PicoRank Privacy Policy

Effective July 5, 2026 · Version 2026-07-05 · Prior versions: July 4, 2026

1. Who is responsible

The data controller for personal data processed by PicoRank is [LEGAL ENTITY — to confirm: Valley Island Investments AB, org.nr ______, registered address ______, Sweden]. Contact for anything in this policy: privacy@picorank.com.

2. What we process, why, and on what legal basis

• Account data — your email address and authentication data. Purpose: creating and securing your account, sending service email (verification, password reset, the weekly digest and alerts you can switch off in Settings → Notifications). Legal basis: performance of contract; the digest and alert emails to account holders rest on legitimate interest with a one-click opt-out in every email.
• Tracking configuration — the domains, keywords, competitors, and settings you add. Purpose: providing the service. Legal basis: contract.
• Your site's content — when you add a domain we crawl its public pages and store their content for analysis and history. Pages on your site may contain personal data (names in bylines, testimonials, contact details); you are responsible for that content on your site, and we process it on your instruction to analyze your site. Legal basis: contract.
• Integration data (Google) — see section 3.
• Billing data — plan, purchases, and transaction records. Payments are processed by Stripe; we never see or store card numbers. Legal bases: contract, and legal obligation (bookkeeping).
• Usage and technical data — feature usage counters, cost/usage metering per account, request logs, and error reports. Purpose: operating, securing, and improving the service and its fair-use limits. Legal basis: legitimate interest.
• Newsletter — if you subscribe on the website we store your email, the consent context, and the double-opt-in confirmation time. Legal basis: consent, withdrawable by the unsubscribe link in every issue.
• Support — what you send us when you contact us. Legal basis: legitimate interest in answering you.
• Acquisition source — when you first visit, a first-party cookie (pr_attrib, see cookies) remembers the campaign parameters, referring site, and landing page that brought you here; if you sign up, we store that source (and, when you have allowed analytics cookies, the Google Analytics client id) with your account so we know which marketing channels work. It contains no personal data and is shared with no one. Legal basis: legitimate interest in measuring our own marketing.

3. Google user data

If you connect a Google account, PicoRank requests read-only access to your Google Analytics 4 and Google Search Console data, plus your account email address. We use this data solely to show your own analytics and search-performance information inside your PicoRank dashboard and reports — including a one-time import of up to 16 months of Search Console history so your charts have depth from day one. We never use it for advertising, and we never sell it or share it with third parties for their own purposes.

We store the minimum required: OAuth tokens (server-side only, inaccessible to browsers) and the metrics needed to render your reports. You can disconnect at any time from the Integrations page or by revoking access in your Google Account permissions, which deletes the associated tokens. Imported metrics already in your reports remain until you ask us to remove them.

PicoRank's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Sub-processors

We use these providers to run PicoRank. Where a provider may process data outside the EU/EEA, transfers rest on the EU–US Data Privacy Framework or Standard Contractual Clauses — see each provider's data-processing agreement for specifics.

• Supabase — database, authentication, and file storage (the core data layer).
• Render — application hosting.
• Cloudflare — DNS and web delivery for the marketing site.
• Stripe — payment processing.
• Resend — transactional and newsletter email delivery.
• Google — the integrations you connect (GA4, Search Console), plus analytics/ads measurement on the marketing site (see cookies).
• DataForSEO — search-results, backlink, and keyword-research data. Your keywords and domains are sent as queries to retrieve public search data.
• Serper.dev and ScaleSERP — additional search-results data providers, used the same way.
• Anthropic — AI analysis of crawled site content when generating recommendations and report narratives.
• Sentry — error monitoring (technical error reports may include request metadata).

In plain words: your account lives in our database; specialized providers handle payments, email, search data, AI analysis, and error logs — each only sees what its job requires.

5. Retention

• Ranking and analysis history — kept for the life of your account (history is the product). Crawl snapshots are superseded by newer crawls.
• Imported Google metrics — kept while your account is active or until you disconnect and ask for removal.
• Billing and transaction records — 7 years (Swedish bookkeeping law).
• Logs and error reports — short-lived (typically ≤90 days).
• Newsletter data — until you unsubscribe (plus a suppression record so we don't email you again).
• After account closure — a 30-day export window, then deletion of account data except what bookkeeping law requires us to keep.

6. Your rights

Under the GDPR you can request access, correction, deletion, restriction, portability, and object to legitimate-interest processing. Write to privacy@picorank.com — we respond within one month. Account deletion is currently handled by us on request (there is no self-serve delete button yet); email us and we'll complete it within the response window. You can also complain to the Swedish supervisory authority, IMY (Integritetsskyddsmyndigheten), or your local EU authority.

7. Cookies

8. Children

PicoRank is a business tool, not directed at children, and we don't knowingly process children's data.

9. Changes

When this policy changes, the date above changes and prior versions stay linked at the top. Material changes are announced through the service.