Privacy Policy

In short

• JustRanks tracks public Amazon search results and product pages for the products you track and their competitors. The data we analyze for you is about products and listings, not about people.
• We process personal data mainly to run your account: your name, email address, team, settings, and how you use the service.
• We do not use advertising or analytics cookies, we do not sell or share personal data for advertising, and we do not build advertising profiles.
• Our database and servers run in the EU. Some service providers are based in the US; we explain below how transfers are protected.
• Payments are handled by Paddle as Merchant of Record. We never see or store your card details.

Who is responsible

The controller responsible for processing personal data under this policy is:

Nico Schmidt, trading as JustRanks
Am See 170, 49770 Herzlake, Germany
Email: legal@justranks.com

Further details are in our Legal Notice. We are not required to appoint a data protection officer. For any privacy question, write to the address above.

Visiting our website

When you open justranks.com, your browser sends technical data to our hosting provider: IP address, date and time, the page requested, referrer, browser type and operating system. We need this to deliver the website, to keep it secure and stable, and to detect and fend off attacks. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Server logs are kept only for a short period and are then deleted automatically.

We load our fonts from our own servers, on the website and in our emails. The website does not use advertising, analytics or social media tracking tools.

Free tools without an account

On our public pages you can try some features without signing up, for example checking a keyword or a product. We process what you enter (such as a keyword or an ASIN) to produce the result.

To prevent abuse, we limit how often these tools can be used. For this, your IP address is used as a key for short-lived counters that expire automatically within two days. We also count daily usage per tool, including an estimate of how many different visitors used it. This estimate is stored in a form from which individual IP addresses cannot be read back, and it is deleted after 90 days. Some forms are protected by Cloudflare Turnstile to tell humans from bots (see Cookie Policy). Legal basis: our legitimate interest in offering the tools and protecting them from automated misuse (Art. 6(1)(f) GDPR).

Your account and use of JustRanks

When you create an account and use the service, we process:

• account data: email address, name, password (stored only in hashed form by our authentication provider), organization, role, and your time zone, which your browser reports so that emails arrive at a sensible local time;
• team data: email addresses of people you invite (invitation links expire after 7 days), and who belongs to which organization;
• content you create: the products you track with their keywords and competitors, tags, notes and settings (such as the hour at which your products are captured each day);
• research you run: the ASINs and keywords you enter, any details you add about your product, and the results;
• usage data: sign-ins with IP address and browser type, actions in the app needed to run it (for example which products are captured, paused or resumed and which emails were sent), and interactions with upgrade prompts;
• subscription data: plan, status and billing period, and the customer and subscription IDs we receive from Paddle.

We use this data to provide the service you signed up for, to secure your account, to communicate with you about it, and to improve the product. Legal basis: performance of our contract with you or your organization (Art. 6(1)(b) GDPR); for security and product improvement, our legitimate interest (Art. 6(1)(f) GDPR). If you use JustRanks on behalf of a company, the company is our contracting party and we process your data as its contact person on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

To suggest keywords and competitors in research and when you add a product, we send public product data from Amazon and the ASINs, keywords and product details you enter to an AI model provider (see “Service providers”). This is about products, not about people.

You can delete your account in your settings at any time. An active, uncancelled subscription must be cancelled first.

Emails from us

We send emails that belong to the service: sign-up confirmation, password reset, invitations, billing notices, messages about your trial and, before we delete an inactive account, advance notices. We also send a daily signals email about the products you track and their competitors, on days with important changes; you can turn it off in your settings or through the unsubscribe link in each email. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and, for product updates to customers, our legitimate interest (Art. 6(1)(f) GDPR). We keep a log of which emails were sent so that none are sent twice.

Payments

Checkout, payment, invoicing, taxes and refunds are handled by Paddle.com Market Ltd. ("Paddle"), which acts as reseller and Merchant of Record. Paddle processes your payment and billing data as an independent controller under its own privacy policy. The checkout runs in a Paddle window on our checkout page. We receive from Paddle only what we need to manage your subscription (customer and subscription IDs, plan, status, billing dates). We do not receive or store card or bank details.

