Privacy Policy & Data Protection Standards

Public vs. Private Data Matrix

To provide complete clarity, the table below outlines exactly what data elements are publicly indexed versus what remains strictly private:

1. Data Controller Identification & Scope

RankRope ("RankRope", "we", "us", "our") is the data controller responsible for personal data processed through our website (rankrope.com), APIs, and associated discovery services.

This Privacy Policy applies to all founders, software developers, backers, and visitors who access our site, launch products, submit rankings, or consume directory listings.

2. Categories of Information We Collect

We collect information in three distinct contexts: directly from you, automatically through your platform usage, and via verified payment webhooks.

A. Information You Provide Directly

• Software Listing Data: Product name, canonical URL, tagline, comprehensive description, category classification, logo/icon image files, and country of origin.
• Maker Account Credentials: Your email address used for passwordless magic link authentication and your public maker handle.
• Support Inquiries: Communications, feedback, or bug reports submitted via email to our support desk.

B. Information Collected Automatically

• Technical & Telemetry Data: IP address (hashed/anonymized for fraud detection), browser user-agent string, operating system, and referral headers.
• Outbound Redirect Telemetry: When users click external links to listed software via /r/[slug], we record the click event to increment the public discovery counter while filtering automated web crawlers.
• Device Preferences: User interface theme preferences (dark mode vs. light mode) stored locally on your device.

C. Information from Third-Party Payment Partners

When you initiate a ranking verification or delta climb payment, our merchant partner (Whop) delivers a secure, cryptographically signed webhook containing:

• Transaction confirmation ID and timestamp.
• Verified payment amount in USD.
• Product ID and target climb rank.
• Payer email (retained only for receipt delivery and billing fraud reconciliation).

3. Payment Security & Certified Merchant Architecture

We adhere to strict data minimization principles regarding financial data:

• Zero Cardholder Data Storage: RankRope never requests, collects, views, or stores your credit card number, debit card number, expiration date, or CVV code on our servers.
• PCI-DSS Compliance: All payment forms and checkout sessions are hosted and managed directly by Whop Inc., which maintains Level 1 PCI-DSS compliance—the highest level of certification in the payment processing industry.
• Encrypted Transport: All payment communication between your browser and Whop is protected with Transport Layer Security (TLS 1.3) utilizing 256-bit encryption.

4. Legal Bases for Processing under GDPR (Article 6)

For individuals situated within the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following lawful bases:

5. Generative Engine Optimization (GEO), AI Search Crawlers & LLM Endpoints

RankRope is intentionally architected to be the canonical source of truth for software discovery in the artificial intelligence search era.

• Public Machine-Readable Endpoints: We maintain structured machine-readable Markdown representations of verified software profiles at /p/[slug].md and an open directory index at /llms.txt.
• AI Search Engines: Legitimate generative search engines—including Perplexity AI, OpenAI ChatGPT Search, Google AI Overviews, Anthropic Claude, and Microsoft Copilot—crawl and ingest public listing information to answer user software queries.
• Data Scope for AI: Only public listing metadata (product name, description, category, verified rank, cumulative equity, and official website) is exposed via these endpoints. Private founder email addresses, payment records, and IP addresses are strictly excluded.

6. Cookies, Local Storage & Tracking Technologies

RankRope respects user privacy and enforces a strict policy against cross-site behavioral surveillance.

Because we do not deploy non-essential tracking cookies or third-party advertising trackers, RankRope does not disrupt your browsing experience with intrusive cookie consent banners.

7. Outbound Referral Telemetry & Click Verification

When a user clicks on an external link to visit a listed software product, the request may route through our secure redirection gateway (/r/[slug]):

• Purpose: To maintain transparent, verifiable traffic discovery counts displayed publicly on product profiles.
• Privacy Safeguard: The redirect endpoint does not set any cookies on your browser. IP addresses used during the redirect are hashed with a daily rotating salt solely to deduplicate bot floods, and the raw IP is never permanently stored.
• Immediate Forwarding: Users are immediately redirected to the product's canonical URL via an HTTP 302 Found response.

