Privacy Policy

This policy explains what RankRelay collects, why, and what you can do about it. RankRelay is operated by Dubori, a sole proprietorship registered in Jorhat, Assam, India. For data our agency customers put into the service about their own clients, the agency is the controller and we are the processor acting on their instructions.

What we collect

From agency users

• Name and email address, so you can sign in and we can reach you.
• A hashed password. We never store or see the password itself.
• Agency name, logo URL, brand colour and support email, so portals can carry your branding.
• Session records including IP address and browser user agent, kept for security.

From your clients

• The client name, company and contact email that you enter about them.
• Their approval decisions and any note they leave, timestamped against the deliverable.
• A record of when a portal link was last used. We do not set analytics or advertising cookies in the client portal, and we do not track clients across other sites.

Payment information

We never see or store your card details. Dodo Payments acts as our online reseller and Merchant of Record, collects payment directly, and handles billing and tax. We store only the customer and subscription identifiers Dodo returns to us, plus your plan and renewal date. Dodo Payments' handling of your payment data is governed by their own privacy policy.

Cookies

• Agency session cookie. Set when you sign in. Strictly necessary. Expires after 30 days.
• Portal session cookie. Set when a client opens their portal link. Holds a signed token identifying which agency and which client, nothing else. HttpOnly and expires after 7 days. Strictly necessary.

We use no advertising, profiling or third party analytics cookies anywhere in the product.

How portal links work

A portal link is a bearer token. We store only a SHA-256 hash of it, never the token itself, so a copy of our database does not give anyone a working portal. When a client opens the link we immediately exchange it for a session cookie and redirect, so the token leaves the address bar and the browser history. Portals send a no-referrer policy so the token is never leaked to sites the client clicks through to. An agency can revoke any link instantly, which takes effect on the client's next action.

Who we share data with

We use a small number of processors and share only what each needs to do its job:

• Cloudflare for hosting, the database and content delivery. Data is stored in Cloudflare's distributed infrastructure.
• Dodo Payments as reseller and Merchant of Record, for payments, invoicing and tax.
• Resend for transactional email such as portal invitations and approval notices.

We do not sell personal data, and we do not share it for advertising.

Where data is stored

RankRelay runs on Cloudflare's global network, so data may be processed outside your country, including outside the European Economic Area and outside India. Where required, transfers rely on the standard contractual clauses in our processors' terms.

How long we keep it

• Account and client data: for as long as the account is open, then 30 days after closure.
• Approval history: for the life of the deliverable, because it is the record of what was agreed.
• Session records: 30 days.
• Billing records: as long as tax law requires, which is generally 7 years.

Your rights

Depending on where you live, you may have the right to access, correct, export, delete or restrict processing of your personal data, and to object to it. Email privacy@getrankrelay.com and we will respond within 30 days. If you are one of our customers' clients rather than an account holder, contact the agency that sent you the portal link first, since they control that data. You may also copy us and we will help.

Security

Every request is scoped to a single agency at the data layer, and portal sessions are additionally pinned to a single client. Passwords are hashed. Portal tokens are stored only as hashes. Traffic is served over HTTPS. No system is perfectly secure, and if a breach affects your data we will notify you and any regulator required, without undue delay.

Children

RankRelay is a business tool and is not directed to anyone under 18.

Changes

We will post any update here and change the date at the top. If a change materially affects how we use personal data, we will email account holders before it takes effect.

Contact

Dubori, Jorhat, Assam, India. privacy@getrankrelay.com