Privacy Policy

Last updated: 13 October 2026

Who we are

This policy explains how Rhino Rank Ltd ("Rhino Rank", "we", "us") uses personal data on our websites and in our services. It covers www.rhinorank.io, app.rhinorank.io, go.rhinorank.io and our other rhinorank.io sites.

Rhino Rank Ltd is the controller of your personal data. We are registered in England and Wales under company number 10849738. Our address is 5 Knights Court, Archers Way, Battlefield Enterprise Park, Shrewsbury, Shropshire, England, SY1 3GA. For anything about this policy or your data, email hello@rhinorank.io.

What we collect

• Account details: your name, email address, username, company, country and password (we store only a scrambled, hashed form of it). If you sign up with Google, Google gives us your name, email address and profile picture.
• Billing and order details: billing name and address, phone number, VAT number, invoice email, what you order and the details needed to deliver it (such as target pages, anchor text, content and press release details), invoices and payment status. Stripe and PayPal handle card and PayPal payments; we never see your full card number.
• Messages and calls: emails and chat messages you send us, and calls you book with us, including what you tell us about your website and goals.
• Technical and usage data: your IP address and browser details when you sign up, sign in or use your account, the pages you visit, what you click, errors you run into and the website that sent you.
• How you found us: campaign tags (utm values) and ad click IDs in the link you arrived on (such as Google's gclid, Microsoft's msclkid, Meta's fbclid, LinkedIn's li_fat_id, Reddit's rdt_cid and X's twclid), the page that referred you and the page you landed on.
• Your choices: your cookie choices, your marketing email preference and your ads choice.
• Affiliate referrals: if you arrive through an affiliate link, which affiliate referred you, with your IP address and the referring page at the time of the click. If you join our affiliate programme, the PayPal email address we pay you at.

How we use your data, and our lawful bases

• To run your account, take payment, deliver your orders and support you. Basis: it's needed for our contract with you.
• To send you service emails about your account and orders. Basis: our contract with you.
• To keep invoices, tax and accounting records, and to check VAT numbers with the EU's VIES service. Basis: legal obligation.
• To keep our sites and your account secure and stop abuse, including bot checks when you sign up or sign in and records of sign-ins. Basis: our legitimate interest in protecting our service and our customers.
• To understand how our sites and services are used, fix errors and improve them. Basis: your consent for analytics cookies and session recordings; our legitimate interest in running and improving our service for records of the actions in your account and for error reports.
• To send you marketing emails with link-building tips and offers. When you create an account we add you to these emails, and you can unsubscribe at any time with the link in any of them. Basis: our legitimate interest in telling our customers about our services.
• To measure which ads and campaigns bring us sign-ups and orders, and to show you relevant Rhino Rank ads. Basis: your consent for marketing cookies and for sending your identifiers to ad partners; our legitimate interest in understanding and improving our marketing for our own campaign records, order reporting and audience lists. See Advertising and measuring our ads.
• To pay affiliates for the customers they refer. Basis: our legitimate interest in running our affiliate programme.

Where we rely on legitimate interests, you can object at any time (see Your rights).

Advertising and measuring our ads

We advertise with Google, Microsoft (Bing), Meta (Facebook and Instagram), Reddit, X (Twitter) and OpenAI (ChatGPT). We work with them in four ways.

Tags and cookies on our sites. These partners' tags record visits and actions on our sites, such as creating an account or paying for an order, so they can tell us which ads work and show you relevant Rhino Rank ads. They need your consent to marketing cookies. In the UK, the EEA and Switzerland they stay off until you allow marketing cookies in our cookie banner; elsewhere they're on unless you turn them off in your cookie settings. Google's tags load either way: without your consent they set no cookies and send Google only limited signals without cookie identifiers (Google calls this consent mode). When you're signed in, our tag manager also receives your Rhino Rank user ID and, after a payment, your order number, value and currency.

