Privacy policy
The short version
- Cairn is a workspace for SEO agencies. We collect what is needed to run it, and nothing for advertising.
- When an agency connects a client's Google services, Cairn reads only what its features show, and Search Console and Google Ads are read only.
- We never sell personal data, and no data in Cairn is used to train AI models.
- This website sets no cookies and runs no analytics.
- You can disconnect any service at any time, and ask us to delete your data by writing to privacy@rankcairn.com.
Who we are
Cairn is the website at rankcairn.com and the application at app.rankcairn.com. It is operated by Muhammad Taha, a sole proprietor based in Pakistan ("Cairn", "we", "us"). For anything in this policy, write to privacy@rankcairn.com.
Whose data, and our role
This policy covers three groups of people:
- Visitors to this website, including anyone who requests early access.
- People with a Cairn login: agency owners, the agency partners and staff they invite, and anyone they share a board with.
- An agency's clients, whose business information, search data and connected Google services an agency manages in Cairn, and who may open a client portal link.
For website visitors and people with a login, we decide how and why personal data is used, so we are the controller. For the data an agency puts into Cairn about its clients, the agency decides, and we process it on the agency's behalf as its processor, under the data processing terms in section 9 of our terms of service. If you are an agency's client and want to exercise a right over that data, contact the agency; we will help them answer you.
What we collect
When you request early access
Your name, work email, agency name, and anything else you choose to tell us in the form: your website, how many clients you look after, the tools you use and your message.
When you use Cairn
- Account details: your name, email address, role, an optional profile photo, your preferences, and your password, which is stored only as a salted scrypt hash and never in readable form.
- What you add: projects and the businesses they describe (name, website, address, phone number, Google place ID), keywords and locations, tasks, comments, notes, the internal brief, logos and post images, report recipients' email addresses, and the share links you create.
- Activity: the history of each task, who approved a Business Profile post and when, and a copy of each email Cairn sends (who it went to, when, and what it said, except for emails that contain a password) so we can trace a delivery problem.
- Connections: when you connect Claude, ChatGPT or another tool through Cairn's connector, the name the tool reports and when it was last used. Connector keys are stored only as hashes.
From a client portal
A portal has no login. If a client sends a request through it, we keep the request and the name they give.
Search data
To track rankings, Cairn asks search data providers for public Google results for each keyword, at the location being tracked. These results are public web pages and business listings, not personal data about you.
When you sign in with Google
Google gives Cairn your name, email address and whether Google has verified the address. We use them to create or find your account. We store no Google token for sign in.
Data from Google
An agency may connect Google services so Cairn can show their data. Each one asks for its own permission on Google's own screen, and Cairn requests only the access its features use.
| Service | What Cairn reads or does | Access |
|---|---|---|
| Google sign in | Your name, email address and whether it is verified | Read |
| Search Console | Clicks, impressions, click through rate and average position, by day, query and page, for the properties you choose | Read only |
| Google Business Profile | The list of accounts and locations the connected Google account manages, and the local posts on them. Cairn creates, reads and deletes local posts, and does nothing else | Posts only |
| Google Ads | Campaign, cost, click, conversion and search term reports for the accounts you link to a project | Read only |
Business Profile and Google Ads grant broad permission at Google's end. Cairn's own code is limited to the actions in the table: it cannot rename a business, change its hours or categories, add or remove its owners, or create, edit or pause a campaign, a budget or a bid.
Data from Google is shown to the people in the agency's account who are allowed to see that project, and, where the agency chooses, to its client through the portal and reports. It is used to write the summaries described in section 6.
Cairn's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, we do not use data from Google APIs for advertising, we do not sell it, we do not use it to train artificial intelligence or machine learning models, and no person at Cairn reads it unless you ask us to for support, it is needed for security or to comply with the law, or it has been aggregated so that no one can be identified.
How we use it
- To provide Cairn: tracking rankings and map grids, syncing connected services, building portals and reports, sending the emails you set up, and running the task manager. Our legal basis is the contract with you.
- To keep it secure and working: limiting repeated sign in attempts, investigating errors and preventing abuse. Our legal basis is our legitimate interest in a safe service.
- To reply to you: answering early access requests and support messages. Our legal basis is your request, and our legitimate interest in answering it.
- To meet legal obligations, such as keeping records the law requires.
Cairn sends account and service emails, such as invitations, password resets, assigned tasks and the reports you schedule. We do not send marketing email without asking you first, and we do not use personal data for advertising or profiling.
