Privacy Policy

1Who we are

Ranqueia (ranqueia.com) is a GEO (Generative Engine Optimization) platform operated by RANQUEIA LTDA, Brazilian company registration (CNPJ) 68.543.951/0001-40, headquartered at Rua Koesa, 218, sala 1004, Kobrasol, São José/SC, Brazil, ZIP 88102-310. We help businesses monitor and improve their visibility in AI tools such as ChatGPT, Gemini and Perplexity.

RANQUEIA LTDA is the controller of the personal data processed to provide the service (Brazil's General Data Protection Law, Law 13.709/2018 — LGPD). As a micro-enterprise, it is exempt from appointing a data protection officer (ANPD Resolution No. 2/2022); any matter about your data is handled through contato@ranqueia.com.

2What data we collect

Data you provide:

• Full name and email (platform sign-up)
• Company name, website, category and business location, plus services, differentiators and any other information you enter to guide the content
• Competitors and monitored keywords
• Brazilian tax ID (CPF or CNPJ), to issue the invoice
• Documents, materials and photos you upload for the platform to use in content — if a photo shows people, you are responsible for having their permission
• Name, email, WhatsApp and company details provided in the free diagnostic (used to send you the result and for sales contact, with your consent), plus the IP address, recorded to prevent abuse of the form
• The assisted setup is booked on Google's calendar (Google Calendar): the data you type there is handled by Google
• For affiliate program participants: name, email and payout details (handled together with Stripe)

Data collected automatically:

• Platform usage data (pages visited, features used)
• IP address and browser information, including the country of access, used to set language and currency
• Application access records (date, time and IP), which the law requires us to keep (Brazilian Civil Rights Framework for the Internet — Marco Civil, art. 15)

Payment data:

• Processed directly by Stripe (our payment processor). Your card details are collected and stored by Stripe — Ranqueia does not see or store your full card number.
• We keep only subscription identifiers (e.g. plan, status, the last 4 digits shown by Stripe).

Integration data (when you authorize it):

• Google Business Profile: the full profile (name, categories, address, phone, hours, description and services), performance metrics, search keywords, posts and reviews — with the reviewer's name, rating and text. Details in section 5.
• Google Analytics (GA4): aggregated traffic metrics for your site and the email of the connected Google account, when you connect the integration
• Google Search Console: indexing status of your blog articles and the top searches that led to it (data aggregated by Google). Details in section 5.
• WordPress / your blog: publishing credentials you provide, stored encrypted and used solely to publish the generated content and configure SEO plugins

3How we use your data

Each use has a legal basis (LGPD, art. 7):

• Provide and improve the platform's services — performance of the contract
• Monitor your brand's visibility in AI tools — performance of the contract
• Generate reports, analyses and content for your business, and publish it to the channels you connect — performance of the contract
• Send service-related communications, such as the weekly reports and billing notices (no spam) — performance of the contract. The weekly reports can be turned off at any time, through the link in the email itself or in Settings; account access and billing emails are still sent.
• Charge the subscription and issue the invoice (includes the tax ID) — legal obligation and performance of the contract
• Keep application access records — legal obligation (Marco Civil)
• Protect the platform against fraud and abuse (usage limits, IP on the diagnostic form) — legitimate interest
• Provide support and the assisted setup inside your account (section 13) — performance of the contract and legitimate interest
• Send the free diagnostic result and follow up commercially about it — consent, which can be withdrawn
• Measure site usage and attribute affiliate referrals through cookies — consent (section 11)
• Comply with legal obligations and defend ourselves in legal proceedings — legal obligation and regular exercise of rights

4Artificial intelligence

We use third-party AI models, contracted through APIs, to measure your visibility and produce content:

• Anthropic (Claude): receives your business data, the monitored queries, the documents and photos you upload, the text of your website, your Google Business Profile and your Google reviews (only the reviewer's first name) — to write articles, analyses, suggestions, posts and replies.
• OpenAI (ChatGPT), Perplexity and Google (Gemini): receive the text of the monitored queries, without your account data, to measure whether your brand appears in the answers. Perplexity also receives the business name, segment, city and services to suggest queries and competitors; and OpenAI may receive the text of your website when it stands in for Anthropic in the brand analysis.