Sign-up, call and order reporting from our servers. When you create an account, book a call with us or pay for an order, our servers report it to Google Ads with the ad click ID from the link you arrived on, the time and a value: the amount for orders, and for sign-ups an estimate we set from your country and the type of email address you used. If you've consented, we also send a hashed copy of your email address, first name and last name so Google can match the event to its user. If you haven't, we send only the click ID, marked as not consented. We report the same events to Microsoft Advertising, with Microsoft's click ID, only if you've consented. If you never made a choice and you're outside the UK, the EEA and Switzerland, we treat consent as given, as our cookie banner does there. If an order is refunded, we report that too.

Order reporting from our customer records. Unless you've opted out (see below), we send Google a hashed copy of your email address with the value of your first and later orders, so Google can measure orders that came from our ads.

Audiences. Unless you've opted out (see below), we send a hashed copy of your email address to Google (Customer Match) and to X. They match it against their own users to show you relevant Rhino Rank ads, to avoid showing ads to existing customers, and to reach businesses similar to our customers. A hash can only be matched by someone who already has your email address; it doesn't reveal it to anyone else. We update Google's lists daily. X keeps an entry for up to 13 months after we last sent it.

Unsubscribing from our marketing emails changes neither the order reporting nor the audiences above. To stop them, email us at hello@rhinorank.io, and we stop sending your email address from the next daily update. If you ticked the ads box when you signed up, you can also turn off Ads in your account settings. If we showed you an ads or marketing-cookies box when you signed up and you left it unticked, we don't send it.

How the partners use data. Each partner also uses this data under its own privacy policy: Google (see also how Google uses information from sites or apps that use its services), Microsoft, Meta, Reddit, X and OpenAI.

Your choices. Change your choice at any time in your cookie settings. To stop us sending your details for order reporting and audiences, email hello@rhinorank.io. You can also manage the ads you see in Google's My Ad Center and in each partner's ad settings.

Our own campaign tracking

When you first visit any of our sites, we set a cookie called rrlid that holds a random ID. When the link you arrived on carries campaign tags or an ad click ID, or when you make a cookie choice, our servers store them with that ID, together with the page that referred you, the full address of the page you landed on and your cookie choice. We don't store your IP address with this record. When you create an account or sign in, we link the record to your account so we know which campaign brought you. We also keep campaign tags for 30 days in cookies whose names start rr_utm_ and rhino_utm_. Our own sites set these cookies when you arrive; the cookie banner doesn't control them.

Analytics and session recordings

PostHog (hosted in the EU and reached through our own address, edge.rhinorank.io) shows us how our sites and services are used. With your consent to statistics cookies, it records the pages you view, what you click, errors, heatmaps and session recordings (a replay of what happened on screen), with everything typed into form fields hidden. When you're signed in, it links this to your account (user ID, name and email address). PostHog doesn't store your IP address. Separately, our servers send PostHog a record of the actions in your account, such as sign-ups, sign-ins and orders, and reports of errors, so we can run and improve the service. These don't use cookies or depend on your cookie choice.

Google Analytics measures visits with your consent to statistics cookies. If an order is refunded, we report the refund to it.

Ahrefs Web Analytics counts visits with your consent to statistics cookies.

On go.rhinorank.io we also count page views and compare page versions without cookies, using a code made from your IP address and browser that changes every day. We don't store your IP address, and we delete each day's key after two days, so the codes can't be linked over time.

Who we share data with

We share personal data only with these recipients, and only what each one needs:

