Privacy Policy

Concierge is operated by 13897109 Canada Inc., operating as Rankr AI, in Ontario, Canada ("Rankr AI", "we", "us"). This policy covers the Concierge app at concierge.rankrai.net, its API, and the Concierge pages on rankrai.net (together, the "Service").

It applies to two groups of people: vendors, the businesses that sign up and use Concierge, and leads, the people who message those businesses on Instagram or Facebook Messenger, or comment on their Instagram posts.

For vendor account data (your sign-in, settings and billing), Rankr AI is responsible for that information.

For leads' messages and details, we process the information on behalf of the vendor who connected the account. The vendor decides how those leads are used. Our Data Processing Terms set out how we handle that information for vendors.

From vendors:

• Your name and email address.
• Sign-in details when you sign in with Google, with an email link, or with an email and password (used for review and support accounts).
• Business details read from your public website and your Instagram bio and captions, at your request, plus the packages, starting prices, service area and other details you confirm or edit.
• The Instagram account, Facebook account and Page IDs you connect, and the access tokens Meta issues for them (stored encrypted).
• The WhatsApp number you give us for lead alerts.
• Your settings, your concierge name and style, and your "Try it" test chats.
• Emails you send to support.
• Usage and cost logs (for example, how many messages were handled and the AI processing cost).

From leads (received through Meta's Instagram and Messenger APIs, and from Instagram comments on the vendor's posts):

• The messages and photos you send to the business.
• Your Instagram username or Facebook name, and the platform IDs Meta provides.
• Details you choose to share in the conversation, such as your name, phone number, and event details (type, date, location, number of guests, theme and budget).
• Conversation status (for example, whether the business has marked you as a hot lead or converted).

Payment data. We do not collect or store payment card data. When billing launches, it will be handled by Stripe, which processes cards directly.

• To run the vendor's concierge: generating replies with an AI model, capturing lead details, sending the vendor a WhatsApp alert when a lead is ready, and showing conversations in the vendor's dashboard.
• To keep the Service secure, prevent spam and abuse, and provide support.
• To improve that vendor's own concierge (for example, its answers and settings).
• To send vendors service emails, such as sign-in links, alerts about their account and important changes.

To generate replies, messages and the relevant business details are sent to Anthropic's Claude API. We do not use vendors' or leads' data to train AI models, and under its commercial terms our AI provider does not train its models on data sent through its API. Each vendor's data is used only to improve that vendor's own concierge, never another vendor's.

Information we receive from Meta (Instagram, Facebook Messenger and WhatsApp) is used only to provide the Service to the vendor who connected the account. We do not sell it, we do not use it for advertising, and we do not share it except with the service providers listed below as needed to run the Service. We delete it on request, as described on our Data Deletion page and as Meta's terms require.

We do not sell personal information. We share it only as follows:

Service providers that help us run the Service, under contract:

• Meta: Instagram and Messenger (sending and receiving messages) and the WhatsApp Cloud API (lead alerts).
• Anthropic: AI model that generates replies and extracts lead details.
• Supabase: database and sign-in (United States).
• Hetzner: application server (United States, Ashburn, Virginia).
• Vercel and Netlify: website and app hosting.
• Brevo: email delivery.
• Backblaze: backup storage (access-restricted).
• Google: sign-in with Google.
• Stripe: billing, when it launches.

Legal requirements. We may disclose information if required by law, or to protect the rights, safety or property of our users, the public or Rankr AI.

Business transfer. If Rankr AI is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, subject to this policy.

Information is stored and processed in the United States and other countries where our service providers operate. We protect it by contract with those providers. While it is outside Canada, it may be accessible to courts, law enforcement and national security authorities in those countries under their laws.

• Conversations are kept while the vendor account is active, by default for up to 12 months after the last message, then deleted.
• Backups are kept for up to 30 days.
• When a vendor deletes their account, its data is purged within 30 days.
• Technical logs are kept for a short period for security and troubleshooting.

We use encryption in transit, store account access tokens encrypted, keep each business's data isolated from every other business, and limit staff and system access to what is needed (least privilege). No system is perfectly secure, but we work to protect your information and will notify affected parties of a breach as the law requires.

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable law, you can ask to access the personal information we hold about you, correct it, or delete it, and you can withdraw your consent (which may mean we can no longer provide the Service). Email [email protected]. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada.

If you are a lead (you messaged a business that uses Concierge), please contact that business first. You can also email us and we will help.

See our Data Deletion instructions for how vendors and leads can have their data deleted.

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you think a child has given us information, contact us and we will delete it.

Leads who message a business may include young people. The business decides who it serves. We will delete a minor's information on request from them, their parent or guardian, or the business: email [email protected].

The Concierge app uses only essential cookies and local storage to keep you signed in. It does not use advertising cookies. The rankrai.net website is covered by our Cookie Policy.

We may update this policy. We will post the new version here with a new "Last updated" date and notify vendors by email of any material changes.

Our Privacy Officer is accountable for how we handle personal information. Contact: Privacy Officer, Rankr AI (13897109 Canada Inc.), [email protected].