Privacy Policy

Theme Press Pty Ltd is an Australian company operating under the trading name Ranki. We provide AI-powered SEO, content marketing, and digital marketing automation services to Australian small and medium-sized businesses through the platform at ranki.com.au and app.ranki.com.au.

Our registered address is Sydney, New South Wales, Australia. For all privacy matters, contact our Privacy Officer at [email protected]. We take privacy compliance seriously and have appointed a Privacy Officer responsible for overseeing our compliance with the Privacy Act 1988 (Cth) and the APPs.

2.1 Information You Provide Directly

• ▸Full name and business name
• ▸Email address - used for account access, service communications, billing notifications, and monthly performance reports
• ▸Business website URL and domain
• ▸Business niche/industry and geographic location (used exclusively for SEO targeting and content personalisation)
• ▸Phone number (optional; collected only during onboarding calls and not used for unsolicited contact)
• ▸WordPress application credentials (username and application password) - encrypted at rest using AES-256
• ▸Any other business information voluntarily provided during onboarding (e.g. target audience, competitors, unique selling points)

2.2 Third-Party Platform Credentials and Access Tokens

• ▸Google OAuth tokens - see clause 5A for the exact Google permissions we request and what each one is used for. We never delete anything in your Google properties.
• ▸WordPress application credentials - encrypted at rest, used exclusively to publish blog content and update SEO metadata. We never modify post body content you have written, or URL slugs.
• ▸Facebook and Instagram API access tokens - used solely to post content on your behalf
• ▸LinkedIn API tokens - used solely to post content on your behalf
• ▸YouTube API tokens - used to upload AI avatar videos to your connected channel

2.3 Website and SEO Data

• ▸SEO audit data from your website: page titles, meta descriptions, heading structure, internal links, HTTP status codes, word counts, and schema markup
• ▸Google Search Console data: keyword impressions, clicks, and average position
• ▸Google Analytics data: sessions, pageviews, and traffic source summaries
• ▸Keyword ranking data for your domain and specified competitor domains (publicly available data obtained via our SEO data provider)
• ▸AI-generated content published to your WordPress site (stored for reporting, refresh, and audit purposes)

2.4 Payment Information

All payment processing is handled exclusively by our payment processor, a PCI DSS Level 1 certified provider. Ranki does not collect, store, process, or have access to your credit card number, CVV, expiry date, or banking details at any time. We receive only a customer ID and subscription status confirmation from our payment processor.

2.5 Prospect Analysis Data

When our team analyses a prospective client's publicly available website data prior to a sales meeting or audit call, that data is stored internally for proposal preparation purposes only. It is not used for any other purpose and is not shared with third parties outside the delivery of our audit service.

2.6 Technical and Usage Data

• ▸Server log data: IP address, browser type, pages visited, HTTP response codes, and timestamps - retained for 90 days then automatically purged
• ▸Authentication events and session tokens
• ▸Application error logs (log entries are designed to exclude personal content; we periodically audit our logging to ensure compliance with this principle)

2.7 Cookies and Local Storage

See clause 10 for full details. We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies on the client dashboard (app.ranki.com.au).

We collect and use personal information only for the following purposes (our "collection purposes"), all of which are directly related to the Ranki service or our legal obligations:

• ▸Providing and delivering the Ranki service, including AI content creation, publishing to your website, and posting to social platforms on your behalf
• ▸Keyword rank tracking, AI visibility monitoring, and generation of monthly SEO performance reports
• ▸Website SEO audits and automated technical optimisations
• ▸Billing, subscription management, payment processing, and invoicing through our payment processor
• ▸Service communications including onboarding, progress updates, alerts, monthly reports, and invoices
• ▸Verifying your identity and authorisation to access the Ranki platform and connected accounts
• ▸Providing customer support and responding to your enquiries
• ▸Detecting, investigating, and preventing fraud, security incidents, and breaches of our Terms of Use
• ▸Complying with applicable Australian laws and regulations, including tax law, record-keeping obligations, and the Notifiable Data Breaches (NDB) scheme
• ▸Product improvement using only aggregated, de-identified, statistical data - we do not use your individual business content, client data, or personal information to train AI models

We will not use your personal information for any purpose that is incompatible with the collection purposes listed above without first obtaining your explicit written consent. We do not sell, rent, lease, trade, or disclose your personal information to any third party for commercial gain, advertising, or profiling purposes.

