Data Processing Terms

These Data Processing Terms ("DPT") form part of the Concierge Terms of Service between you (the "vendor") and 13897109 Canada Inc., operating as Rankr AI ("Rankr AI"). They apply to personal information about your leads (people who message or comment on your connected accounts) that Rankr AI processes to provide the Service ("Lead Data").

You are the organization in control of Lead Data (the controller). Rankr AI is your service provider (the processor) and processes Lead Data on your behalf.

Rankr AI processes Lead Data only to provide the Service to you, as described in the Terms and the Privacy Policy, and on your documented instructions, which include your settings in the app. We will not sell Lead Data, use it for advertising, or use it to train AI models. If we believe an instruction breaks the law, we will tell you. We may also process Lead Data where required by law, and will tell you first unless the law forbids it.

Anyone at Rankr AI who can access Lead Data is bound by confidentiality obligations and has access only where needed to provide or support the Service.

We maintain appropriate technical and organizational measures, including:

• encryption of data in transit;
• encryption of stored platform access tokens;
• logical isolation of each business’s data, enforced in the application and in the database;
• least-privilege access controls for staff and systems; and
• backups stored with Backblaze, with access restricted.

You authorize Rankr AI to use the following sub-processors to provide the Service:

• Meta Platforms: Instagram and Messenger messaging; WhatsApp Cloud API for lead alerts.
• Anthropic: AI model processing.
• Supabase: database and sign-in (United States).
• Hetzner: application server (United States, Ashburn, Virginia).
• Vercel and Netlify: website and app hosting.
• Brevo: email delivery.
• Backblaze: backup storage (access-restricted).
• Google: sign-in with Google.
• Stripe: billing, when it launches.

We bind each sub-processor by contract to protections at least as strong as these terms, and remain responsible for their performance. We will give you notice (by email or by updating this page) before adding or replacing a sub-processor. If you object on reasonable grounds, you may cancel the Service.

If a lead asks to access, correct or delete their information, we will help you respond, taking into account the nature of the processing. If a lead contacts us directly, we will tell you and, where appropriate, act on the request as described on our Data Deletion page.

If we become aware of a breach of security safeguards affecting Lead Data, we will notify you without undue delay, with the information reasonably available to help you assess it and meet any reporting or notification obligations you have, and we will take reasonable steps to contain it.

While the Service runs, conversations are kept by default for up to 12 months after the last message, then deleted. Backups are kept for up to 30 days. When your account is deleted or the Service ends, we delete Lead Data within 30 days. Copies in backups are deleted within a further 30 days as backups roll over. We may keep information only where the law requires it, and it stays protected by these terms.

Lead Data may be stored and processed in the United States and other countries where our sub-processors operate. We protect it by contract. While outside Canada, it may be accessible to authorities in those countries under their laws. You are responsible for telling your leads, where required, that their information may be processed outside Canada.

On reasonable written request (no more than once a year, unless required after a breach or by a regulator), we will provide information reasonably needed to show that we comply with these terms, such as written answers to security questionnaires and a description of our security measures.

These terms are intended to meet the requirements of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) for organizations that transfer personal information to a service provider for processing, and of other privacy laws that apply.

If these terms conflict with the Terms of Service on the processing of Lead Data, these terms apply. Otherwise, the Terms of Service apply, including its limitation of liability and governing law.