API and connected applications

If you use the JustRanks API, connect an AI assistant (such as Claude or ChatGPT) through our MCP server, or set up webhooks, we process your API keys or the authorization you granted, the webhook addresses you enter, and the requests made with them. We store API keys only as a hash, together with a short visible prefix so you can recognize them. When you connect an assistant, you sign in with your JustRanks login and approve the connection; the authorization is managed by our authentication provider. You can revoke API keys and disconnect assistants at any time in Connect with AI.

To enforce usage limits and to detect shared or misused access, we record per day which accounts made requests and from which network origin. The IP address is stored only as a keyed hash that cannot be reversed without a secret, and it is deleted after 15 days. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

A connected assistant receives the JustRanks data it requests on your behalf, for example your products, keywords, competitors, research and signals, and webhooks send signals for your products to the address you entered. From there, the data is processed by the provider of the assistant or the recipient of the webhook under their own terms; we are not responsible for that processing. What you send to an AI assistant is governed by that assistant's provider; we only receive the requests it makes to JustRanks.

Google Sheets export

If you choose to export to Google Sheets, you sign in with Google and grant JustRanks permission to create files in your Google Drive. We only create the exported spreadsheet and cannot access any other files. We do not store your Google credentials.

Error monitoring and security

To find and fix errors, we use Sentry with data storage in the EU. When an error occurs in your browser or on our servers, Sentry receives a technical report (error message, affected page, browser and device type, timing data). We have configured it so that it receives no IP addresses, cookies or request headers, and we remove access tokens from addresses before a report is sent. Legal basis: our legitimate interest in a reliable, secure service (Art. 6(1)(f) GDPR). Reports are deleted automatically after a limited retention period.

Enquiries and support

If you write to us, use the support form in the app or send an enquiry through our enterprise page, we process your name, email address, company, the details you give us and our reply, in order to answer you. Legal basis: steps prior to or performance of a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Our company email runs on Google Workspace.

Amazon marketplace data

The core of JustRanks is public Amazon data: search results, product pages, prices, ratings, brands and the names of sellers as shown on Amazon. This data is about products and businesses. Where a seller is an individual trading under their own name, the seller name shown on Amazon can be personal data. We process it only as part of the listing it belongs to, to show market and competition data to our customers. Legal basis: our legitimate interest and that of our customers in market analysis based on publicly available information (Art. 6(1)(f) GDPR). You can object at any time (see “Your rights”).

Business outreach to Amazon sellers

We contact brands and sellers on Amazon whose products appear in search results we track, to offer them a free report about their market and to introduce JustRanks. This section is our information under Art. 14 GDPR for the people we contact this way.

What we process and where it comes from

• from the seller profile on Amazon: seller and business name, business address, brands and products;
• from the company's own website: website address and business email addresses published there; we store on which page we found each address;
• from Hunter.io, a B2B email directory: in some cases the business email address of a decision-maker at the company;
• from our contact with you: the emails we sent and received, your reply and how we classified it (for example interested or not interested), and opt-out requests;
• on your report page: that the page was opened and which parts of it were used. This is counted per report, without cookies, and your IP address is not stored with it;
• if you ask us to email you your report: the email address you entered.

Purpose and legal basis

We use this data to contact businesses that may benefit from JustRanks and to follow up on the contact. Legal basis: our legitimate interest in direct marketing to businesses (Art. 6(1)(f) GDPR, Recital 47). We only contact business addresses, and every email tells you where we found your address.

Your right to object

You can object to this processing at any time, without giving reasons, by replying “stop” to our email or by writing to legal@justranks.com. We will then stop contacting you and delete your data, except for a minimal entry on a block list (company and email address) so that we do not contact you again.

Recipients and retention

Outreach emails are sent through Google Workspace; postcards, where we send them, are printed and mailed by PostGrid. Outreach data is deleted 12 months after the last activity (our last contact with you or the last update from Amazon), unless you take over your report into a JustRanks account. The block list is kept for as long as we do outreach.

