Privacy Policy

Personal information we collect

Depending on how you use the Services, we collect the following categories of personal information:

• Account and identity information: name, email address, password hash, email-verification status, connected sign-in methods, and the stable identifier Google provides if you use Google sign-in.
• Profile and business information: company name, website URL, market, business goals, preferences, and onboarding details.
• Project and service information: Project names and details; research inputs and results; saved reports; AI visibility snapshot inputs and any saved earlier responses or citations; competitor information; service, audit, visibility-check, and Growth Desk requests; replies; status history; and notes.
• Credit and order information: selected credit bundle, displayed price, credit balance and ledger activity, order status, and related records. Automated payment processing is not currently active, and RUFHUB does not collect or store full payment card numbers or card security codes through the current application.
• Device, security, and activity information: IP address, browser or device information contained in the user-agent string, session and sign-in activity, timestamps, request and administrator security logs, and interactions necessary to operate and secure the Services.
• Communications: messages, feedback, support information, and other information you choose to send us.

Please do not provide government identifiers, payment-card details, account passwords, private customer lists, health information, or other sensitive personal information through free-text fields.

Sources of personal information

We collect personal information directly from you, automatically from your browser or device when you use the Services, and from Google when you choose Google sign-in. If RUFHUB accepts a separate professional-service request, information used for that work may also come from the public website you identify and other publicly available sources relevant to the request.

How we use information

• Provide, maintain, personalize, and support accounts, Projects, research, reports, credits, requests, and other Services.
• Authenticate users, maintain sessions, enable account security controls, and prevent fraud, abuse, and unauthorized access.
• Run the current RUFHUB planning tools, save reports and AI visibility snapshot drafts, manage service requests, and prepare requested proposals, recommendations, reports, or project plans.
• Record credit-order and payment-link requests, issue authorized test credits or administrator corrections, deduct credits for completed research runs, and maintain the credit ledger.
• Display account, security, credit, and request information; provide customer-visible request updates; and respond to messages submitted through the Services.
• Debug, analyze, and improve the performance, reliability, usability, and security of the Services.
• Comply with law, enforce our agreements, and establish, exercise, or defend legal claims.

Google sign-in

If you choose Continue with Google, Google provides your verified email address, name, and a stable Google account identifier. We use these details to create or connect your RUFHUB account, confirm your identity, and sign you in. We store the linked identifier, email address, and name with your account, but RUFHUB does not store the Google access token or ID token after the sign-in request is completed.

RUFHUB does not receive your Google password and does not request access to Gmail, Google Drive, Contacts, Calendar, or other Google services. RUFHUB does not sell Google account information or use it for advertising. You may revoke RUFHUB access through your Google Account. Revocation stops future Google sign-in but does not by itself delete your RUFHUB account or records; use the account controls described under "Your choices and privacy rights" to request deletion.

AI features and public-web research

RUFHUB currently allows you to save AI visibility snapshot inputs, including a brand name, website, market, competitors, and buyer prompts. External provider-powered AI execution is paused. RUFHUB does not currently send new snapshot inputs to an external AI provider as part of the generally available Services. Saved records from an earlier provider run, if any, may include the provider and model, prompts, response text, citations, response identifier, technical response data, status, and error details. Do not include personal or confidential information in buyer prompts.

Self-service research tools combine RUFHUB planning logic with live search data supplied by a third-party research data provider. When you run a check, RUFHUB sends that provider the keywords or topic you entered, and, for checks that examine a site, the website address you chose. The provider returns search volumes, difficulty, ranking, backlink, and crawl data. RUFHUB does not send that provider your name, email address, account details, or payment information. If you submit a website for a requested review or professional service, RUFHUB may examine its public pages and publicly available search results, business listings, competitor information, citations, content structure, metadata, schema, and similar visibility signals.

How AI is used in research checks

Some research checks use an AI provider to interpret results: grouping search terms, deciding what type of page each group suits, judging whether a group fits your business, and writing the summary that explains what the research means and what to do first. Numbers such as search volume, difficulty, and ranking positions are not produced by AI. Matching against pages on your website is not done by AI.

For this feature RUFHUB sends the AI provider the search terms in that check, the short description of your business from your profile, and, where a check has examined your website, the addresses of your own pages it matched. RUFHUB does not send your name, email address, account details, or payment information.

The provider used for this feature may process and store data outside the United Kingdom, the European Economic Area, and the United States. It may retain inputs for a limited period.