8. Third-Party Subprocessors & Service Partners

We engage carefully selected third-party service providers to execute infrastructure operations, subject to rigorous data processing agreements:

We never sell, trade, or monetize your personal data to advertisers, data brokers, or marketing syndicates under any circumstances.

9. Security Safeguards & International Data Transfers

We implement industry-standard technical and organizational security measures to protect your personal information against unauthorized access, destruction, loss, or alteration:

• Transport Security: All data in transit between your device and RankRope is encrypted using TLS 1.3.
• Access Controls: Access to production databases and founder email records is strictly restricted using multi-factor authentication (MFA) and least-privilege role boundaries.
• Webhook Cryptography: Inbound payment webhooks from Whop are validated using HMAC SHA-256 signature verification to prevent spoofing or unauthorized ledger modifications.
• Cross-Border Transfers: When personal data is transferred across international borders, we ensure adequate safeguards are in place, including European Commission Standard Contractual Clauses (SCCs).

10. Data Retention Schedules & Product Delisting

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Active Public Listings: Public software metadata and cumulative ranking equity remain live on the directory indefinitely to preserve the integrity of the All-Time discovery ledger.
• Founder-Requested Delisting: If you request removal of your product via support@rankrope.com, the public profile is permanently unpublished and removed from search indexation.
• Financial & Legal Audit Logs: Payment transaction metadata (invoice IDs, amounts, and dates) are retained for a minimum of 7 years to satisfy statutory tax, accounting, and regulatory compliance obligations.
• Telemetry Logs: Server access logs and anomaly detection hashes are purged automatically after 30 days.

11. European Union & UK Privacy Rights (GDPR)

If you reside in the European Economic Area (EEA) or the United Kingdom, you possess specific statutory rights under the General Data Protection Regulation (GDPR):

• Right of Access (Art. 15): The right to request copies of your personal data held by RankRope.
• Right to Rectification (Art. 16): The right to correct inaccurate or incomplete personal information.
• Right to Erasure (Art. 17): The right to request deletion of your personal data ("Right to be Forgotten"), subject to statutory financial retention exceptions.
• Right to Restriction of Processing (Art. 18): The right to restrict processing under certain conditions.
• Right to Data Portability (Art. 20): The right to receive your personal data in a structured, machine-readable format.
• Right to Object (Art. 21): The right to object to processing based on our legitimate interests.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your national Data Protection Authority (DPA) regarding our processing practices.

To exercise any of these rights, email us at support@rankrope.com. We respond to verified requests within thirty (30) days.

12. California & US State Consumer Privacy Rights (CCPA / CPRA)

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), California residents are entitled to specific disclosures and protections:

• Notice of Collection: In the preceding 12 months, we have collected identifiers (email addresses, IP hashes) and commercial transaction records solely for leaderboard placement services.
• No Sale or Sharing of Personal Information: RankRope does not "sell" personal information, nor do we "share" personal information for cross-context behavioral advertising as defined under the CCPA/CPRA.
• Right to Know & Delete: You have the right to request disclosure of personal data collected and request deletion without discrimination.
• Non-Discrimination: We will never deny services, charge different prices, or provide a different level of quality to users who exercise their statutory privacy rights.

13. Children's Privacy (COPPA Compliance)

RankRope is a commercial software discovery and launch platform intended for software developers, entrepreneurs, and professional users.

Our Service is not directed to children under 13 years of age (or under 16 in the EEA/UK). We do not knowingly solicit or collect personal information from children. If you believe that a child has provided us with personal information without parental consent, please contact us immediately at support@rankrope.com, and we will promptly delete such records.

14. Privacy Policy Modifications & Data Inquiries

We may periodically update this Privacy Policy to reflect platform enhancements, operational changes, or legal requirements. When updates occur, we will revise the "Effective Date" at the top of this document. We encourage you to review this page periodically.