Written summaries and AI
Cairn writes a short progress summary for each project from its numbers: rankings, map grid results, Search Console figures, Google Ads figures and the work completed. To do this, those figures and task titles are sent to our AI provider, Anthropic, which returns the text. The internal project brief is never sent. Anthropic does not use this data to train its models, and the summary is used only inside the agency's own Cairn account and the reports and portal it chooses to share.
A summary that reports worrying news is held for the agency to review before a client sees it, and an agency can edit or turn off summaries.
Who else handles it
We use a small number of providers to run Cairn. Each receives only what its job needs, under a contract that requires it to protect the data.
| Provider | What it does for Cairn | What it receives |
|---|---|---|
| Contabo | Hosts Cairn's servers | Everything stored in Cairn |
| Brevo | Delivers Cairn's emails | The recipient's address and the email itself |
| Anthropic | Writes the progress summaries | The figures and task titles described in section 6 |
| DataForSEO | Supplies Google search and map results | Keywords, locations and the website being tracked |
| SearchAPI | A second source of search results, used to confirm a drop | Keywords, locations and the device |
| Sign in, and the services an agency connects | What is needed to make each connection work | |
| CARTO | Map images behind map grids | Map tile requests, which include your IP address when your browser loads a map |
| Spaceship | Our domain name and email forwarding | Email sent to our rankcairn.com addresses |
We will also disclose information if the law requires it, to protect people's safety, or as part of a sale or reorganisation of Cairn, in which case this policy continues to apply. We will tell agencies before adding a provider that handles their clients' data.
Where it is stored
Cairn's servers are in the United States, and Cairn is run from Pakistan, so the people who operate it may reach data from there. Some providers process data in other countries, including the European Union. Where data from the UK or the European Economic Area is transferred, we rely on the safeguards the law provides, such as the standard contractual clauses and the UK addendum to them.
How long we keep it
- Your account and what you add: for as long as the account is open. A deleted project goes to a bin and is permanently removed after 30 days.
- Ranking history: kept for the life of the project, because the history is the product. The raw search result pages behind each check are deleted after 14 days.
- Data synced from Google: kept as the project's history until the project is deleted or you ask us to delete it.
- Early access requests: deleted after 12 months, or sooner if you ask.
- Backups: daily, kept for 14 days, then overwritten.
When an account is closed, we delete its data within 30 days, and it leaves our backups within a further 14.
How we protect it
- Every connection to Cairn is encrypted with HTTPS.
- Passwords are stored as salted scrypt hashes, connector keys as hashes, and changing a password signs out every other session.
- Each agency's account is isolated from every other, and an automated test checks every part of Cairn against that before a change is released.
- Google connection tokens are encrypted at rest, with the key kept outside the database. They stay on the server, are never shown in the app or sent to a browser, and disconnecting revokes them at Google.
- Sign in, password resets and public forms are rate limited.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authority as the law requires.
Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy in a portable format, restrict or object to how we use it, and withdraw consent you have given. To use any of these rights, write to privacy@rankcairn.com. We will answer within one month, and we may need to confirm it is you first.
If you are in the UK, you can complain to the Information Commissioner's Office. If you are in the European Economic Area, you can complain to the data protection authority where you live or work. We would appreciate the chance to put things right first.
If you live in California or another US state with a privacy law, you have similar rights to know, correct and delete. We do not sell personal information and do not share it for targeted advertising, and we will not treat you differently for using your rights.
Disconnecting and deletion
- Disconnect a Google service from Settings, Integrations, or from the project it is linked to. Cairn revokes its access at Google and deletes the stored token at once.
- Revoke access from Google's side at any time, from your Google Account under Security, Your connections to third party apps and services (myaccount.google.com/connections).
- Delete a project from its Settings. It is permanently removed after 30 days.
- Delete your account or any data, including data already synced from a connected service, by writing to privacy@rankcairn.com from the address on the account, with "Delete my data" as the subject. We confirm when it is done, within 30 days.
Cookies and storage
This website sets no cookies, runs no analytics and loads nothing from third parties. Its fonts are served from our own server.
The Cairn application stores your sign in and display preferences in your browser's local storage, which is needed for it to work. During sign in with Google it sets one cookie, cairn_oauth, which expires after 10 minutes and protects the sign in from forgery. Map tiles load from CARTO, as described in section 7. Cairn uses no advertising or analytics cookies.
Children
Cairn is a business tool for people aged 18 and over, and is not directed at children. We do not knowingly collect personal data from children.
Changes
If we change this policy, we will update the date at the top. If a change is significant, we will tell people with an account by email before it takes effect.
Contact
Privacy questions and requests: privacy@rankcairn.com. Everything else: support@rankcairn.com.
Cairn is operated by Muhammad Taha, Pakistan.