Service providers

We use the following service providers. They process personal data only on our instructions under a data processing agreement (Art. 28 GDPR), unless stated otherwise.

Anthropic receives public Amazon product data and the ASINs, keywords and product details entered for research and product setup, to suggest keywords and competitors. We don't send account or contact data to Anthropic.

Transfers outside the EU

Several providers are based in the US or can access data from there. Where personal data is transferred to a country without an adequacy decision of the European Commission, we rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). Canada has an adequacy decision. You can ask us for a copy of the safeguards in place.

How long we keep data

We keep personal data only as long as we need it for the purposes above. Specific periods are given in the sections above. In addition:

• account data is kept while your account exists and deleted when you delete the account or it is closed;
• research that nobody in your organization has opened for 30 days is deleted, unless it became a tracked product; products you started adding but never confirmed are deleted 30 days after you started them;
• when you delete a product, it disappears from your account right away; we keep a copy with its keywords, competitors, tags and notes for 7 days so we can restore it if you ask, then it is deleted for good; a paused product keeps its data;
• accounts whose email address was never confirmed are deleted after 72 hours; accounts on a paid plan that never completed checkout are deleted after 14 days;
• accounts that are paused because the trial or subscription ended are kept with all their content, so you can pick up where you left off; if nobody signs in for 24 months, we delete the account after notifying you by email in advance;
• when you delete your account, your account and all content of your organization are deleted immediately; we keep a short record (email address, date, reason) for 12 months to handle questions and prevent abuse;
• invoices and tax records are kept by Paddle as Merchant of Record; we keep business records where commercial or tax law requires it (up to 10 years in Germany);
• database backups are overwritten after 7 days.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have incorrect data corrected (Art. 16);
• have your data deleted (Art. 17) or its processing restricted (Art. 18);
• receive data you provided in a common, machine-readable format (Art. 20);
• withdraw any consent you gave, with effect for the future (Art. 7(3));
• lodge a complaint with a data protection authority (Art. 77), for example the one where you live or the one responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Hannover, Germany.

To exercise your rights, write to legal@justranks.com.

Cookies and similar technologies

We only use cookies and browser storage that are needed for the service you use, such as keeping you signed in and remembering display settings. We do not use them for advertising or analytics. Our cookie notice lets you decide about optional tools should we ever add them; until then there is nothing to switch on. The details are in our Cookie Policy.

Notice for US residents

This section applies to residents of US states with consumer privacy laws, such as California, to the extent those laws apply to us. It supplements the rest of this policy.

Categories of personal information

In the last 12 months we have collected the following categories, for the purposes described above:

• identifiers, such as name, email address, IP address and account IDs;
• commercial information, such as plan, subscription status and billing history (payment details stay with Paddle);
• internet or network activity, such as sign-ins, use of the service and error reports;
• professional information, such as company, role, business address and business contact details.

Sources: you, your device, your organization (for example when a colleague invites you), Paddle, and public sources such as Amazon and company websites; for business outreach also Hunter.io.

No sale or sharing

We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We do not use personal information for targeted advertising or for profiling that produces legal or similarly significant effects. We do not use or disclose sensitive personal information other than to provide the service. Because there is nothing to opt out of, we do not offer a “Do Not Sell or Share” link; opt-out preference signals such as Global Privacy Control are respected all the same.

Your rights

Depending on your state, you may have the right to know what personal information we collect, use and disclose, to access and receive a copy of it, to have it corrected or deleted, and to opt out of sale, sharing and targeted advertising. We will not discriminate against you for exercising these rights. To make a request, write to legal@justranks.com. We will verify your request by matching it to information we already hold, usually your account email address. An authorized agent may submit a request on your behalf with your signed permission. If we decline your request, you can appeal by replying to our decision; we will respond to appeals within the time required by your state's law.

Retention periods are described in “How long we keep data” above.

Children

JustRanks is a service for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows the latest version. If a change materially affects how we use data you have already given us, we will tell account holders by email before it takes effect.