GraphoRank · Digital Fshat SHPK
Privacy Policy
Last updated: 25 October 2026
This policy explains how GraphoRank collects and uses personal data when you visit graphorank.com, use the GraphoRank application, API, MCP server or tools, or contact us.
1. Who we are
The data controller is Digital Fshat SHPK, Bulevardi «Zog i Parë», Tirana, Albania, NUIS M61617002B (“GraphoRank”, “we”, “us”). For any privacy question or request, write to privacy@graphorank.com.
2. What we collect
- Account data: first and last name, email address, password (stored by our authentication provider, never by us in plain text), account and workspace identifiers, role, language preference.
- Usage data: actions in the app (sites added, scans, reports, settings), technical data needed to run and secure the Service (IP address, browser, device and request logs).
- Billing data: plan, subscription status and order references. Card and payment details are collected and processed by Paddle, our Merchant of Record; we never see your full card number.
- Communications: what you send us through the contact form (name, email, company, message), support tickets and emails.
- Data from websites you analyse: the public pages our crawler fetches for the sites you add. These are public web pages and may incidentally contain personal data published there.
- Connected accounts: if you connect Google Search Console or Google Analytics, the performance data of the properties you choose (queries, pages, clicks, sessions). You can disconnect at any time.
- Website analytics: aggregated visit statistics measured with Plausible Analytics, which we host ourselves. It uses no cookies and does not identify you.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Create and run your account, provide the Service, crawls, scores, reports and support | Performance of a contract |
| Billing, tax and accounting through Paddle | Performance of a contract; legal obligation |
| Security, abuse and fraud prevention (including bot protection at sign-up) | Legitimate interests |
| Improving the Service from aggregated usage and website statistics | Legitimate interests |
| Answering your messages and requests | Pre-contractual steps or legitimate interests |
| Product and service emails about your account | Performance of a contract |
| Marketing emails | Consent, which you can withdraw at any time |
4. Who processes it for us
We share personal data only with providers that help us run the Service, under contracts that protect it:
- Hetzner Online GmbH (Germany): servers, databases, backups and file storage. Our infrastructure is hosted in the European Union.
- Clerk, Inc. (United States): sign-up, sign-in and session management, including bot protection by Cloudflare, Inc. (Turnstile).
- Paddle.com (United Kingdom): checkout, payments, invoices, taxes and refunds, acting as Merchant of Record and independent controller for payment data.
- Resend, Inc. (United States): delivery of account and report emails.
- Google LLC / Google Ireland Ltd.: our business email (Google Workspace) and, only if you connect them, Search Console and Analytics.
- AI and data providers that process website content, prompts and keywords to produce scores, recommendations and AI-visibility results: OpenAI, Google (Gemini), Anthropic, Perplexity, DataForSEO and Firecrawl. They receive the content needed for the task, not your account profile, and are used under terms that do not allow them to train their models on your data.
We do not sell personal data and we do not share it for advertising.
5. International transfers
Some providers process data outside your country, including in the United States. Where required, transfers rely on adequacy decisions (such as the EU-U.S. Data Privacy Framework) or on the European Commission’s Standard Contractual Clauses.
6. How long we keep it
- Account data: for as long as your account is active, and deleted within 30 days after you close it.
- Database backups: up to 14 days.
- Billing records: as long as tax and accounting law requires.
- Support conversations: up to 24 months after the last message.
- Technical logs: only as long as needed for security and troubleshooting.
7. Your rights
You can ask to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw consent at any time. Write to privacy@graphorank.com; we answer within one month. You can also complain to a data protection authority: in Albania, the Information and Data Protection Commissioner; in the European Union, the authority of the country where you live or work.
8. Security
We use encryption in transit, access controls, tenant isolation in our database, least-privilege credentials and monitored backups. No system is perfectly secure; if a breach affects your data, we will inform you and the competent authority as the law requires.
9. Children
The Service is for professional use and is not intended for anyone under 18.
10. Cookies
How we use cookies is explained in our Cookie Policy.
11. Changes
We may update this policy. We will tell you about material changes by email or in the app before they take effect.