Privacy Notice.

Outrankfast act as controller for the personal data described here, which means we decide why and how it is processed. We process personal data under the Law of Ukraine "On Personal Data Protection" No. 2297-VI and, where it applies to you, under Regulation (EU) 2016/679 (GDPR) and the UK GDPR.

This Notice covers personal data processed through outrankfast.app and its subdomains, the Outrankfast web application, our API and our MCP server, together the "Services". Defined terms not explained here carry the meaning given in our Terms of Use.

Account data. Your name, email address, authentication identifiers and password credentials held in hashed form, account settings, and your plan and subscription status.

Data about your sites. The domains you register, the publicly accessible HTML we fetch from them, the technical findings produced from that HTML, the brand and competitor names you enter, and the buying questions you track. This data concerns your website rather than you personally, though it may contain personal data where your site publishes it, for example a name in an author byline or a contact email in a page footer.

Content you generate. Prompts, drafts, suggestions and measurement results held in your account.

Usage and technical data. IP address, browser and device information, operating system, approximate location derived from IP address, pages viewed, features used, clicks, session duration, referring URL, timestamps, API and MCP request metadata, and error and diagnostic logs.

Session analytics. Microsoft Clarity records interaction data such as pointer movement, scrolling, clicks and page views, which we review in aggregate and as session replays to understand how the interface performs.

Communications. Anything you send us by email or through support, including the content of your message and any attachment.

Payment-related data. Paddle collects and processes your payment details. We never receive or store your card number. We receive the transaction record, which includes your email address, the plan purchased, the amount, the currency, the country used for tax determination and the subscription status.

We collect nothing about you from data brokers or similar sources.

To provide the Services under our contract with you: creating and running your account, authenticating you, fetching and analysing your registered domains, running measurements against AI engines, generating drafts, delivering results through the web application, the API and the MCP server, and providing support. Legal basis: performance of a contract.

To operate billing and subscriptions: activating, renewing, upgrading and cancelling plans, and reconciling transactions with Paddle. Legal basis: performance of a contract, and compliance with a legal obligation for accounting and tax records.

To secure the Services: detecting and preventing cyberattacks, abuse, credential stuffing, fraud and automated misuse, enforcing rate limits, and investigating incidents. Legal basis: our legitimate interest in the security and integrity of our systems and our users' accounts.

To understand how the Services are used and improve them: analysing usage patterns, reviewing session analytics, diagnosing errors, prioritising features and testing changes. Legal basis: our legitimate interest in developing and improving a product that works for the people who pay for it.

To communicate with you: service messages, security notices, changes to these documents, billing notifications and responses to your requests. Legal basis: performance of a contract, and our legitimate interest in administering the relationship.

To comply with law and defend claims: retaining records required by Ukrainian tax and accounting rules, responding to lawful requests from authorities, and establishing, exercising or defending legal claims. Legal basis: compliance with a legal obligation, and our legitimate interest in defending our rights.

Where we rely on legitimate interest, we have weighed that interest against your rights and freedoms and concluded that our processing does not override them. You may object to it as described in Section 9, and we will stop unless we can show compelling legitimate grounds.

To send product updates, and only to people who asked for them: we ask separately during setup, with the box unticked, and the switch is under Data and privacy in your settings. Legal basis: consent. Withdrawing it is one click in any such email, or that same switch, and it does not affect anything sent beforehand. Service messages and billing notices in this Section continue either way, because those are about your account.

We run no advertising. We use no advertising network, we run no tracking pixel for one, and we sell nothing about you to anybody.

5.1. When the Services measure AI visibility or generate a draft, we send the relevant query to Google's Gemini models through Vertex AI, grounded with Google Search. Those queries contain the buying questions, brand names, competitor names and site content associated with your account.

5.2. Google processes that data as our service provider under the Google Cloud terms and data processing terms in force between us.

5.3. We do not use your data to train our own artificial intelligence models.

5.4. Do not enter personal data, confidential information or anything sensitive into prompts or tracked questions unless it is needed for the analysis you want.

Google (Google Cloud Platform, Vertex AI, Google Workspace). Hosting, storage, database, logging, AI model access and our business email. Acting as our processor.

