Privacy Policy
This Privacy Policy explains how Nutrigen Sp. z o.o. ("Company", "we", "us", or "our") collects, uses, stores, and protects your personal data when you use the RankWire platform at rankwire.io, including the SaaS application and API (the "Service").
We are committed to protecting your privacy and complying with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the California Consumer Privacy Act ("CCPA"), and other applicable data protection laws.
1. Data Controller
The data controller for personal data processed through the Service is:
Nutrigen Sp. z o.o.
ul. Tadeusza Kosciuszki 25/5
50-011 Wroclaw, Poland
NIP: 897-188-11-25 · KRS: 0000851334
Email: [email protected]
2. What Data We Collect
2.1 Account Data
When you register, we collect:
- Name
- Email address
- Password (stored as a bcrypt hash; we never store plaintext passwords)
- Organization/tenant name (if provided)
2.2 Synced Content Data
When you connect a WordPress site, the RankWire plugin syncs the following data to our servers:
- Post titles, content (body text), slugs, and publication dates
- Post metadata (categories, tags, word count)
- Internal link structure of your site
This data is processed to generate link suggestions, topic clusters, and SEO analytics. It is stored within your tenant and is not shared with other users.
2.3 Usage and Analytics Data
We automatically collect:
- IP address (anonymized for analytics)
- Browser type, operating system, and device information
- Pages visited, features used, and timestamps
- API request logs (endpoint, timestamp, response status)
2.4 Payment Data
Payment processing is handled entirely by Paddle.com Market Limited, our Merchant of Record. We do not collect or store credit card numbers, bank account details, or other payment instruments. Paddle collects and processes payment data under its own privacy policy. We receive from Paddle:
- Subscription status and plan tier
- Transaction IDs and invoice references
- Billing country (for tax purposes)
For details on how Paddle handles your payment data, see Paddle's Privacy Policy.
2.5 Communication Data
When you contact us via email or support channels, we collect the content of your messages, your email address, and any attachments you send.
3. How We Use Your Data
| Purpose | Legal Basis (GDPR) |
|---|---|
| Provide and operate the Service (account management, content analysis, link suggestions) | Performance of contract (Art. 6(1)(b)) |
| Process payments and manage subscriptions (via Paddle) | Performance of contract (Art. 6(1)(b)) |
| Send transactional emails (account verification, password resets, billing notifications) | Performance of contract (Art. 6(1)(b)) |
| Send product updates and feature announcements | Legitimate interest (Art. 6(1)(f)) |
| Analyze usage patterns to improve the Service | Legitimate interest (Art. 6(1)(f)) |
| Ensure security and prevent fraud | Legitimate interest (Art. 6(1)(f)) |
| Comply with legal obligations (tax records, law enforcement requests) | Legal obligation (Art. 6(1)(c)) |
| Send marketing communications (only with your opt-in) | Consent (Art. 6(1)(a)) |
4. AI Processing
Your synced content is processed by AI models to generate embeddings, analyze topics, and produce link suggestions and anchor texts. This processing is essential to deliver the core functionality of the Service (legal basis: performance of contract). We do not use your content to train general-purpose AI models. AI processing is performed solely to provide results for your specific account.
5. Data Sharing
We do not sell your personal data. We share data only with the following categories of recipients:
| Recipient | Purpose | Location |
|---|---|---|
| Paddle.com Market Limited | Payment processing (Merchant of Record) | UK / EU |
| Cloud hosting provider | Infrastructure and data storage | EU (primary), US (CDN/backup) |
| AI service provider | Content analysis, embedding generation | US (with Standard Contractual Clauses) |
| Email delivery service | Transactional and marketing emails | EU / US |
| Analytics provider | Usage analytics (anonymized data) | EU |
All sub-processors are bound by data processing agreements that ensure an adequate level of data protection. For transfers outside the EEA, we rely on Standard Contractual Clauses (SCCs) or adequacy decisions, as applicable.
6. International Data Transfers
Your data is primarily stored in the European Union. Where data is transferred outside the EEA (for example, to AI service providers in the United States), we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions where available
- Data processing agreements with all sub-processors
7. Data Retention
- Account data: Retained for the duration of your account plus 30 days after deletion.
- Synced content: Deleted within 30 days of website removal or account termination.
- Usage logs: Retained for up to 12 months, then anonymized or deleted.
- Billing records: Retained for the period required by applicable tax and accounting law (typically 5-7 years).
- Support communications: Retained for up to 24 months after resolution.
8. Your Rights
8.1 Rights Under GDPR (EEA Residents)
If you are located in the European Economic Area, you have the right to:
- Access your personal data and obtain a copy.
- Rectification of inaccurate or incomplete data.
- Erasure ("right to be forgotten") of your data, subject to legal retention requirements.
- Restriction of processing in certain circumstances.
- Data portability — receive your data in a structured, machine-readable format.
- Object to processing based on legitimate interest, including direct marketing.
- Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
- Lodge a complaint with a supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
8.2 Rights Under CCPA (California Residents)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, and disclose.
- Delete your personal information, subject to certain exceptions.
- Opt out of sale — we do not sell personal information.
- Non-discrimination — we will not discriminate against you for exercising your rights.
To exercise your CCPA rights, contact us at [email protected]. We will verify your identity before processing your request.
8.3 How to Exercise Your Rights
To exercise any of the rights described above, contact us at [email protected]. We will respond within 30 days (or as required by applicable law). We may ask you to verify your identity before fulfilling your request.
9. Security
We implement appropriate technical and organizational measures to protect your data, including:
- Encryption in transit (TLS 1.2+) and at rest
- Hashed API keys and passwords (bcrypt)
- Role-based access control and tenant isolation
- Regular security audits and dependency monitoring
- Two-factor authentication (2FA) available for all accounts
No system is 100% secure. If we become aware of a data breach that affects your personal data, we will notify you and the relevant supervisory authority in accordance with applicable law.
10. Children's Privacy
The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will promptly delete it.
11. Third-Party Links
The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any personal data.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or a prominent notice on the Service at least 30 days before the changes take effect. The "Last updated" date at the top indicates the most recent revision.
13. Contact
For any privacy-related questions or requests, contact us:
Nutrigen Sp. z o.o.
ul. Tadeusza Kosciuszki 25/5
50-011 Wroclaw, Poland
NIP: 897-188-11-25 · KRS: 0000851334
Email: [email protected]