Privacy Policy

Who we are

RankPilot is an SEO tool run by Nubri GmbH, Liebenowzeile 22, 12167 Berlin, Germany (info@nubri.co). Nubri GmbH is the controller for the data described here.

What we store

• Account: your name, email address, a hashed password, your plan, and whether you confirmed your email.
• Your SEO work: the sites, pages, keywords and competitors you add, the pages we fetch from them, audit results, rank history, and the outlines and drafts you generate.
• Free use: a one-way hash of your email inbox, so free AI requests are counted per inbox.
• Security log: sign-ins, password resets, email confirmation and account deletion, with time and IP address; deleted after one year.
• Payments: Stripe handles card details; we store your Stripe customer number and subscription status.
• Visits: a random visitor ID and where you first came from (stored in your browser), and the pages you open on our site. If you give us your email to receive an audit report, we store it with that context.
• Contact form: your message is emailed to us and not stored on our servers.

Why, and on what basis

We use this data to provide RankPilot (Art. 6(1)(b) GDPR), and to keep the service secure, prevent abuse of free use and understand which pages bring visitors (Art. 6(1)(f) GDPR).

AI and search

Page content, keywords and your instructions are sent to Anthropic's Claude models on Amazon Bedrock (AWS) to write audits, suggestions, outlines and drafts; AWS does not use them to train models. To track rankings, each tracked keyword is searched once a day through Serper.dev, which returns Google's results.

Who processes data for us

• Amazon Web Services (hosting, AI models, email)
• Serper.dev (Google search results for rank tracking)
• Stripe (payments)

Some are in the United States; transfers rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. We do not sell your data.

Retention and deletion

We keep your data while you have an account. You can delete sites and keywords at any time, and delete your whole account on the Billing page: this cancels any subscription and then removes your account and everything in it at once. Invoices are kept as tax law requires (up to 10 years).

Cookies and storage

We set one cookie, rp_token, to keep you signed in. Your browser's local storage holds the visitor ID, first-visit details and whether you closed the cookie notice. No advertising or third-party tracking.

Server logs

Our web server logs each request: IP address, time, the address requested, the response, and your browser's user agent. We use the logs to keep the service running and secure (Art. 6(1)(f) GDPR); they are deleted automatically after at most 8 days.

Your rights

You can ask for access to, correction, deletion, restriction or export of your data, and object to processing based on legitimate interests: email info@nubri.co. You can also complain to a data protection authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.