Privacy policy
Last updated November 5, 2026
Draft. To be reviewed with counsel before launch.
Short version. This site loads nothing from other companies: no analytics, no advertising pixels, no session recording, no embedded videos, fonts or booking widgets. It sets cookies only to keep you signed in. We collect what you type into our forms, use it to do what you asked, and don’t sell or share it. We test this site with the same check we sell.
What we collect
- Call requests (the form on /contact): your name, work email and, if you give them, your company, store address, platform, search engine, what is coming up, what you are interested in, and a message. Requests made through the older service form before November 5, 2026 also hold a role, revenue band, catalog size and example searches.
- Benchmark waitlist: your work email, company and role, used only to send the benchmark when it publishes.
- Disputes: your name, work email, optional company and store address, and what you dispute, used to answer and, if we confirm an error, to correct the report.
- Free Findability Checks: the store address you enter, the public product and search data we read from that store, and the result. We store a one-way, salted hash of your network address to limit abuse; we don’t store the address itself.
- Free account: your email address and your saved checks. You can delete the account and its checks at any time from your account settings.
- Sample reports by email: your email address and, if you give them, your name and company; the category you asked for, the page you asked from, the time, and the consent you gave (to receive the report, and separately whether you asked for follow-up emails and when you confirmed). We create a free account for your email so you can sign in later without a password. We record when the private report link is opened, and a one-way hash of your network address to limit abuse. We send follow-up emails only if you ticked the box and then confirmed by clicking the link in our email; every email has an unsubscribe link.
- Private report links: when one is opened we record the time and which report, without your network address.
- Invoicing: for paid work, invoice and payment data held by Stripe. No card data touches this site.
- Server records: our server counts events such as “a check finished” or “a form was sent”, without names, emails or network addresses, to see which pages work. Short-lived in-memory counters limit how often one network can send forms; they are not stored.
Cookies
We set two cookies, both only after you sign in: ddt.session_token keeps you signed in (HttpOnly, 30 days), and ddt_in tells our static pages to show “My checks” instead of “Log in” (no personal data). Both are strictly necessary for the feature you asked for, so we don’t show a cookie banner. We use no cookies for analytics or advertising.
Global Privacy Control and opt-outs
If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale and sharing of your personal information, and the footer of every page says that we received it. Because we don’t sell or share personal information or load third-party trackers, honoring the signal changes nothing else on this site. You don’t need to send us a separate opt-out request.
Why we use it
To do the work you asked for, send the report you asked for, reply to you, invoice you, and keep the site secure. Asking for a sample report alone doesn’t put you on any email list. We don’t sell personal information, share it for cross-context behavioral advertising, or use it to train AI models.
How long we keep it
Requests and messages that don’t lead to work together are deleted after 24 months. Sample report requests are deleted after 24 months without contact; private report links stop working after 30 days. Free checks are kept until you delete them or your account. If you unsubscribe, we keep your email address on a do-not-email list so we don’t write to you again. Client work records are kept as long as tax and contract law require. You can ask us to delete your data sooner.
Who processes it
Only providers that help us run the service, under contracts that limit them to that purpose: our hosting provider; an email delivery provider (Postmark, Resend or our mail host) for the emails you ask for; Stripe for invoices; and, if we turn it on, HubSpot as our contact database. If you open our booking page, Cal.com handles that booking under its own policy; this site doesn’t embed it.
Your rights
You can ask to know, see, correct or delete the personal information we hold about you, and to opt out of its sale or sharing (which we don’t do). California residents have these rights under the CCPA; residents of other US states with privacy laws have similar rights; visitors in the EU and UK have rights under the GDPR, where our legal basis is your request (to do the work or send the report), your consent (follow-up emails, which you can withdraw at any time) or our legitimate interest in replying to business inquiries and keeping the site secure. We won’t treat you differently for using these rights.
Email hello@ranktalos.com. We reply within 30 days. An authorized agent can make a request for you with your written permission.
Stores we test
When we test a public storefront, we read public pages and public search results, as any visitor can. We don’t collect personal information about the store’s customers. Findings go privately to the store; see scanning ethics and disclosure.
Security
The site is served over HTTPS only, with strict security headers and a content security policy that allows no third-party code. Access to stored data is limited to the people who need it. If we learn of a breach affecting your data, we will tell you.
Changes and contact
We change the date above when this policy changes. DataDriveTech LLC d/b/a RankTalos. hello@ranktalos.com