We do not use your data to train AI models, and we contract these providers under API terms that, according to them, do not use the submitted content for training.

AI-generated content may contain inaccuracies. Public replies to reviews are kept as drafts for you to review, unless you turn on automatic publishing. No decision affecting your rights is made solely by an automated system.

5Google integrations

Google Business Profile (add-on):

• What we read: the full profile, performance metrics (up to 18 months), search keywords, posts and reviews.
• What we publish on your behalf: scheduled posts; replies to reviews (drafts by default, published automatically only if you turn that option on); and the profile changes you submit through the platform.
• Real-time notifications: we subscribe your account so Google notifies us of new reviews (via Google Cloud Pub/Sub).
• Reviewers are third parties: only their first name goes to the AI, and replies do not repeat health information or details the person did not write.
• When you cancel: we stop reading and publishing. When the account is deleted, we remove the notification subscription.

Google Analytics (GA4):

• Read-only: aggregated traffic metrics (traffic sources and blog pages). We do not receive data about individual visitors.

Google Search Console:

• To measure whether Google indexes your blog, we create and verify the blog property in Ranqueia's Google account — with a verification tag placed on the blog — and submit the sitemap.
• We read the indexing status of the articles and the top searches that led to the blog.
• When your account is deleted, we remove the property from our account and relinquish the verification; the tag can then be removed from your site.

Limited use of Google data:

Ranqueia's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice: Google data is used only for the features you see on the platform; it is not sold, not used for advertising and not used to train AI models; and the team only sees it when providing support you requested, for security, or to comply with the law.

6Who we share it with

We do not sell your data. We share it only with the providers that run the service for us:

• Supabase — database, authentication and file storage; holds all platform data (United States)
• Cloudflare — application hosting and delivery, and the anti-bot check (Turnstile) on the diagnostic form, which receives your IP
• Stripe — payment and subscription processing (name, email, tax ID and card, which stays with Stripe only); for affiliates, also the payout account (Stripe Connect) and the identity verification Stripe requires (United States)
• Spedy — invoice issuance, from Stripe's billing data: name, tax ID and amounts (Brazil)
• Anthropic / OpenAI / Perplexity / Google (Gemini) — AI processing for visibility analyses and content generation; what each receives is in section 4 (United States)
• Resend — transactional emails and the weekly report (United States)
• Google — the integrations you authorize (section 5), the assisted-setup calendar, the site's fonts (Google Fonts, which receives visitors' IP) and, with your consent, the site's Google Tag Manager / Analytics (United States)
• Pexels — stock images for posts; receives only search terms, which may include the company name
• IBGE — list of Brazilian cities; receives only the state code (Brazil)

We may also provide data to authorities when required by law or court order.

International transfer: platform data is stored in the United States, and several of these providers process data outside Brazil. The transfer is necessary to perform the contract with you (LGPD, art. 33, IX) and is carried out with the contractual data protection safeguards offered by each provider.

7How long we keep it

• Account data: for as long as your account remains active
• After cancellation, your account stays accessible for 30 days — so you can download your articles via the "Export content" button. If you cancel during the free trial, access lasts until the trial ends.
• Personal data is automatically deleted within 90 days of cancellation: the account, business data, integrations and their access, uploaded files and the Search Console property in our account. With the "Delete account" button, deletion is immediate.
• Database backups may keep deleted data for a few more days, until they are replaced
• Tax records (invoices, tax ID and amounts at Stripe and on the invoice): 5 years, as required by law
• Application access records: at least 6 months, as the Marco Civil requires
• Free diagnostic data: up to 12 months
• Articles published on your own site (WordPress/Wix) stay with you and are not removed by Ranqueia
• Content already published on the Ranqueia blog may remain online after cancellation, unless you request removal
• System and audit logs, including the record of team access to your account: up to 12 months

