Privacy Policy

Last updated: 2 August 2026

This policy explains what personal data we process on the Bigrank website and in the Bigrank app, why, on what legal basis, and the rights you have.

01 Controller

The controller responsible for data processing is:

Kevin Baum — 57Marketing
c/o Autorenglück #19414
Albert-Einstein-Straße 47
02977 Hoyerswerda
Germany

Email: hello@bigrank.io
Phone: +49 176 75730410

This policy covers both the Bigrank marketing website (the “Website”) and the Bigrank application (the “Service”). The two run on different infrastructure, which is why hosting is described separately in sections 05 and 06. We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the German Telecommunications Digital Services Data Protection Act (TDDDG).

02 Legal bases

Where we process personal data, we rely on one of the following legal bases under Art. 6 (1) GDPR:

• Consent (lit. a) — e.g. analytics and marketing cookies;
• Performance of a contract (lit. b) — e.g. providing your account and the Service;
• Legal obligation (lit. c) — e.g. statutory retention of invoices;
• Legitimate interests (lit. f) — e.g. the security and stable operation of our systems.

For the storing of, or access to, information on your device we additionally rely on § 25 TDDDG (consent, or the strict-necessity exception).

03 Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure (Art. 17);
• restriction of processing (Art. 18);
• data portability (Art. 20);
• object to processing based on our legitimate interests (Art. 21); and
• withdraw consent at any time with effect for the future (Art. 7 (3)).

To exercise these rights, contact hello@bigrank.io. You also have the right to lodge a complaint with a supervisory authority. For our seat, this is the Saxon Data Protection and Transparency Officer (Sächsischer Datenschutz- und Transparenzbeauftragter).

04 Categories of data we process

• Usage & device data — IP address, browser, device, pages visited, and (with consent) analytics identifiers.
• Account data — name, email address, password (stored only as a hash), workspace and settings.
• Connected-website data — the domains you connect, access credentials or tokens, and content we read to understand your brand and publish articles.
• Search performance data — clicks, impressions, queries and average position retrieved from Google Search Console for the properties you connect.
• Content data — keywords, briefs, and the articles and social posts generated and published for you.
• Social account data — access tokens and page or profile identifiers for the social accounts you connect for auto-posting.
• Billing data — name, email, billing address, plan, and transaction data (card data is handled by our payment provider, not stored by us).
• Communications — the content of your support requests and correspondence.

05 Website hosting

Our marketing website is built and hosted with Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (“Webflow”). Webflow processes data on our behalf under a data processing agreement (Art. 28 GDPR). Content is delivered through Webflow’s global content delivery network.

When you access the Website, Webflow automatically records server log data including your IP address, browser type and version, operating system, referrer URL, and the time of the request. This is used for the technical operation, security, and integrity of the site. Legal basis: our legitimate interest in a secure and performant website (Art. 6 (1)(f) GDPR).

Webflow is based in the USA. Transfers are safeguarded by the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. See webflow.com/legal/privacy.

06 Application hosting and server logs

The Bigrank application is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA (“Vercel”), acting as a processor under a data processing agreement (Art. 28 GDPR). Our deployment region is located in the European Union, so application data is processed on servers within the EU.

Please note that Vercel is a US-incorporated company. Even with EU-region hosting, access from the USA cannot be entirely excluded, which is why transfers remain safeguarded by the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

The hosting infrastructure automatically records server log files containing: browser type and version, operating system, referrer URL, host name of the accessing device, time of the request, and IP address. This data is used solely for the technical operation, security, and integrity of our systems, is not merged with other sources, and is deleted after a short period. Legal basis: Art. 6 (1)(f) GDPR, and for the delivery of the Service also Art. 6 (1)(b) GDPR.

07 Fonts and content delivery

Our pages use the Rubik typeface. Where this font is loaded from Google’s font servers (Google Ireland Limited / Google LLC), your IP address is transmitted to Google in order to deliver the file. Legal basis: consent (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG); the font is loaded only after you have accepted. See policies.google.com/privacy.

08 Cookies and consent management

We use cookies and comparable technologies (such as local storage). Some are strictly necessary to run the site and to remember your cookie choice; these rely on Art. 6 (1)(f) GDPR and § 25 (2) TDDDG.

All optional cookies and tools — in particular analytics and marketing — are used only with your prior consent (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG). On your first visit, a consent banner lets you accept all, reject all, or choose per category. Nothing optional loads before you opt in, and you can change or withdraw your choice at any time here: Cookie settings. Withdrawal does not affect the lawfulness of processing performed beforehand. For Google services we use Google Consent Mode, set to “denied” by default until you consent.

09 Web analytics

Google Analytics 4

With your consent, we use Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). It uses cookies to analyse how you use the site. IP anonymisation is enabled, so your IP is shortened within the EU/EEA before any transmission. Legal basis: consent (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG). Data may be transferred to the USA under the EU Standard Contractual Clauses and the EU–US Data Privacy Framework. See policies.google.com/privacy.

Google Tag Manager

We use Google Tag Manager (Google Ireland Limited) to manage tags. Tag Manager itself does not store personal data in cookies; it only triggers other tags, and tags requiring consent run only after you consent.

Vercel Web Analytics

With your consent, we use Vercel Web Analytics (Vercel Inc.) for aggregate traffic measurement. It is privacy-friendly and does not use cookies to identify individual visitors. Legal basis: consent (Art. 6 (1)(a) GDPR).