We collect and process personal information on the following legal bases:

• ▸Performance of contract: processing necessary to deliver the Ranki service you have subscribed to
• ▸Legitimate interests: processing for security monitoring, fraud prevention, and aggregated product analytics, where these interests are not overridden by your privacy rights
• ▸Legal obligation: processing required to comply with Australian law (including tax and record-keeping obligations and the NDB scheme)
• ▸Consent: where we rely on your consent (e.g. for optional communications), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal

Where we rely on consent as the basis for processing, you may withdraw that consent at any time by contacting us at [email protected]. Withdrawal of consent may affect our ability to deliver parts of the service.

To deliver the Ranki service, we share limited personal information with the following sub-processors. We have contractual data processing obligations in place with each sub-processor requiring them to: (a) process data only for the purpose of providing services to us; (b) implement appropriate security measures; (c) not further sub-process without our approval; and (d) assist us in meeting our obligations under the Privacy Act 1988 (Cth).

• ▸Database and authentication provider (USA) - SOC 2 Type II certified. All data is encrypted at rest. Data is stored on servers located in the United States. Cross-border transfer is addressed in clause 6.
• ▸Payment processor (USA) - PCI DSS Level 1 certified. We share only your name, email address, and billing information required to create and manage your subscription. We do not share card details.
• ▸AI content generation provider (USA) - Prompts include your business name, niche, location, and target keywords. Under this provider's API terms of service, API inputs are not used to train its models.
• ▸AI avatar video provider (USA) - We share post titles and video scripts. No biometric data relating to you or your customers is shared.
• ▸AI voice synthesis provider (USA) - Used for video voiceovers. We share text scripts only.
• ▸SEO data provider - Keyword research, ranking data, and website crawl data. We share your domain and target keyword list.
• ▸Transactional email provider (USA) - We share recipient email addresses and email content (reports, invoices, notifications).
• ▸Stock image and video library (Germany) - We share text search queries related to your content topics only. No personal information is shared beyond search queries.
• ▸Google LLC (USA) - Google Analytics 4, Google Search Console, and YouTube APIs. Data processing subject to Google's privacy policies and terms.
• ▸Meta Platforms Inc. (USA) - Facebook and Instagram API. Data processing subject to Meta's Data Policy.
• ▸Microsoft Corporation (USA) - LinkedIn API. Data processing subject to LinkedIn's Privacy Policy.
• ▸Backend infrastructure and compute hosting provider (USA) - Hosts our server and scheduled pipelines.
• ▸Frontend hosting and CDN provider (USA) - Hosts the ranki.com.au and app.ranki.com.au websites.

We do not permit any sub-processor to use your personal information for their own commercial purposes, advertising, or profiling. Our list of active sub-processors is updated when material changes are made. You may request the current list at any time by emailing [email protected].

Connecting a Google product to Ranki is always optional and always initiated by you. When you connect one, Google shows you a consent screen listing exactly what you are granting. Ranki requests the narrowest permission that each feature can work with, and asks only for the permissions belonging to the product you chose to connect.

5A.1 The Google permissions we request and why

• ▸Search Console, read only (webmasters.readonly) - reads the impressions, clicks, average position and search queries for the site you connected, so we can show your keyword performance in your dashboard and monthly report, and choose which pages to improve. We never write to Search Console.
• ▸Indexing (indexing) - after Ranki publishes an article to your own website, we notify Google that the page is new or updated so it is crawled sooner. This submits only the URL of a page you own.
• ▸Analytics, read only (analytics.readonly) - reads sessions, pageviews and traffic sources for the property you connected, so we can show your traffic in your dashboard and monthly report. We never write to Analytics.
• ▸Business Profile (business.manage) - lists the business locations on your account so you can choose which one to use, and publishes the updates Ranki writes for you to that location. We only create posts; we do not change your business details, hours, or reviews.
• ▸YouTube upload and channel list (youtube.upload, youtube.readonly) - lists your channels so you can choose which one to publish to, and uploads the videos Ranki produces for you to that channel. We do not read, edit, or delete videos you uploaded yourself.

5A.2 Limited Use

Ranki’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, and in addition to everything else in this policy:

• ▸We use data obtained from Google APIs only to provide and improve the features you can see in your Ranki dashboard and reports.
• ▸We do not sell Google user data, and we do not use it for advertising, retargeting, or profiling of any kind.
• ▸We do not use Google user data to train, retrain, or fine-tune any artificial intelligence or machine learning model, our own or anyone else's, and we do not send it to a third-party AI provider for that purpose.
• ▸We do not transfer Google user data to others except as needed to provide or improve the service with your consent, to comply with the law, or as part of a merger or acquisition after notice to you.
• ▸No person at Ranki reads your Google user data except where you have given us permission for a specific support request, where it is necessary for security purposes, or where the law requires it.

