← PulseRanker

Privacy Policy

Last updated: November 2026

1. Controller and Contact

PulseRanker ("we", "us") operates the website pulseranker.com. The data controller under Art. 4(7) GDPR is the operator named in our Legal Notice.

Contact for all privacy inquiries and requests: support@pulseranker.com

2. Data We Process, Purposes, and Legal Bases

  • Account & Authentication Data (Email address, password hash, user ID, timestamps): Processed to create and secure your account, handle sign-in, magic links, and password resets. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
  • Search Queries & Credit Ledger (Action type, search query, country, timestamps, credit balance changes): Processed to deliver search results, show your session history, and maintain an accurate credit ledger. Legal basis: Art. 6(1)(b) GDPR.
  • Purchase & Billing Records (Order ID, date, amount, credit pack, payment status, consent timestamp): Processed to grant purchased credits and comply with tax and commercial accounting laws. Legal basis: Art. 6(1)(b) and Art. 6(1)(c) GDPR.
  • Technical & Anti-Abuse Data (IP address, hashed network/device identifiers, rate-limit counters): Processed for security, fraud prevention, rate limiting, and free-trial abuse protection. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting our service from abuse).
  • Transactional Emails (Sign-in links, password resets, billing notices): Processed to operate your account. Legal basis: Art. 6(1)(b) GDPR.

3. Obligation to Provide Data & Automated Decision-Making

Providing a valid email address is required to create an account and purchase credits; without it, we cannot provide paid features (Art. 13(2)(e) GDPR). We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

4. Recipients and Data Processors (Art. 28 GDPR)

We do not sell personal data or share it for third-party advertising. We use the following service providers under data-processing agreements:

  • Database, Authentication & Edge Functions: Supabase, Inc. (USA), with project database and functions hosted in the European Union (Ireland, AWS eu-west-1).
  • Payment Processing: Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin, Ireland). Stripe processes your payment details directly; we never see or store your payment card numbers. Stripe also acts as an independent controller for fraud prevention and regulatory compliance (see stripe.com/privacy).
  • Search Engine Data Provider: DataForSEO. Only the searched keyword or domain and target country code are transmitted to fetch Google search metrics. No user email, user ID, or personal identifiers are ever sent to DataForSEO.
  • Application Hosting: Lovable (GPT Engineer, Inc.) for serving the web application frontend.
  • Transactional Email Delivery: Resend, Inc. for delivering sign-in magic links and password-reset emails.

5. International Data Transfers

Where service providers process data outside the EU/EEA (such as in the United States), transfers are safeguarded by an EU adequacy decision (the EU-US Data Privacy Framework) or Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR.

6. Browser Storage and Cookies

We use only strictly necessary browser storage (localStorage and sessionStorage) to maintain your sign-in session and display your active session searches. We do not use analytics, marketing, or tracking cookies.

7. Data Retention and Account Anonymization

  • Account Data: Retained while your account is active. When you request account deletion, your email address and authentication credentials are permanently erased/anonymized so that historical ledger records can no longer be associated with your person.
  • Billing & Accounting Records: Retained for 8 years (accounting vouchers pursuant to § 147 Abs. 3 AO / § 257 Abs. 4 HGB) and up to 10 years (books and financial statements) as required by German tax and commercial law.
  • Technical & Free-Trial Logs: Purged after 90 days.

8. Your Rights & Supervisory Authority

Under the GDPR, you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interests (Art. 21). To exercise these rights, email support@pulseranker.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority for our place of business is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

9. US and Canadian Residents

We do not sell or share personal information for cross-context behavioral advertising. You may request access to, correction of, or deletion of your personal information by emailing support@pulseranker.com.