Privacy
Last updated 14 July 2026.
AiRankia audits and optimizes websites. This notice covers two different groups of people, and the difference matters:
- Customers — people with an AiRankia account. We are the data controller.
- Visitors to a customer’s website, measured by our optimization tag. The customer is the controller; we are their processor.
If you are a customer
| What | Why | Kept |
|---|---|---|
| Email address and password hash | To give you an account and let you sign in. Authentication is handled by Supabase. | Until you ask us to delete the account |
| The websites you audit, and the audit results | They are the product — the report, the personas, the recommendations. | Until you delete them |
| Analytics connections you authorize (Google Analytics, Tag Manager) | To read the metrics you asked us to read. Tokens are encrypted at rest (AES-GCM) and never shown back to you or written to logs. You can disconnect at any time in Connections. | Until you disconnect |
| Errors and crashes | To find out when the product breaks. Sent to our own self-hosted error tracker, not a third-party service. | 90 days |
We do not sell data, and we do not use it to train models we sell to anyone else. To produce an audit we send the content of the page being audited to a language-model provider; we do not send your account details.
If you are a visitor to a website that uses AiRankia
Our tag measures how the page performs, not who you are: no cookies, no visitor ID, no profile, no cross-site tracking, and it never reads what you type into a form. We store aggregate counters only — there is no per-visitor record to look up.
The full field-by-field breakdown, and how to switch it off, is on the tracking page.
Who else processes data
- Hetzner (Germany) — servers and databases. All customer data stays in the EU.
- Cloudflare — CDN and abuse protection in front of our domains.
- Supabase (self-hosted, on our own EU servers) — sign-in.
- OpenRouter and the model providers it routes to — the analysis itself.
- Google — only if you connect Analytics or Tag Manager, and only for the data you authorize.
Your rights
Under the GDPR (and, in Mexico, the LFPDPPP) you can ask for a copy of your data, correct it, have it deleted, or object to how it is used. Write to [email protected] and we will act within 30 days. If we get it wrong, you can complain to your national data-protection authority — in Spain, the AEPD.
Security
Traffic is encrypted in transit. Third-party tokens are encrypted at rest. Access to production is limited to the people who run the service. If we ever suffer a breach that puts you at risk, we will tell you — we would rather lose your trust honestly than keep it by silence.
Contact
AiRankia — [email protected]. If something here is unclear or looks wrong, tell us and we will fix the page.