5A.3 Withdrawing access

You can disconnect any Google product from the Integrations page in your Ranki dashboard at any time, which deletes the stored token. You can also revoke Ranki’s access directly from your Google Account at myaccount.google.com/permissions. Revoking access stops all future data collection immediately; retention of anything already collected is covered in clause 10.

The majority of our sub-processors are based in the United States. As a result, your personal information is transferred to, stored, and processed in the United States, which does not have a formal adequacy determination from the Australian Government.

Before transferring personal information internationally, we take the following steps to ensure it receives protection substantially similar to the APPs:

• ▸We select sub-processors that are certified under recognised frameworks (e.g. SOC 2 Type II, PCI DSS, ISO 27001) or that operate under binding corporate rules or Standard Contractual Clauses
• ▸We require sub-processors to contractually commit to data protection obligations equivalent to the APPs
• ▸We limit the scope of data shared with each sub-processor to the minimum necessary for service delivery
• ▸We review sub-processor compliance as part of our annual security review

By using the Ranki service, you consent to the transfer of your personal information to the sub-processors listed in clause 5 for the purposes described in this policy. If you do not consent to international transfer, you should not use the Ranki service, as it cannot be delivered without these transfers.

Content published to your website and social media accounts is generated by artificial intelligence tools. By using the Ranki service, you acknowledge and accept that:

• ▸AI-generated content is reviewed for quality and relevance but may contain factual inaccuracies, outdated information, hallucinated statistics, or errors of judgment. You retain sole responsibility for the accuracy and appropriateness of content published under your brand.
• ▸You must review published content promptly and notify us at [email protected] of any required corrections, retractions, or removals. We will act on such requests within 2 business days.
• ▸Ranki makes no copyright claim over AI-generated content published to your platforms. You own the content published to your website and social channels, subject to the acknowledgement that AI-generated content may have limited copyright protectability under applicable law.
• ▸AI-generated content is for general marketing and SEO purposes only. It must not be construed or used as professional legal, medical, financial, engineering, psychological, or other regulated professional advice.
• ▸Content generated for your business uses your business name, location, niche, and target keywords as inputs to the AI model but does not incorporate your personal communications, private data, or customer data.
• ▸We do not use the content generated for your account to train any AI model, fine-tune any model, or improve AI outputs for any other client.

We implement a layered set of technical and organisational security measures designed to protect personal information against unauthorised access, disclosure, alteration, loss, and destruction, including:

• ▸AES-256 encryption for all credentials, API tokens, and sensitive business data stored at rest
• ▸TLS 1.3 encryption for all data in transit between your browser, our servers, and sub-processors
• ▸Row-level security (RLS) policies enforced at the database layer - no client can access another client's data
• ▸All API credentials and secrets stored exclusively as environment variables in secure secrets management systems, never in source code, version control, or log files
• ▸Role-based access controls (RBAC) - only authorised Ranki personnel with a documented legitimate business need can access client data, on a need-to-know basis
• ▸Automated dependency auditing and vulnerability scanning for known CVEs
• ▸Regular internal security reviews and access audits

Despite implementing these measures, no system can guarantee absolute security. You acknowledge and agree that you provide personal information to us at your own risk. We are not responsible for security breaches caused by your own disclosure of credentials, your browser or device security, or third-party platforms outside our control.

We maintain a documented incident response procedure for data security incidents. In the event of a data breach that is likely to result in serious harm to affected individuals:

• ▸We will contain and assess the breach as rapidly as possible upon becoming aware of it
• ▸We aim to notify affected individuals and the relevant regulator within 72 hours of becoming aware of a notifiable breach. This is our operational commitment, and it aligns with Article 33 of the GDPR for users covered by it
• ▸In all cases we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches (NDB) scheme (Part IIIC of the Privacy Act 1988 (Cth)) as soon as practicable, and no later than 30 days after becoming aware that a notifiable data breach has occurred
• ▸We will notify you of any breach affecting your account data as soon as practicable, including a description of the nature of the breach, the types of information involved, and the steps we have taken to contain it
• ▸We will take all reasonable steps to remediate the breach, prevent recurrence, and cooperate with any regulatory investigation by the OAIC

For breaches that are unlikely to result in serious harm, we will document the breach internally and may notify you at our discretion.

