Privacy policy

Who is responsible

Toufik Beladi, a sole trader trading as RankLuma, is responsible for account administration, security and support information. Contact support@rankluma.app about privacy or your rights. Where an agency uploads client personal information, that agency remains responsible for its use of that information; RankLuma processes workspace content to provide the requested service.

Information we use

• Account information: your email address, account identifier, authentication records and profile details supplied by your chosen sign-in provider. Password authentication is handled by Supabase; do not send us your password.
• Workspace information: business names, countries, optional public contact details, service areas, listing identifiers, search terms, ranking areas, saved reports, citation evidence and your review notes. A business phone or address may be personal data for a sole trader.
• Requests and technical information: search inputs, usage-limit records, request times, error messages, IP addresses and device information processed by our hosting and authentication services for operation and security.
• Support messages: information you choose to send when requesting help.

We obtain information from you, your authorised sign-in provider, connected business accounts and public business listings. Do not upload sensitive personal information or private client details that are unnecessary for local SEO work.

Why we use it and our lawful bases

• Provide accounts, save your work and carry out requested searches: performance of our agreement with you. For personal data about your clients, our legitimate interests in providing the requested business service, subject to their rights and your instructions, or our role as your processor as applicable.
• Prevent abuse, enforce usage limits, investigate faults and protect accounts: legitimate interests in running a secure and reliable service.
• Answer support and privacy requests: performance of our agreement, legitimate interests in helping users, and legal obligations where applicable.
• Comply with applicable laws and resolve disputes: legal obligation or legitimate interests as appropriate.

Choosing a Google connection authorises that specific access. It does not provide permission for unrelated advertising or marketing. We will seek consent where required for any future optional tracking or new use of Google data.

Google sign-in and Business Profile access

Google sign-in uses your Google account identifier, email address and basic profile information, such as name and profile picture, to identify you and create or access your RankLuma account. It does not give RankLuma access to your Gmail messages, Drive files or Google Business Profiles.

Google Business Profile import is a separate connection, currently awaiting activation. If enabled and you choose to connect, it requests the business.manage permission to list the accounts and business locations you manage and import the profile you select. Available information can include the business name, public address, service areas, phone, website, Place ID and ranking location. Although Google's permission covers management, the current import implementation reads profiles and saves your selected profile to RankLuma; it does not edit your Google listing.

The import access token is kept in an encrypted, secure, HTTP-only cookie for up to one hour and cleared after a successful import. The authorisation-state cookie lasts up to ten minutes. Imported profile details remain in your workspace until removed or deleted. Account sign-in sessions are separate.

RankLuma's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements where applicable. We do not sell Google user data, use it for advertising, credit decisions or surveillance, or use it to train general-purpose AI models. Human access is restricted to purposes permitted by that policy, such as support you authorise, security investigation or legal requirements.

You can revoke access in Google Account connections. Revocation stops future authorised access; it does not automatically delete details already imported into RankLuma. See our data deletion instructions for removal.

Searches, maps and public listing checks

Google discovery sends your business name, optional town and country to Google Places. Search results are displayed for selection; the app records request metadata for usage protection rather than retaining Places response content. A selected Place ID may be saved. Details that you independently enter are stored as your workspace content. Google's Privacy Policy also explains Google's processing when you use its services.

If you choose the open map index, the corresponding query is sent to the Photon/OpenStreetMap service. Map tiles and public listing links can connect your browser to their respective providers, which receive normal connection information such as your IP address. Citation checks request the public URLs in the report; search-based discovery, where enabled, sends the necessary business search terms to DataForSEO. Coverage and publisher access vary. A blocked page remains unverified.

Live ranking checks and other integrations operate only when enabled and requested. Their relevant business and keyword inputs are shared with the named provider to fulfil that request. We do not send Google account authentication data to ranking or citation providers.

Providers and other disclosures

We use Supabase for authentication and database storage, Hostinger for hosting and domain email, Google for Google sign-in and Places discovery, and the relevant map and listing providers for the features you use. DataForSEO supports configured discovery or ranking requests. Providers process the information needed for their role. Your information may also be disclosed where legally required, to investigate abuse or protect legal rights. We do not publish your private workspace for other customers.

Providers may process data outside the UK. Where a restricted international transfer requires safeguards, we use the applicable lawful transfer mechanism, such as adequacy arrangements or appropriate contractual safeguards. Contact us for information about the arrangement relevant to your data. We do not claim that all information stays in the UK.

Retention and deletion

We keep account and workspace information while it is needed to provide your account and requested features. Archived records remain stored; archiving is not deletion. After a verified deletion request, we remove or de-identify information no longer required, while retaining only what is necessary for security, legal obligations or a specific dispute. Operational logs and usage records are retained according to security, troubleshooting and abuse-prevention needs; backup copies may remain until the provider's normal backup cycle expires and are not used to restore deleted content to active service unless legally required.

Retention decisions take account of whether your account is active, the purpose of the record, unresolved requests and legal requirements. Ask us about the retention applicable to a specific record. We do not promise instant deletion of provider backups.

Your rights

Depending on applicable law, you can request access, correction, deletion, restriction or portability of personal data, object to processing based on legitimate interests, and withdraw consent where consent applies. Email support@rankluma.app from your account email where possible. We may need to verify your identity. We normally respond to UK data-rights requests within one month, subject to lawful extensions and exceptions.

You can complain to the UK Information Commissioner's Office, or your local supervisory authority where applicable. Providing account information is necessary for an account; optional business contact details and a website are not required. RankLuma does not make automated decisions producing legal or similarly significant effects about you.

Storage, security and updates

We use authentication, access controls and encrypted connections to protect information. No system is risk-free. Our cookies and storage notice explains session and browser storage. RankLuma is for adult business users and is not directed at children. We update this notice when the service or data use changes, and give additional notice or seek renewed permission where required.