Privacy Policy

Nestake LLC is the data controller for the personal data described in this policy. Being the “controller” means we decide why and how the data is processed, and we are responsible for it.

This policy applies to three groups of people: visitors to our website, business contacts we approach with B2B outreach, and customers who buy a Benchmark or Monitor subscription.

Our product measures what AI assistants say about businesses. The reports themselves contain business information (company names, services, locations), not private information about individuals.

To tell local businesses about RankMeasure, we gather business contact details from public and professional sources: company websites, public business directories, and professional listings. The data is limited to work identities — business name, work email address, role, city — not private contact details.

Our legal basis for this is legitimate interest under UK GDPR Art. 6(1)(f). In plain terms: we have a genuine business reason to offer a measurement service to businesses that may benefit from it, we limit the data to what is needed for a professional approach, and every message includes a clear way to opt out. You can object at any time and we will stop.

When you purchase a Benchmark or Monitor, you provide your name, work email, business name and billing details. We process this to perform our contract with you — to take payment, produce your report and deliver it. The legal basis is UK GDPR Art. 6(1)(b), performance of a contract.

Card details are entered directly into Stripe, our payment processor. We never see, store, or have access to your full card number. Stripe processes payment data under its own privacy policy and is PCI-DSS certified.

We also keep records of what you bought, when, and for which business, so we can deliver the service, apply the Benchmark credit if you subscribe to Monitor, handle refunds, and meet our legal accounting obligations.

We keep analytics minimal and aggregate. We look at overall numbers — how many people visited a page, roughly where traffic comes from — to understand whether the site works. We do not build individual browsing profiles, we do not run advertising trackers, and we do not use analytics data to identify you.

RankMeasure sends prompts to publicly available AI assistants and records their answers about businesses in a given market. This measures the public output of AI systems — the same answers any user could get by asking.

We do not collect or process special-category personal data (health, religion, political opinions and similar). If an AI answer ever contains personal data about an individual, we do not use it beyond what is strictly necessary to present the measured output, and you can ask us to remove it.

We use customer data to: prepare and deliver your reports, process payments through Stripe, send transactional service emails (order confirmation, delivery, billing, cancellation confirmations), apply the Benchmark credit to a Monitor subscription, and respond to support and refund requests.

We use business contact data to send B2B outreach emails. Every outreach email clearly identifies the sender and includes a one-click opt-out link. When you opt out, your address goes on a permanent suppression list: we keep the minimum record needed to make sure you are never contacted again, and nothing else.

We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not profile you for advertising.

We share data only with the processors needed to run the service: Stripe (payments), our email infrastructure provider (sending service and outreach email), and our cloud hosting provider, whose database is located in an EU region.

Each processor is bound by a data processing agreement and may only handle the data on our instructions. We do not sell personal data, rent it, or share it with third parties for their own marketing.

We may disclose data if the law requires it (for example to a court or tax authority) or in the context of a business transfer such as a merger or acquisition, in which case the buyer must respect this policy.

We are a US company, and some of our processors (such as Stripe) operate globally, so your data may be transferred outside the UK and EEA. Our primary database is hosted in an EU region.

Where data is transferred internationally, we rely on appropriate safeguards — such as standard contractual clauses approved by the relevant authorities — so that your data keeps essentially the same level of protection it has under UK GDPR.

Outreach contact data: kept until you opt out, or until 12 months of inactivity (no reply or engagement), whichever comes first. Opt-out suppression records: kept indefinitely, because deleting them would mean we could contact you again by mistake.

Customer purchase and billing records: kept for as long as the law requires for accounting and tax purposes, then deleted.

Delivered reports and their underlying measurement data: kept for the duration of the service relationship so you can access them, and deleted or anonymised afterwards unless the law requires otherwise.

We use encrypted connections (HTTPS/TLS) for all traffic, store data with reputable cloud providers, restrict access to personal data to people who need it to run the service, and process payments only through PCI-DSS certified infrastructure.

No method of transmission or storage is 100% secure, but we work to protect your data and will notify you and the relevant authority of a personal data breach where the law requires it.

You have the right of access — to ask what personal data we hold about you and receive a copy. The right of rectification — to have inaccurate data corrected. The right of erasure — to have your data deleted where there is no overriding legal reason to keep it. The right to restriction — to pause processing while a question is resolved. The right to data portability — to receive the data you provided in a structured, commonly used format. And the right to object — in particular to outreach, which we will stop immediately.

To exercise any of these rights, email support@rankmeasure.com from the address concerned. We respond within one month. We do not charge a fee unless a request is manifestly unfounded or excessive.

If you are not satisfied with our response, you have the right to complain to your data protection supervisory authority — in the UK, the Information Commissioner’s Office (ICO).

Our website aims to work without advertising or tracking cookies. If we introduce any non-essential cookie in the future, we will ask for your consent first and update this policy.

We may update this policy from time to time. The current version is always on this page with its last-updated date. If a change is material — for example a new use of your data — we will notify customers by email before it takes effect.

For any privacy question, request, or complaint: Nestake LLC, 16192 Coastal Highway, Lewes, DE 19958, USA · support@rankmeasure.com.