8Your rights (LGPD)

Under Brazil's General Data Protection Law (Law 13.709/2018, art. 18), you have the right to:

• Confirm whether we process your data and access it
• Correct incomplete or outdated data
• Anonymize, block or delete unnecessary data or data processed in breach of the law
• Delete your data (right to be forgotten), except what the law requires us to keep
• Portability of your data
• Know who we share your data with (section 6)
• Withdraw consent at any time, and know the consequences of not consenting
• Object to processing that breaches the law
• Complain to Brazil's National Data Protection Authority (ANPD)

Some of this you can do yourself on the platform: correct data in Settings, download all your data with "Download my data", download your articles with "Export content" and delete the account with "Delete account". For anything else, contact us at contato@ranqueia.com

We reply within 15 days. We may ask you to confirm your identity before providing or deleting data.

9If you are not our customer

Some of the data we process belongs to people without a Ranqueia account: people who reviewed a customer on Google, visitors to a customer's blog, people shown in photos or documents a customer uploads. In these cases we process the data on behalf of the customer, who is the controller; Ranqueia acts as processor (LGPD, art. 39), using the data only to provide the service the customer contracted.

If this is your case, you can contact the business you dealt with directly, or write to contato@ranqueia.com — we will forward your request to them and help handle it.

10Security

We use encryption, access control and security best practices to protect your data:

• encrypted connections (HTTPS) and data encrypted at rest;
• WordPress application passwords and Google tokens stored encrypted (AES-256-GCM), out of the browser's reach;
• isolation of each account in the database, with safeguards that prevent changing billing and access data from the browser;
• a record of every team access to your account (section 13).

No system is 100% secure. If an incident may cause you relevant risk or harm, we will notify you and the ANPD within 3 business days, as the regulation requires.

11Cookies

We use:

• Essential cookies — keep your session active and your preferences (language, and the display currency, chosen by country of access). The login session is kept in the browser's storage, not in a cookie;
• Referral cookie — if you arrive through a partner/affiliate link and accept cookies, we store the referral code for up to 30 days, solely to attribute the referral correctly;
• Site measurement — with your consent, the site uses Google Analytics, loaded through Google Tag Manager, for aggregated audience metrics. Without consent, none of this is loaded.

Regardless of consent, the site's fonts come from Google Fonts and the diagnostic form uses Cloudflare's anti-bot check (Turnstile) — both receive your IP address to work.

We do not use advertising cookies and we do not sell browsing data. If that changes, we will ask for your consent first.

You can change your choice at any time: Cookie preferences.

12Changes to this policy

We may update this policy from time to time. We will notify you by email in case of relevant changes.

13Access to your account for support and administration

To provide support, resolve technical issues, configure integrations and keep the service running, authorized Ranqueia team members may, when necessary, access your account and view the data in it — including remotely, acting on your behalf inside the platform (support/impersonation feature).

• This access is restricted to authorized staff (team administrators and editors) and used only to operate, maintain and improve the service you subscribed to. Editors cannot delete your account.
• Every administrative access to an account is logged (audit log): who entered, when, until when and what they changed. The log cannot be edited, is kept for 12 months and is handled under a duty of confidentiality. You may request a copy.
• We do not see your password or your full credit card details (those stay with Stripe only). Integration credentials are stored encrypted and are not shown to the team.
• Legal basis (LGPD, art. 7): performance of the service contract and legitimate interest in operating and supporting the platform.

If you do not want the team to access your account for support, please contact us — in that case, some support actions may not be possible.

14Contact

RANQUEIA LTDA — CNPJ 68.543.951/0001-40
Rua Koesa, 218, sala 1004, Kobrasol, São José/SC, Brazil, ZIP 88102-310
Email: contato@ranqueia.com
Website: https://ranqueia.com