• ▸Account and business data: retained for the duration of your active subscription plus 7 years to meet Australian tax and record-keeping obligations under the Income Tax Assessment Act 1997 (Cth) and the Corporations Act 2001 (Cth).
• ▸Published content: retained while your subscription is active. Upon cancellation, you may request a full data export within 30 days of your cancellation date.
• ▸OAuth tokens (Google, Meta, LinkedIn, YouTube): deleted within 30 days of subscription cancellation or upon active token revocation by you, whichever is earlier.
• ▸WordPress credentials: deleted within 7 days of subscription cancellation.
• ▸Log and technical data: automatically purged after 90 days.
• ▸Prospect analysis data: retained for 12 months from the date of analysis, then permanently deleted.
• ▸Billing and transaction records: retained for 7 years in accordance with Australian tax law.
• ▸Data subject access request records and complaint records: retained for 5 years.

When personal information is no longer required for any of our collection purposes and no retention obligation applies, we will take reasonable steps to destroy or permanently de-identify it.

Under the Privacy Act 1988 (Cth) and the APPs, you have the following rights regarding your personal information:

• ▸Access (APP 12): Request a copy of the personal information we hold about you. We will provide access in a reasonable format within 30 days, unless an exception applies under the APPs (e.g. where access would unreasonably impact another person's privacy or would be unlawful).
• ▸Correction (APP 13): Request correction of personal information that is inaccurate, out-of-date, incomplete, irrelevant, or misleading. If we refuse to correct, we will provide written reasons and information on how to complain to the OAIC.
• ▸Deletion: Request deletion of your personal information, subject to our legal retention obligations and legitimate business interests. We will advise you if we cannot delete information and the reason why.
• ▸Withdrawal of consent: Withdraw consent to any processing based on consent at any time. This does not affect the lawfulness of processing conducted before the withdrawal. Withdrawal may prevent us from delivering parts of the service.
• ▸Opt-out of direct marketing: Opt out of non-essential marketing communications at any time by using the unsubscribe link in any marketing email or by emailing [email protected]. Note: service communications (invoices, reports, alerts) are not marketing communications and cannot be opted out of while your subscription is active.
• ▸Complaint: Lodge a complaint about our handling of your personal information with us in the first instance. If unsatisfied with our response, lodge a complaint with the OAIC.

To exercise any of these rights, email [email protected] with sufficient information to verify your identity and describe your request. We will acknowledge your request within 5 business days and provide a substantive response within 30 days. If additional time is required, we will notify you and provide an estimated completion date. We do not charge a fee for access requests, correction requests, or complaints.

Ranki is an Australian service and our primary obligations arise under the Privacy Act 1988 (Cth). Where you are located outside Australia, additional rights may apply to you, and we honour them as set out below. The underlying practices described throughout this policy are the same for every user regardless of location.

12.1 European Union and United Kingdom (GDPR and UK GDPR)

Where we process the personal data of individuals in the EU, EEA, or UK, we act as a controller in respect of your account, billing, and platform usage data, and as a processor in respect of the content and website visitor data we handle on your instructions. Our legal bases under Article 6(1) are:

• ▸Performance of a contract (Article 6(1)(b)): creating and maintaining your account, generating and publishing content, keyword and ranking analysis, reporting, support, and payment processing.
• ▸Legal obligation (Article 6(1)(c)): tax, accounting, and record-keeping obligations under Australian law, and responding to lawful requests from authorities.
• ▸Legitimate interests (Article 6(1)(f)): security monitoring, fraud prevention, service performance monitoring, and aggregated de-identified product analytics. We assess these against your rights and interests and do not rely on this basis where your interests override ours.
• ▸Consent (Article 6(1)(a)): optional marketing communications and any non-essential cookies. You may withdraw consent at any time, which does not affect the lawfulness of processing carried out before withdrawal.

In addition to the rights in clause 11, you have the right to erasure, the right to restrict processing, the right to data portability in a structured, commonly used, machine-readable format, and the right to object to processing based on legitimate interests or to direct marketing. We respond within one month, extendable by up to two further months for complex or numerous requests, and we will tell you within the first month if an extension applies.

Your personal data is stored and processed in Australia and the United States. Neither jurisdiction is covered by a European Commission adequacy decision for all transfers, so we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum where applicable, and the technical and organisational measures described in clauses 6 and 8. Copies of the relevant safeguards are available on request at [email protected].

We have not appointed a Data Protection Officer because we are not required to under Article 37. Our Privacy Officer (clause 18) handles all data protection enquiries. You may lodge a complaint with the supervisory authority in your country of residence, your place of work, or the place of the alleged infringement.

