our Terms of service.
13. Children
The Service is for businesses and is not meant for anyone under 16.
14. Changes
We may update this policy as the Service changes. The date at the top shows the latest version. If a change matters, we will tell account holders by email or in the Service before it applies.
15. Contact
Questions about this policy or your data: contact@scriborank.com.