RankPilotAI – Privacy Policy
Last updated: 20 October 2026
1. Introduction
This Privacy Policy explains how RankPilotAI (“we”, “our”, “us”) collects, uses, shares and protects personal information when you visit rankpilotai.com, install our WordPress plugins (AI Alt Text Builder, AI Snippet SEO Helper, AI Snippet SEO Pro) or use our API (together, the “Services”).
2. Data Controller and Data Protection Officer
RankPilotAI is a sole proprietorship owned by Mehmet Volkan Uludag and established in Turkey. Mehmet Volkan Uludag is also our designated data protection officer. Contact: [email protected]. If RankPilotAI is incorporated in the future, this policy and its obligations transfer to the successor entity.
3. Information We Collect
| Category | Examples | Purpose |
|---|---|---|
| Account Data | Name, email, password (stored only as a hash), site domain(s), license tokens | Create and manage your account and licenses |
| Payment Data | Card brand, last 4 digits, expiry and billing country (handled by Stripe Checkout; we never receive full card numbers) | Subscriptions and token purchases |
| Usage Data | Token consumption per site and billing period | Quotas, billing and abuse prevention |
| Log Data | IP address, time, request path, browser or user agent | Security and operations |
| Customer Content | Image URLs, file names and existing alt text sent by our plugins; page titles and text sent for SEO snippets; custom instructions you configure | Generate the AI output you request |
| Support Data | Emails and attachments you send us | Support and invoicing |
| Cookies | Login and session cookies; Google Analytics on rankpilotai.com; Stripe Checkout cookies | Sessions, site analytics and payments |
4. How AI Processing Works
- Images are processed by URL. Our server passes the image’s public URL and our instruction prompt to the AI provider, which fetches the image directly. We do not download or store your images.
- We keep no copy of the output. AI output (alt text, titles, descriptions) is returned to your WordPress site and saved there.
- AI providers. Anthropic (Claude API) is our primary provider. OpenAI is used automatically if Anthropic is unavailable, and directly from your site if you use BYOK mode with your own OpenAI key.
- Institutional plans. Requests from a site that uses an institutional key go to a dedicated RankPilotAI service for that institution on Cloudflare Workers (edu-<institution>.rankpilotai.com). Its requests are set to run in the United States, its data is stored in the United States, and it never passes through our server in Turkey. It sends the image URL and our instruction prompt only to Anthropic, processed in the United States, with no fallback to another AI provider. It stores a hash of the site key, the institution’s site domains, the plan and usage counters (Cloudflare D1, United States) and a request log that contains no image addresses, file names or text.
- No training on your data. We do not use your content to train AI models. Under their commercial API terms, Anthropic and OpenAI do not use API data to train their models, and they delete API inputs and outputs within 30 days by default, except where longer retention is required by law or to enforce their usage policies.
5. How We Use Information
We use personal information to provide and secure the Services, process payments, manage licenses and quotas, respond to support requests, send service and billing notices, and meet legal obligations. We do not sell personal data, show ads or build profiles.
6. Legal Bases
- Contract – to deliver the Services you request and manage your account
- Legitimate interests – to secure the Services and prevent abuse
- Consent – for analytics cookies on rankpilotai.com (you may withdraw consent at any time)
- Legal obligation – to meet accounting, tax and regulatory requirements
7. Service Providers (Subprocessors)
| Provider | Purpose | Location |
|---|---|---|
| Anthropic | AI processing (primary) | United States |
| OpenAI | AI processing (fallback; BYOK mode) | United States / global |
| Cloudflare | Network security, TLS and content delivery; Workers, D1 and R2 for institutional plans | Global (institutional plans: United States) |
| Saga Network | Server hosting for rankpilotai.com and our API | Turkey |
| Stripe | Payment processing | United States |
| Google (Workspace, Analytics) | Email and support; website analytics | United States / global |
We also disclose information when required by law (a valid court order or legal obligation) or in connection with a merger or acquisition.
8. International Transfers
Our servers are in Turkey. Anthropic processes our AI requests in the United States (we pin every request to US processing); OpenAI, used only as a fallback, may process data in its global infrastructure. Institutional plans keep their data in the United States: requests are set to run on Cloudflare Workers in the United States, data is stored in Cloudflare D1 and R2 in the United States, and AI processing is by Anthropic in the United States. Cloudflare receives traffic at its nearest data center, and scheduled tasks such as the daily backup may run in any Cloudflare data center. We rely on our providers’ data processing terms and standard contractual safeguards for these transfers.
9. Data Retention
- Account and license data – for the life of the account; deleted within 30 days of a deletion request, except records we must keep by law (for example, invoices)
- Usage counters – for the life of the account
- Web-server logs – 14 days
- Account activity log (sign-ins, failed sign-ins and account changes, with a partly masked IP address) – 30 days
- Database backups – 14 days
- Institutional request log (date, route, site domain, number of images, result and error code, quality tier, model, processing region and duration; no image addresses or text) – 90 days
- Institutional backups (Cloudflare R2, United States) – 35 days
- Institutional database history (Cloudflare D1 Time Travel, United States) – 30 days
- Institutional service logs (Cloudflare Workers Logs) – 7 days
- Customer content – not retained by us (see section 4)
10. Security
We use encryption in transit (TLS), a server that accepts no direct inbound web traffic (all traffic passes through Cloudflare), key-only administrative access, automatic security updates and nightly backups. No system is completely secure. If a breach affects your personal data, we will notify you without undue delay and within 72 hours of becoming aware of it, where required.
11. Your Rights
Depending on where you live (including under Turkey’s Law No. 6698 on the Protection of Personal Data and the GDPR), you may request access to, correction, deletion or export of your personal data, object to or restrict processing, and withdraw consent. Email [email protected]; we may ask you to verify your identity first. You may also complain to your data protection authority (in Turkey, the Personal Data Protection Authority, KVKK).
12. Cookies
We use three kinds of cookies on rankpilotai.com:
- Essential – login, session and checkout functions (cannot be disabled)
- Analytics – Google Analytics, to understand site usage
- Payment – set by Stripe during checkout
We do not use advertising or marketing cookies. Our WordPress plugins set no cookies on your website. You can manage non-essential cookies through our cookie banner or your browser settings.
13. Children
The Services are not directed to children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided data, please contact us for deletion.
14. Changes
We will post updates here and notify registered users at least 14 days before material changes take effect.
15. Contact
Email: [email protected]