Microsoft (Microsoft Clarity). Session analytics and interaction recording. Acting as our processor.

Brevo (Sendinblue). Delivery of email we send you, and the contact record behind it: your address, your name, the plan you are on and whether you asked for product updates. Established in the European Union and acting as our processor.

Paddle. Merchant of record for all purchases. Paddle processes your payment data as an independent controller under its own privacy policy at paddle.com/legal/privacy, and we receive transaction records back from it.

Professional advisers and authorities. Accountants, lawyers, courts and state authorities, where necessary for compliance, for an audit, or to establish or defend a legal claim.

A successor in a business transfer. If we sell or transfer the business or its assets, your data may transfer as part of that transaction, subject to the protections in this Notice.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

7.1. We operate from Ukraine, and our infrastructure providers process data in the European Union and in other countries where they maintain facilities. Your data may therefore be transferred to, stored in and accessed from countries outside your own.

7.2. Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses, the UK Addendum or another lawful transfer mechanism in the agreements with our providers. Ukraine benefits from Council of Europe Convention 108+ and maintains data protection legislation adopted for alignment with European standards.

7.3. Write to hello@outrankfast.app for details of the safeguards applied to a specific transfer.

Account and content data: for as long as your account remains open, and for 12 months after you close it or after prolonged inactivity, after which we delete or anonymise it.

Measurement history: for the retention window stated for your plan, and in any event no longer than the period in the preceding paragraph.

Billing and tax records: for the period Ukrainian accounting and tax law requires, currently at least 1095 days from the end of the relevant reporting period.

Security and access logs: up to 12 months, or longer where we are investigating an incident.

Session analytics: for the retention period applied by Microsoft Clarity, which does not currently exceed 13 months.

Support correspondence: up to 3 years from the last message.

Where a legal claim is pending or reasonably anticipated, we keep the relevant data until it is resolved.

Subject to the conditions in the law applicable to you, you may ask us to confirm whether we process your personal data and to give you access to it or a copy, to correct data that is inaccurate or incomplete, to delete your data, to restrict our processing, to provide your data in a portable machine-readable format or transmit it to another controller, and to stop processing carried out on the basis of legitimate interest by objecting to it. Where we rely on consent for anything, you may withdraw that consent at any time, and the withdrawal does not affect processing already carried out.

We do not make decisions producing legal or similarly significant effects about you by automated means alone.

Write to hello@outrankfast.app to exercise any right. We respond within 30 calendar days, and we may ask for information reasonably needed to verify your identity. We charge nothing unless a request is manifestly unfounded or excessive.

If you are in the European Economic Area, the United Kingdom or Switzerland, you may lodge a complaint with your national supervisory authority. In Ukraine, you may complain to the Ukrainian Parliament Commissioner for Human Rights. We would rather hear from you first.

10.1. We use cookies and local storage that are strictly necessary to run the Services, including for authentication, session management, security and load balancing. These cannot be switched off without breaking the application.

10.2. We use Microsoft Clarity to understand how the interface is used. Clarity sets its own identifiers and records interaction data.

10.3. You can block or delete cookies through your browser settings. Blocking necessary cookies will prevent you from signing in.

10.4. We do not respond to Do Not Track browser signals, because no common standard for handling them exists.

11.1. We encrypt data in transit, store credentials in hashed form, restrict administrative access to the people who need it, and rely on the security controls of Google Cloud for our infrastructure.

11.2. No system is completely secure, and we cannot guarantee the security of data you transmit to us. You are responsible for keeping your credentials, API keys and MCP tokens confidential.

11.3. Where a breach of personal data occurs that is likely to result in a risk to your rights, we notify you and the competent authority as the applicable law requires.

The Services are not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, write to hello@outrankfast.app and we will delete it.

The Services contain links to third-party websites, and we analyse third-party content as part of the measurement we provide. We do not control those sites and take no responsibility for their privacy practices. Read their notices before giving them your data.

We may amend this Notice at any time at our sole discretion. We publish the amended version on the Site with a new effective date, and where the change is material we notify you by email or in the application. Continued use after the effective date means you accept the amended version. Check this Notice, the Terms of Use and the Refund Policy from time to time.

hello@outrankfast.app

Rostyslav Shuleshko