12.2 California (CCPA and CPRA)

If you are a California resident, you have the right to know what personal information we collect and the purposes for which it is used, to access a copy of it, to request correction of inaccurate information, to request deletion subject to legal retention obligations, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these rights.

We do not sell personal information, and we do not share personal information for cross-context behavioural advertising. We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking on the client dashboard. There is accordingly no opt-out of sale or sharing to provide, and we do not knowingly collect or sell the personal information of anyone under 16.

To exercise a California right, email [email protected] with the subject line “California Privacy Request”. We will verify your identity against the email address and account details we hold before responding, and we will respond within 45 days, extendable once by a further 45 days where reasonably necessary. An authorised agent may submit a request on your behalf with your signed written permission.

12.3 Other jurisdictions

Residents of Canada, New Zealand, Brazil, and US states with comprehensive privacy legislation have rights broadly equivalent to those described above. We honour valid requests of this kind regardless of where you live. Contact [email protected] and tell us which law you are relying on so we can apply the correct timeframe.

12.4 Data Processing Agreement

Where you are a business customer and we process personal data on your behalf, our Data Processing Agreement applies and forms part of your contract with us. It sets out the subject matter, duration, nature and purpose of processing, the categories of data and data subjects, our obligations as processor, and the approved sub-processors. No signature is required, though we will countersign on request.

The Ranki platform uses automated systems to perform functions including keyword analysis, content scheduling, SEO scoring, and AI visibility reporting. These automated processes do not make decisions about you as an individual in a way that produces legal effects concerning you or significantly affects you personally. The service operates on your business data for business marketing purposes. No profiling of individuals for credit, insurance, or other regulated decisions is performed.

Our platform uses the following cookies and local storage mechanisms:

• ▸Strictly necessary cookies: session tokens required for authentication and maintaining your logged-in state. These cannot be disabled without preventing access to the dashboard.
• ▸Preference storage: Theme settings (dark/light mode preference) stored in browser localStorage. This is not a cookie and does not track you across sites.

We do not use third-party advertising cookies, retargeting pixels, cross-site tracking cookies, or behavioural profiling cookies on the client dashboard (app.ranki.com.au). The marketing website (ranki.com.au) may use anonymised analytics (e.g. page view counts) to understand site performance; these do not identify you individually.

Consent. Strictly necessary cookies do not require consent and cannot be disabled without preventing access to the dashboard. If we later introduce analytics, advertising, or conversion-tracking technologies that require consent under the EU ePrivacy Directive, the UK Privacy and Electronic Communications Regulations, or equivalent law, we will obtain your prior consent through a cookie banner that lets you accept all, reject all non-essential cookies, or choose by category. Rejecting non-essential cookies will not restrict your access to the service. You can change your choice at any time, and you can also block or delete cookies through your browser settings.

Should we introduce such technologies, we will update this clause to name the providers involved and the data shared with them before the technology goes live, and we will notify you in accordance with clause 17.

The Ranki service is designed exclusively for business use by persons aged 18 years and over. We do not knowingly collect personal information from minors under the age of 18. If we become aware that a person under 18 has provided personal information without verifiable parental or guardian consent, we will promptly delete that information and terminate the associated account. If you believe a minor has provided us with personal information, please contact us immediately at [email protected].

The Ranki platform and our communications may contain links to third-party websites, platforms, and resources (including Google, Meta, and LinkedIn). These third-party sites have their own privacy policies and are not governed by this policy. We are not responsible for the privacy practices or content of any third-party site. We encourage you to review the privacy policy of any third-party site you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• ▸Notify you by email to your registered address at least 14 days before the change takes effect
• ▸Update the effective date at the top of this page
• ▸Where required by law (e.g. where we intend to use your information in a materially different way), seek your renewed consent before processing

Continued use of the Ranki service after the effective date of any update constitutes acceptance of the revised Privacy Policy. If you do not accept the changes, you may cancel your subscription before the effective date and request deletion of your personal information.

For any privacy-related enquiry, access request, correction request, or complaint:

If you are not satisfied with our response to a complaint, or believe we have not handled your personal information in accordance with the APPs, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• ▸Website: www.oaic.gov.au/privacy/privacy-complaints
• ▸Phone: 1300 363 992
• ▸Post: GPO Box 5218, Sydney NSW 2001

We encourage you to contact us first before lodging a complaint with the OAIC, as we may be able to resolve the issue more quickly. We take all privacy complaints seriously and commit to investigating and responding to each complaint fairly and promptly.