• Payments: Stripe and PayPal.
• Hosting, delivery and security: our hosting providers; Cloudflare, which delivers our sites and runs the Turnstile bot check at sign-up and sign-in (it receives your IP address); and the services that deliver fonts and scripts to our pages (Google Fonts, jsDelivr, jQuery and DataTables), which see your IP address.
• Email: MailerSend sends account and order emails. MailerLite sends marketing emails and holds your email address and name.
• Support and calls: Tidio runs the chat on www.rhinorank.io. Calendly runs call booking and receives your name, email address and what you tell us for the call.
• Analytics: PostHog, Google and Ahrefs, as described above.
• Advertising: Google, Microsoft, Meta, Reddit, X and OpenAI, as described above.
• Order fulfilment: publishers, writers and outreach partners receive the order details needed to deliver your order. For press releases, our newswire distribution partner receives the release and its contact details.
• AI services: we use OpenAI, and Google and Anthropic models through OpenRouter, to draft proposals and campaign plans from your name, website, goals and keyword data.
• Our team's tools: our order-management, CRM and messaging tools (including Slack) receive the account and order details our staff need.
• VAT checks: the EU's VIES service receives your VAT number.
• AI assistants you connect: see Connecting an AI assistant to your account.
• Others when needed: professional advisers, authorities when the law requires it, and a buyer if our business is sold.

International transfers

Some of these providers process data outside the UK, including in the United States. When they do, we rely on the UK's adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or on the UK's approved data transfer agreements and contract clauses. Contact us for details.

How long we keep data

We keep your account, order and campaign records while your account exists. If you close your account or ask us to delete your data, we delete or anonymise it, except what we need to keep for tax, accounting, legal or security reasons. Cookies last for the periods in our cookie policy. Other periods are given in the sections above and below.

Your rights

You have the right to:

• get a copy of your personal data;
• have inaccurate data corrected;
• have your data deleted, or its use restricted, in some circumstances;
• receive the data you gave us in a portable format;
• object to our use of your data based on legitimate interests, and always to direct marketing; and
• withdraw your consent at any time. This doesn't affect what we did before you withdrew it.

To use any of these rights, email hello@rhinorank.io. We'll reply within one month.

If you're unhappy with how we use your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. If you're in the EEA, you can complain to your local data protection authority.

Security

Our sites use encrypted (HTTPS) connections, and we store passwords only in hashed form.

Children

Our services are for businesses and people aged 18 or over. We don't knowingly collect data from children.

Changes to this policy

When we change how we use personal data, we update this page and the date at the top.

Connecting an AI assistant to your account

You can connect an AI assistant such as Claude or ChatGPT to your Rhino Rank account. You approve the connection on our website, and the assistant never sees your password. Tools that cannot sign in this way use a personal API key you create on the AI Assistants page of your account.

What we receive. When the assistant uses the connection we receive the request it sends: which action to take and the details needed for it, for example an order number, the lines of an order, a change to your name, billing or invoice details, or the company, contact and release details of a press release. We do not receive your conversation with the assistant. If you ask the assistant to contact us, or it reports a problem with the connection, we receive the message or report it writes. We also record the time of each request, which action it was, whether it succeeded, and the network address it came from, which is usually the assistant provider's server. When the assistant connects, it reports its app's name and version, such as Claude or Cursor, and we keep those with the connection.

What we use it for. To carry out the action on your account, to keep a record of changes made to your account, to protect the service from misuse, and to understand how the connection is used so we can improve it.

Who receives it. The data stays in your Rhino Rank account and is handled like the same data entered on our website. We keep a record of each change made through an assistant, with the details submitted, in our own activity log. Our analytics provider, PostHog, receives a note that a change was made, which action it was and its outcome, without the details submitted. Press release content and contact details go to our newswire distribution partner when you approve a release, as they do for a release ordered on the website. The assistant you connect receives the results of the actions it takes, such as your orders and account details, and its provider handles them under its own privacy policy.

How long we keep it. A connection stays active while it is used. It ends when you disconnect it, when you change or reset your password, or after 90 days without use. A personal API key ends on the expiry date you chose (30, 90 or 365 days, or no expiry), when you revoke it, or when you change or reset your password. Records of changes made through an assistant are kept with your account's history and are not deleted automatically. Order and press release data is kept with your account, as it is for orders placed on our website.

Your choices. You can disconnect an assistant or revoke an API key at any time on the AI Assistants page of your account, or disconnect inside the assistant. Disconnecting ends its access straight away. To ask for a copy of your data or to have it deleted, email hello@rhinorank.io.