Contents
1. Who is responsible
IndiRanker is the data fiduciary for the personal data described here, within the meaning of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). Our contact for privacy matters is privacy@indiranker.com.
If you use IndiRanker to run audits for your own clients, you are the data fiduciary for any personal data in those client records. We act as your data processor for that content and process it only on your instructions.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, work email, company name, password hash, seat assignments | You, at sign-up |
| Billing | GSTIN, billing address, invoice history, last four digits of your card | You and our payment processor |
| Usage | Features used, queries run, projects and keywords you create, IP address, device and browser type | Automatically, as you use the service |
| Support | Messages you send to support, and any attachments | You |
| Crawl targets | Domains you ask us to audit, and pages we fetch from them | You, as an instruction |
We do not ask for or knowingly collect sensitive personal data such as health, biometric, caste, religious or financial account information beyond what billing requires. We do not collect data from children; the service is for people aged 18 and over.
3. Why we hold it
- To provide the service — authenticating you, running the queries you request, storing your projects and reports.
- To bill you — issuing GST invoices and meeting our tax and accounting obligations.
- To keep it secure — detecting abuse, fraud, and unauthorised access, and enforcing plan limits.
- To support you — responding to your requests and diagnosing faults.
- To improve the product — aggregated, de-identified usage statistics. We do not use your private project data to train models that we then sell.
- To meet the law — retaining records where statute requires it.
We rely on your consent for optional communications (product updates, newsletters) and on the performance of our contract with you for the core service. You can withdraw consent for marketing at any time without affecting your account.
4. Cookies and local storage
We use a small number of first-party cookies and browser storage entries, all of which are necessary to operate the service:
ir_session— an HTTP-only session cookie that keeps you signed in. Expires after 30 days or on sign-out.ir_token— a session token in local storage used by the application interface. Cleared on sign-out.ir_last_email— remembers the address you last signed in with, so the form is pre-filled. Local storage only.
We do not set advertising or cross-site tracking cookies. We do not embed third-party tracking pixels in the application. Our marketing pages load fonts from Google Fonts, which means your IP address is visible to Google when the page loads; we are evaluating self-hosted fonts to remove that dependency.
5. Data about websites we crawl
Our crawler fetches publicly reachable web pages. It does not log in to sites, does not bypass paywalls, and honours robots.txt by default. Pages we fetch are stored so that audits and reports remain reproducible.
If you are a site owner and want a domain excluded from our crawl or removed from our index, write to privacy@indiranker.com with the domain and the reason. We action verified requests within 30 days. Note that we do not operate a public web index; crawl data is retained per-customer for the audits they requested.
6. Who we share with
We share personal data only with processors who help us run the service, and only to the extent they need it:
- Payment processing — our gateway handles card details. We never see or store full card numbers.
- Email delivery — for transactional mail such as invoices and password resets.
- Hosting and infrastructure — servers that run the application and store the database.
- Search and crawl data providers — public sources we query to build SEO datasets.
We do not sell personal data. We disclose data to authorities only where legally compelled, and where permitted we will tell you first. If the business is acquired, customer data may transfer to the acquirer under the same terms; we will notify you beforehand.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | While the account is open, then 30 days after deletion |
| Invoices and tax records | 8 years, as required by Indian tax law |
| Usage logs | 12 months, then aggregated or deleted |
| Support tickets | 24 months |
| Crawl data for your projects | While the project exists; deleted with the project or account |
| Backups | Rolling 30 days |
When you delete your account we remove your projects, reports and crawl data within 30 days, except where we must keep records for tax or legal reasons. Backups age out within the following 30-day cycle.
8. Your rights
Under the DPDP Act you have the right to:
- Access — see the personal data we hold about you.
- Correct — fix inaccurate or incomplete data.
- Erase — ask us to delete your data, subject to legal retention duties.
- Withdraw consent — stop optional processing such as marketing email.
- Grievance — complain about how we handled your data, and escalate to the Data Protection Board of India if unresolved.
Most of this you can do yourself from the account page: export your data as JSON or CSV, edit your profile, and delete your account. For anything else, email privacy@indiranker.com. We respond within 30 days. We may need to verify your identity before acting, and we will not charge a fee for a first request.
9. Security
Passwords are stored as salted hashes, never in plain text. Sessions are HTTP-only cookies where possible. Access to production data is restricted to staff who need it, and administrative actions are logged. Traffic is encrypted in transit.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority as required by law, without undue delay.
10. International transfers
Our infrastructure is hosted in India. Some processors — for example a global payment gateway or an email provider — may process data outside India. Where that happens we rely on contractual safeguards and only transfer what is necessary for the function.
11. Changes
We may update this policy as the product or the law changes. Material changes are notified by email or in-app at least 14 days before they take effect. The effective date at the top of this page always reflects the current version.
12. Contact
Privacy questions and data requests: privacy@indiranker.com. Legal: legal@indiranker.com. Grievance officer details are available on request and are published in the account area.
← Back to indiranker.com