10 Marketing

Google Ads and conversion tracking

With your consent, we use Google Ads (Google Ireland Limited), including conversion tracking, to measure our advertising. A cookie is set when you click one of our ads so that we and Google can recognise a completed action. This is not used to personally identify you. Legal basis: consent (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG).

Meta Pixel

With your consent, we use the Meta Pixel (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). It lets us measure interactions after you see or click a Meta ad and improve our campaigns. This may involve transfers to Meta, including to the USA under appropriate safeguards, and Meta may act as joint controller for parts of this processing. Legal basis: consent (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG). See facebook.com/privacy/policy.

11 Your account and authentication

To create and run your account, we use Supabase, Inc. (“Supabase”) as our database, authentication, and file-storage provider, acting as a processor under a data processing agreement (Art. 28 GDPR). Supabase stores your account data, workspace data, connected-website data, and generated content on our behalf.

Our Supabase project is hosted in the European Union. Where data is nonetheless processed outside the EU/EEA, transfers are safeguarded by the EU Standard Contractual Clauses. Legal basis: performance of the contract (Art. 6 (1)(b) GDPR).

12 AI content generation

The Service generates SEO articles and social posts using large language models. We route these requests through the Vercel AI Gateway (Vercel Inc.), which forwards them to the underlying model providers — currently including OpenAI, Anthropic, and Google, and potentially other providers available through the gateway. The current list of model providers is published at vercel.com/ai-gateway/models.

The data sent for generation includes your keywords, brand information, and content read from your connected website; the output is the generated article. We select providers that process this data only to deliver the response and do not use it to train their models. Processing takes place under data processing agreements (Art. 28 GDPR), with EU Standard Contractual Clauses where data is transferred outside the EU/EEA. Legal basis: performance of the contract (Art. 6 (1)(b) GDPR).

13 Connected websites and publishing

When you connect a website, you provide us with the credentials or access tokens needed to read your site and publish articles to it. We use this access solely to deliver the Service — analysing your site for brand and keyword context and publishing the content you schedule. You can disconnect a website at any time, which revokes our access. Legal basis: performance of the contract (Art. 6 (1)(b) GDPR).

If you enable auto-posting, we additionally store access tokens for the social accounts you connect (Facebook and Instagram via Meta Platforms Ireland Limited, and LinkedIn via LinkedIn Ireland Unlimited Company) and transmit the generated posts to those platforms on the schedule you set. The platform then processes the published content under its own privacy policy as an independent controller. You can revoke access at any time, both in Bigrank and in the platform’s own settings. Legal basis: performance of the contract (Art. 6 (1)(b) GDPR).

14 Google APIs and Search Console

To show you how your articles perform, we connect to Google APIs (Google Ireland Limited) on your behalf — in particular the Google Search Console API. When you authorise the connection via Google OAuth, we receive an access token and retrieve clicks, impressions, queries, and average position for the properties you select.

We request read-only access and use this data solely to display your performance inside the Service. Bigrank’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You can revoke our access at any time in your Google Account security settings. Legal basis: performance of the contract (Art. 6 (1)(b) GDPR).

15 Payments and billing

Payments are processed by Paddle, operated by Paddle.com Market Ltd, Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom, and its affiliates, acting as our merchant of record. This means Paddle is the seller of record for the transaction and independently processes your billing and payment data (name, email, billing address, payment method, and transaction details) as a separate controller for payment processing and tax purposes. We receive only the billing information needed to manage your subscription; we do not store full card details. Legal basis: performance of the contract and our legal obligations (Art. 6 (1)(b) and (c) GDPR). Please also review Paddle’s own privacy notice at paddle.com/legal/privacy.

16 Processors and subprocessors

We have concluded data processing agreements (Art. 28 GDPR) with the processors below. Where a provider is located in a third country, transfers are safeguarded by the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

17 International data transfers

Some of our providers are located in, or process data in, the United States or other third countries. In those cases we ensure an adequate level of protection through the EU Standard Contractual Clauses (Art. 46 GDPR) and, where the provider is certified, the EU–US Data Privacy Framework. You can request a copy of the relevant safeguards from us.

18 Data retention

We keep personal data only for as long as necessary for the purposes described, for the duration of your account, or as required by statutory retention periods (e.g. invoices under commercial and tax law). When the purpose no longer applies and no retention obligation remains, the data is deleted or anonymised. You can delete your account at any time, after which we remove your data subject to those retention obligations.

19 Data security

We use SSL/TLS encryption for data in transit (recognisable by the “https://” prefix and the lock icon) and apply appropriate technical and organisational measures to protect your data against loss, misuse, and unauthorised access. Passwords are stored only as salted hashes, and access tokens for connected websites and social accounts are stored encrypted.

20 Children

The Service is intended for businesses and adults. It is not directed at children, and we do not knowingly collect personal data from children under 16.

21 Contacting us

If you contact us by email or phone, we store your details to handle your request, on the basis of Art. 6 (1)(b) GDPR (pre-contractual or contractual matters) or Art. 6 (1)(f) GDPR (our interest in responding). We delete this data once it is no longer required and no retention period applies.

22 Changes to this policy

We may update this Privacy Policy to reflect changes to the Website, Service, or legal requirements. The current version, as published on this page, always applies.