Cookies, local storage, and tracking choices

RUFHUB uses a first-party, HTTP-only session cookie to keep signed-in users authenticated. It expires after 30 days or earlier when you sign out or revoke the session. Google sign-in also uses a short-lived first-party state cookie to protect the authentication flow. The website uses browser local storage to remember your light or dark theme and session storage for temporary form, return-path, and development email-verification state.

RUFHUB does not currently use third-party advertising cookies or track your activity over time across unaffiliated websites for targeted advertising. The current application does not process browser "Do Not Track" or Global Privacy Control signals differently because it does not sell personal information or share personal information for cross-context behavioral advertising.

How we disclose personal information

We disclose personal information only as reasonably necessary to the following categories of recipients:

• Infrastructure service providers that support the hosting, database, and security functions used to operate the current Services.
• Authentication providers, including Google, when you choose their sign-in service.
• Research data providers that supply live search, ranking, backlink, and crawl data for the checks you run. RUFHUB sends the keywords, topic, or website address you submit for a check.
• AI providers that help interpret the results of a check. RUFHUB sends the list of search terms in that check and the short description of your business from your profile.
• Authorities and other parties when reasonably necessary to comply with law or legal process, protect rights and safety, investigate fraud or abuse, or enforce our agreements.

RUFHUB does not use the current application to sell personal information for money or share personal information for cross-context behavioral advertising.

Data retention and account deletion

We retain active-account product data while the account remains active and the data is needed to provide the Services. Session records expire after 30 days. The application automatically removes security and administrator audit records older than 24 months. Historical requests no longer connected to an account are removed after 24 months once completed or cancelled, unless retention is reasonably necessary for an active contract, dispute, fraud or security investigation, legal hold, or legal obligation.

When you request account deletion, the account is deactivated immediately and a 30-day recovery period begins. A successful sign-in during that period presents a separate recovery confirmation; the account is restored and deletion is cancelled only if you explicitly confirm recovery. After the period ends, the application deletes account identity and workspace data from the primary database. Any separate disaster-recovery retention must be confirmed against the configured infrastructure before RUFHUB makes a more specific public backup-deletion commitment.

Paid and refunded credit-order records in the database are de-identified and retained for up to seven years for tax, accounting, refund, dispute, and reconciliation purposes.

Your choices and privacy rights

You can update profile and Project information through your account, review recent sessions, sign out other devices, download a portable account archive, or request account closure and deletion from the Profile area. You may also revoke Google access through your Google Account and control browser storage through your browser settings.

Depending on where you live and subject to applicable exceptions, you may have rights to request access to, correction of, deletion of, or a portable copy of personal information; to opt out of certain sale, sharing, targeted advertising, or profiling; to limit certain uses of sensitive personal information; and to appeal a denied request. RUFHUB will not discriminate against you for exercising an applicable privacy right.

• Signed-in users may use the controls under Profile to access, correct, export, or request closure and deletion of account information.
• While signed in, you may submit another privacy question through a service or Growth Desk request and write "Privacy Request" at the beginning of the notes field.
• We may need to verify your identity and authority before completing a request. Authorized agents may be required to provide proof of authority, and we may confirm the request directly with you.
• If we deny an appealable privacy request, you may appeal by replying through the same request channel and stating that you are appealing the decision.

Some information may be exempt from a request or retained as permitted by law, including information needed for security, fraud prevention, transaction completion, legal compliance, or legal claims.

Security

RUFHUB uses reasonable administrative, technical, and organizational safeguards designed to protect personal information. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for using a strong, unique password and protecting your account credentials.

Children

The Services are intended for business users who are at least 18 and are not directed to minors. We do not knowingly collect personal information from children under 13. If you believe a child under 13 provided personal information and you already have signed-in access, use the temporary method in the Contact section. A public reporting address must be added before wider commercial launch.

United States operation and international visitors

RUFHUB is a United States company, and personal information may be processed in the United States and other locations where RUFHUB or its service providers operate. Those locations may have privacy laws different from the laws where you live. This U.S.-focused interim policy does not describe every disclosure that may be required before RUFHUB intentionally offers Services in another country.

Changes to this policy

We may update this Privacy Policy as the Services and law change. We will post the revised policy and update the date above. If a change materially affects how we use or disclose information already collected, we will provide additional notice through the Services or another available method before the change takes effect when required by law.