legal

Privacy Policy

Version 2026-08-17 — effective 17 August 2026. Replaces the previous version 2026-08-11.

This notice explains what personal data we collect, why we collect it, who we share it with, and what rights you can exercise. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”).

1. Who processes your data

The data controller is:

  • RANKWIT SRL SOCIETÀ BENEFIT (short form: Rankwit Srl SB), an Italian limited liability company with benefit purpose
  • Registered office: Piazza delle Scuole 6, 95021 Aci Castello (CT), Italy
  • Tax code and VAT number: 06209300877 — Companies Register no. CT-478459
  • Registered in the special section for innovative start-ups since 6 August 2025
  • Certified email (PEC): rankwit@pec.it
  • Privacy contact: info@rankwit.ai

We have not appointed a Data Protection Officer, as the conditions under Article 37 GDPR do not apply to our processing activities. For any request concerning your data, please write to the email address above.

2. Scope of this notice

It covers personal data processed through all our websites and online services:

  • rankwit.ai and www.rankwit.ai — our corporate website, blog, and public forms (free audit request, contact, press enquiries, call booking);
  • try.rankwit.ai — the Rankwit platform (the “Platform”), available to registered users;
  • hotel.rankwit.ai, destination.rankwit.ai, ecommerce.rankwit.ai — the same Platform, with the interface tailored to each industry;
  • magic.rankwit.ai — the portal for unlocking content through the physical cards handed out at trade fairs and events;
  • the public report sharing pages at try.rankwit.ai/share/…;
  • the emails we send in connection with the above: sign-in links, service notifications, monitoring digests, and marketing messages where you have consented.

It does not cover third-party websites reachable through links on our pages. Each has its own privacy notice, which we encourage you to read. For the terms governing the service, see our Terms and Conditions.

3. Two distinct roles: when we are controller and when we are processor

Rankwit handles two categories of data in two different capacities. The distinction matters because it determines whom you should approach to exercise your rights.

3.1 Data for which we are the controller

This is data about you as a visitor to our websites, a Platform user, or a business contact: your email address, browsing data, support requests, billing details, and how you use the product’s features. We determine the purposes and means of this processing, and this notice governs it.

3.2 Data for which we are a processor

This is data the customer enters into or connects to the Platform in order to obtain analyses: the domain to be analysed, the content of their own website, the Google Analytics 4 and Google Search Console accounts they choose to connect, and any third-party data contained in that material. For this data, Rankwit acts on behalf of and on the documented instructions of the customer, who remains the controller under Article 28 GDPR. The relationship is governed by a Data Processing Agreement signed alongside the service contract; you may request a copy at info@rankwit.ai.

If you believe personal data about you has been uploaded to the Platform by one of our customers, your request should be addressed to that customer as controller. If you write to us regardless, we will forward the request without delay and tell you which controller is responsible.

We expressly exclude joint controllership: the two spheres remain separate and no joint decisions on purposes are taken.

4. What we collect, why, and on what legal basis

4.1 Browsing our websites and the Platform

  • Data collected: IP address, browser and device type (user agent), pages visited, date and time, referring page, technical events and application errors.
  • Why: to deliver the service, secure our infrastructure, prevent abuse (rate limiting per IP address), and diagnose faults.
  • Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) and our legitimate interest in the security and continuity of the service (Art. 6(1)(f) GDPR).

Non-essential cookies and tracking technologies are activated only with your consent — see our Cookie Policy.

4.2 Protecting our forms against bots and abuse

  • Data collected: IP address, user agent, the outcome of the Cloudflare Turnstile anti-bot check, and temporary submission counters held in a cache for up to 60 minutes.
  • Why: to block automated submissions, account enumeration attempts, and system overload.
  • Legal basis: our legitimate interest in protecting our systems and our users (Art. 6(1)(f) GDPR).

4.3 Free audit request and other public forms

  • Data collected: the domain to be analysed, name, email address, phone number, industry, free-text notes, language, campaign attribution parameters (UTM and referrer), and any call booking.
  • Why: to produce and deliver the analysis you requested, to follow up and walk you through it, and to explore a possible commercial relationship.
  • Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).

Name, email, and phone number are required to deliver the analysis and get back to you; without them we cannot act on the request. All other fields are optional and only make the analysis more relevant. The box for receiving marketing communications is separate, optional, and never pre-ticked: leaving it empty does not prevent you from receiving the analysis.

4.4 Account and use of the Platform

  • Data collected: email address, workspace membership and role, display preferences, configured websites and domains, report and processing history, access logs.
  • Why: to create and maintain your account, deliver the service, manage permissions within your team, and provide support.
  • Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Sign-in is passwordless: we email you a single-use link (“magic link”) valid for 15 minutes. Your authenticated session is then maintained by a technical cookie lasting 7 days.

If your email address belongs to a company domain already linked to an existing workspace, your first sign-in will automatically add you to that workspace as a member. This lets colleagues in the same organisation collaborate without manual invitations. If you do not wish to be part of it, write to us and we will remove you. Addresses on generic mail domains (gmail.com, outlook.com, and similar) are excluded from this mechanism and always receive their own personal workspace.

