Privacy Policy — GetRankWP

Last updated: 2026-09-25

1. What we collect

Account data: your e-mail address, display name, chosen language and a hashed password. Site connection: your WordPress site URL, WordPress username and a WordPress Application Password that you create (or that our connector plugin creates) — never your main WordPress password. Google data (optional): if you connect Google, we store an OAuth refresh token and read, in read-only mode, Search Console performance data (queries, pages, clicks, impressions, positions, index status) and Google Analytics 4 reports (page views, sessions, traffic sources) for the properties that match your site. Usage data: job history, credit ledger and an audit log of actions performed in your account.

2. How we use it

Only to provide the service: diagnosing your site, showing your rankings and traffic inside your dashboard, choosing which articles to refresh, sending you a weekly report, and billing. We do not sell or rent data, do not use it for advertising, and do not train machine-learning models on it.

3. Google API Services — Limited Use

GetRankWP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Scopes requested: webmasters.readonly, analytics.readonly, openid email. Google data is only displayed to you and used to compute recommendations and content for your own site. We do not use Google user data to develop, improve or train generalized AI or machine-learning models. Humans do not read it except with your consent for support, for security purposes, or to comply with the law. Who we share it with is listed in full in Section 6.

4. Storage and security (data protection mechanisms)

We apply the following technical and organizational measures to protect your data, including the Google Search Console and Google Analytics data described in Section 1:

• Encryption in transit: every connection to our servers and to Google's APIs uses HTTPS/TLS; no data is ever transmitted in plaintext.
• Encryption at rest: the database holding your account data, WordPress Application Passwords and Google OAuth refresh tokens is encrypted at rest on our hosting provider's infrastructure (Hostinger, EU/US data centres).
• Access control: only the account owner (via their authenticated dashboard session) and the service operator (for debugging or support, only with your consent) can access your data. OAuth tokens and Application Passwords are never displayed in the interface, in logs, or in API responses.
• Least-privilege scopes: we request only read-only Google scopes (webmasters.readonly, analytics.readonly, openid email) — we never request write or delete access to your Google data.
• Data minimization: Google data is fetched and cached only as needed to provide the service; it is shared only with the parties listed in Section 6, and only the minimum needed for the feature you use.
• Retention and deletion: Google refresh tokens are deleted immediately when you disconnect Google from your dashboard. Full account deletion (including all Google and site data) completes within 30 days of your request — see Section 5.
• Breach response: in the unlikely event of a data breach affecting your account, we will notify you by e-mail without undue delay after becoming aware of it.

5. Revocation and deletion

You can disconnect Google at any time from your dashboard (the token is deleted immediately) or from myaccount.google.com/permissions. You can revoke the WordPress Application Password from your WordPress profile. To delete your account and all data, write to no-reply@getrankwp.com; deletion is completed within 30 days. Content we changed on your site stays on your site (it is yours) and each change is reversible from the dashboard.

6. Sharing, transfer and disclosure of your data (including Google user data)

We do not sell, rent or trade your data or Google user data, we do not use it for advertising, and we do not transfer it to data brokers or information resellers. We share Google user data only with the following parties, only to provide features you use, and only the minimum needed:

• AI model providers — Google (Gemini API) and, as a fallback, Groq; or another provider only if you select it in your settings. When you ask for a new article, an article refresh or an AI recommendation, we send the minimum information needed to produce it: for example a search query from your Search Console data used as the article topic, or the titles and URLs of your pages with their click and impression counts. We never send your OAuth tokens, your e-mail address, your password or any personal information about you or your site's visitors. The result is returned to your dashboard or to your WordPress site.
• Your own WordPress site — content that we write or improve for you (which may be informed by your Search Console data) is published to the WordPress site you connected, and nowhere else.
• Hosting provider — Hostinger hosts our servers and database, where your data is stored encrypted at rest. It processes data on our behalf and does not use it for its own purposes.
• E-mail delivery — the weekly report, which contains summary numbers from your Google data, is sent only to your own account e-mail address.
• Legal reasons — if we are required to by law or a valid legal request, to protect the rights, safety or security of our users or the service, or with your explicit consent.
• Business transfer — if the service is merged or sold, your data may be transferred to the new owner under this same policy, and we will notify you in advance.

PayPal processes subscription payments; it does not receive any Google user data, and we never see your card numbers.

7. Contact

no-reply@getrankwp.com · See also our Terms of Service.