Privacy policy

1. Two roles we play

Controller: for data about the businesses that use our service (account holders, their staff and anyone who contacts us), we decide how it is used.

Processor: for data about our clients' own customers (names, mobile numbers, email addresses, ratings and feedback), the business is the controller and we process it only on their instructions, under our Data Processing Agreement.

2. What we collect

• Account data: name, business name, email, phone, address, billing details (card payments are handled by our payment provider; we never see full card numbers).
• Staff data our clients add: names and photos used for personalised thank-you images.
• Customer data our clients provide: first name, surname, mobile, email, visit date and which staff member served them.
• Survey data: star ratings, written feedback and whether a review link was clicked.
• Technical data: login session, IP address and device information needed to keep the service secure.

3. Why we use it and our legal basis

• To provide the service under our contract with the business (Art. 6(1)(b) GDPR).
• To send review requests on the business's instructions. The business must assess and document its lawful basis and meet applicable electronic marketing rules, including consent where required. An existing-customer relationship alone does not automatically authorise every message. Customers can opt out using the message's opt-out option or by contacting us.
• To bill, prevent fraud and meet legal and tax obligations (Art. 6(1)(c)).
• To improve and secure the service (legitimate interests).

4. Who we share it with

We use carefully chosen sub-processors: cloud hosting and database, SMS and WhatsApp delivery (Twilio, Meta), email delivery, AI services used to draft review replies and create sign photos, payment processing, and Google (when a business connects its Google Business Profile). We never sell personal data.

Some providers are based outside the EEA/UK. Where they are, we rely on adequacy decisions or Standard Contractual Clauses.

5. How long we keep it

• Personalised sign photos: deleted automatically after 90 days.
• Customer records and messages: for as long as the business keeps its account, or until the business or the customer asks for deletion.
• Opt-out records: kept so we never message that person again.
• Account and billing records: for the period required by Irish and UK tax law (generally 6 years).

6. Your rights

You can ask for access, correction, deletion, restriction, portability, or object to processing. To stop review requests, use the opt-out option in your message or contact us. Opting out does not itself delete your data. For deletion or other rights, email us; we coordinate with the business and retain only records necessary to honour opt-outs or meet legal obligations. We respond within one month.

You can complain to the Data Protection Commission (Ireland, dataprotection.ie) or the Information Commissioner's Office (UK, ico.org.uk).

7. Security

Data is encrypted in transit, photos are stored privately and shared only by short-lived links, access is restricted by account, and Google connection tokens are encrypted.

8. Acquisition funnel analytics

On the review-opportunity funnel, essential session storage keeps your selected business and progress, and a short-lived random hand-off links that selection to account setup. If you allow analytics, Ranknua stores a random session identifier, the funnel stages visited, campaign UTM labels, your consent choice and notice version, and confirmed trial or subscription outcomes to measure the acquisition journey. These records are stored with our cloud hosting/database provider. We do not send these funnel events or account matching data to Meta. Reject analytics to use the funnel without that measurement; withdraw through the funnel’s Cookie settings at any time. Withdrawal stops new events, including delayed billing measurement. Contact us to request deletion of earlier records. Public Google review information is fetched for the displayed comparison rather than saved as historical visitor data.

9. Cookies

The main website uses essential cookies and storage. The acquisition funnel offers optional first-party analytics with a separate consent choice; rejection is as easy as acceptance. See the funnel’s Cookie settings to change your choice.

10. Changes

We will post any changes here and, for significant changes, tell account holders by email.