4.5 Product usage analysis

  • Data collected: a record of significant actions taken in the Platform (report created, processing completed, export performed) linked to your user identifier, plus a daily aggregate count per feature.
  • Why: to understand which features are used and which are not, and decide where to invest development effort. We do not profile individuals and we do not use this data for advertising.
  • Legal basis: our legitimate interest in improving the product (Art. 6(1)(f) GDPR). You can object at any time by writing to info@rankwit.ai.

4.6 Support requests

  • Data collected: the content of your message, email address, the page the request was sent from, user agent, and workspace membership.
  • Why: to answer you and resolve the issue you reported.
  • Legal basis: performance of a contract (Art. 6(1)(b) GDPR) or our legitimate interest in responding to people who contact us (Art. 6(1)(f) GDPR).

4.7 Google integrations (Analytics 4 and Search Console)

  • Data collected: authorisation credentials (OAuth tokens) and the traffic and ranking metrics for the website you authorise us to read.
  • Why: to enrich the Platform’s analyses with real data from your website.
  • Legal basis: performance of a contract (Art. 6(1)(b) GDPR), based on the authorisation you grant explicitly in the Google consent screen.

We request read-only permissions exclusively (analytics.readonly and webmasters.readonly): we cannot modify or delete anything in your Google accounts. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use this data for advertising, we do not sell it, we do not transfer it to third parties, and we do not use it to train artificial intelligence models. You can revoke the authorisation at any time from the Platform or from your Google account settings.

4.8 Connecting external AI applications

  • Data collected: the authorisation you grant to an external application, plus a record of active connections and of the operations carried out through them.
  • Why: the Platform exposes a connector that lets you link an AI assistant of your choice to your workspace, so you can consult its contents from there.
  • Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Once you activate a connection, your workspace data becomes accessible to the application you authorised, and from that point its processing is governed by that provider’s privacy notice, not ours. The connection sees exactly what you see in the Platform: no more, no less. You can revoke it at any time from your account settings.

4.9 Publicly shared reports

You may choose to make a report public, which makes it accessible to anyone with the address and indexable by search engines. Publication is your explicit and reversible choice: until you enable it, the report stays private. Before publishing, check that the content does not include personal data you do not intend to make public.

4.10 Card and event portal (magic.rankwit.ai)

  • Data collected: email address, unlocked content, and any code handed to you at an event.
  • Why: to verify that you have access to the mailbox you entered and to keep track of the content you unlocked, so you can find it again later.
  • Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).

The portal requires no account and no password: your identity is your email address, verified through a temporary link. The verification session lasts at most 30 days.

4.11 Marketing communications

  • Data collected: name and email address, plus opening and click data for the emails we send.
  • Why: to send you product updates, content, and offers.
  • Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking a box that is never pre-ticked and never required in order to obtain the service.

We keep proof of every consent declaration, as required by Article 7(1) GDPR: we record the purpose, the choice made, the date, the version of this notice shown to you, and the form it came from. Withdrawal is recorded as a declaration in its own right: nothing is overwritten.

You can withdraw consent at any time using the unsubscribe link in every email or by writing to info@rankwit.ai. Withdrawal does not affect the lawfulness of processing carried out beforehand.

If you are already a customer, we may send you communications about services similar to those you purchased under Article 130(4) of the Italian Privacy Code (“soft spam”), always with a free and simple means of objecting in each message.

4.12 Billing and statutory obligations

  • Data collected: company name, address, VAT number and tax code, e-invoicing recipient code or certified email address, and accounting records.
  • Why: to issue invoices and comply with tax, accounting, and corporate law obligations.
  • Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).

5. Artificial intelligence: how it works and what we do not do

Rankwit analyses how content performs in generative search engines and conversational assistants. To do so, it queries third-party language models (the providers are listed in section 6), sending them the requests needed for the analysis: typically questions about the industry, the customer’s domain, and the publicly available content of the pages being analysed.

  • We use only the providers’ enterprise interfaces (APIs), configured so that the data we send is not used to train their models.
  • We do not deliberately send personal data about users or customers to these models. We ask you not to enter personal data — and in particular not special categories of data under Article 9 GDPR — into the Platform’s free-text fields.
  • We do not carry out automated decision-making producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22 GDPR. The Platform’s outputs are analyses, texts, and recommendations intended to be reviewed and approved by a person before any use.

The Platform also collects publicly accessible content from the websites being analysed and from search engine results, and checks whether the crawlers of the main AI systems are able to reach the customer’s website. This collection concerns public pages and respects the technical exclusion instructions published by the websites concerned.

6. Who we share data with

We do not sell your data and we do not disclose it to third parties for their own marketing purposes. We make it accessible only to organisations processing it on our behalf, appointed as processors under Article 28 GDPR, and only to the extent necessary:

  • Infrastructure and storage: Amazon Web Services — servers, databases, file storage, application logs, and transactional email delivery through Amazon SES; primary processing region: Frankfurt, Germany. Microsoft Azure for ancillary compute resources.
  • Artificial intelligence models: OpenAI, Anthropic, Google, and Amazon Web Services (Bedrock), to run the analyses described in section 5.
  • Search engine data and public content collection: DataForSEO, SerpApi, and Bright Data.
  • Security and bot protection: Cloudflare.
  • Measurement and marketing: Google (Tag Manager, Analytics, and advertising products) and Meta, exclusively where you have given the relevant consent through the cookie banner.
  • Corporate website: Webflow, which hosts rankwit.ai.
  • Appointment booking: Cal.com.
  • Automation and management of business enquiries: Make.com, to route submissions from our public forms.
  • Professional advisers: accountants, lawyers, and auditors, within the limits of their respective engagements.

Data may also be disclosed to public authorities where required by law or necessary to establish, exercise, or defend legal claims.

An up-to-date list of our processors is available on request at info@rankwit.ai.

7. Transfers outside the European Economic Area

Our core infrastructure is located in the European Union. Some of the providers listed in section 6 are, however, established in or process data in third countries, notably the United States. In such cases the transfer relies on one of the safeguards set out in Chapter V of the GDPR:

  • an adequacy decision of the European Commission, where the provider is certified under the EU-U.S. Data Privacy Framework;
  • failing that, the Standard Contractual Clauses adopted by the European Commission, supplemented where necessary by additional technical and organisational measures identified through an assessment of the legal framework of the destination country.

You may request a copy of the safeguards in place by writing to info@rankwit.ai.

8. How long we keep your data

The periods below are maximum retention limits. Where the purpose ends sooner, the data is deleted or anonymised at that point.

  • Account data and Platform content: for the duration of the relationship and no more than 30 days after the account is closed. Backups are overwritten within 90 days.
  • Sign-in links (magic links): 15 minutes, after which they no longer work.
  • Session cookie: 7 days from the last sign-in.
  • Card portal sessions (magic.rankwit.ai): 30 days.
  • Public form submissions not followed by a contract: no more than 24 months from the last contact.
  • Support requests: no more than 24 months from closure of the request.
  • Technical and security logs: no more than 12 months.
  • Product usage data: no more than 24 months in a form linked to the user; beyond that only aggregates remain, from which no individual can be identified.
  • Marketing data: until consent is withdrawn, and in any case no longer than 24 months from your last interaction, unless renewed.
  • Proof of consent: for the duration of the processing it relates to and for 5 years thereafter — the ordinary limitation period within which we may be required to demonstrate the lawfulness of the processing.
  • Cookie preferences: 180 days, as stated in the Cookie Policy.
  • Accounting and tax records: 10 years, under Article 2220 of the Italian Civil Code and applicable tax law.

Once these periods expire, data is deleted or irreversibly anonymised, unless retention is necessary to establish, exercise, or defend legal claims.

9. Your rights

As a data subject you may exercise the following rights, within the limits set by Articles 15 to 22 GDPR:

  • Access: obtain confirmation that processing is taking place and receive a copy of your data.
  • Rectification: correct inaccurate data or complete incomplete data.
  • Erasure: have your data deleted, where no retention obligation applies.
  • Restriction: ask that processing be suspended pending verification.
  • Portability: receive the data you provided in a structured, commonly used format, where processing is based on consent or contract and is carried out by automated means.
  • Objection: object at any time to processing based on our legitimate interest — including the product usage analysis described in section 4.5 — and object at any time, without giving reasons, to processing for direct marketing purposes.
  • Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise your rights, write to info@rankwit.ai. We will respond without undue delay and in any event within one month of the request, extendable by two further months for particularly complex requests, of which we will inform you. We may ask for the minimum information needed to verify your identity, solely to avoid disclosing data to someone not entitled to it.

You also have the right to lodge a complaint with a supervisory authority. In Italy: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it. You may also contact the authority in the Member State where you live or work, or bring proceedings before the courts.

10. Security

We implement technical and organisational measures appropriate to the risk, including: encryption of traffic in transit (HTTPS), encryption of stored data, passwordless sign-in through short-lived single-use links, session cookies that scripts in the browser cannot read, role-based access control with strict separation between different customers’ workspaces, environment separation, access logging, bot protection and rate limiting, regular backups, and external monitoring of service availability.

No system is entirely secure. Should a personal data breach occur that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, as required by Article 34 GDPR.

11. Children

Rankwit is a service for professionals and businesses. It is not directed at anyone under 18 and we do not knowingly collect their data. If you believe a minor has provided us with personal data, write to info@rankwit.ai and we will delete it.

12. Changes to this notice

We may update this notice to reflect changes in our services, our providers, or the law. Each version is identified by the date shown at the top of this document, and we keep an archived copy of it, so we can always establish which text was shown to you at the moment you gave a consent. The version in force is always published on this page. Where changes are material, we will give you reasonable advance notice by email or through a notice inside the Platform, and ask for your consent again where required.

13. Contact

For any question about this notice or about how we handle your data: info@rankwit.ai — Rankwit Srl Società Benefit, Piazza delle Scuole 6, 95021 Aci Castello (CT), Italy.

‍