Privacy policy
Version 1.1. Effective 25 October 2026.
CataRank is an SEO and AI search visibility platform for ecommerce stores. It is operated by LinkWrangler Pty Ltd (ACN 694 414 152), an Australian company ("LinkWrangler", "we", "us"). This policy explains what information CataRank collects, how we use it, who we share it with, and the choices you have.
We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Where the EU or UK General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA) applies to you, you also have the rights described in "Your rights" below. Questions about this policy can go to privacy@linkwrangler.com.
The short version
- CataRank reads data so it can show you how your store performs in search. It never changes your website, store, Google accounts or ads.
- We only collect what we need to run the features you use.
- We do not sell your information, and we do not use it for advertising.
- Data from Google services is used only to show you reports and recommendations inside CataRank, and is handled under Google's Limited Use requirements (see "Google user data").
- You can disconnect any integration, export your data or delete your account at any time.
Information we collect
Account information
When you or your team create an account we collect your name, email address, password (stored only as a secure hash) and your role in the account. If you sign in with a magic link, we send a one-time link to your email.
Your sites and settings
The domains you track, the keywords, competitors, locations and devices you choose, tags, notes and other settings you enter.
Data from services you connect
CataRank only connects to another service when an account owner or admin authorises it, and only requests read access wherever the service offers it.
| Service | What we read | Why |
|---|---|---|
| Google Search Console | Search queries, clicks, impressions, average position and click-through rate for your pages, by day, country and device, for the last 16 months and then daily. You connect it by signing in with your own Google account and approving read-only access. We store a secure, encrypted token for that sign-in. | To show which searches your pages and products appear for, on your Dashboard, Keywords and Products pages |
| Google Analytics 4 | Aggregated sessions, conversions and revenue by landing page, channel and product | To estimate the value of search traffic to each page and product |
| Google Merchant Centre | Product status, issues and disapprovals, product attributes as Google holds them, free listing and Shopping performance, price benchmarks and best seller reports | To show feed problems and Shopping visibility for each product |
| Google Ads | Search terms, keyword and product performance (clicks, cost, conversions) | To compare paid and organic results for the same searches and products |
| BigCommerce | Your product catalogue (products, variants, categories, prices, stock, images, identifiers, reviews), store settings, page and redirect URLs, and order line items | To match search data to products and estimate product revenue |
Orders and shopper information. To calculate product revenue we read order line items: product, variant, quantity, price and order date. We do not store your shoppers' names, email addresses, phone numbers or postal addresses. If an order record includes them, we discard those fields when the order is processed.
Public web data
To track rankings and analyse competitors we collect publicly available information, including search engine results for the keywords you track, and the content and structure of public web pages on your site and on competitor sites you add. We obtain search results through our data provider, DataForSEO, and crawl public pages with our crawler, which identifies itself as CataRankBot and respects robots.txt. Public real-user page speed data comes from Google's Chrome UX Report and PageSpeed Insights.
Technical and usage information
When you use CataRank we collect information needed to keep it secure and working: IP address, browser type, device information, pages viewed, actions taken and error logs. We use essential cookies to keep you signed in. [We do not use advertising cookies. If we add product analytics, list the tool here and in the cookie notice.]
Billing information
[When paid plans launch: payments are processed by Stripe. We store your billing name, address, plan and invoice history, but never your full card number.]
Information you send us
If you contact support or give feedback, we keep that correspondence.
How we use information
We use information to:
- provide CataRank's features, including rank tracking, site audits, competitor comparisons, product reports and recommendations;
- run background jobs such as daily rank checks, crawls and data syncs, and keep a history of your results over time;
- secure the service, prevent abuse and fix errors;
- send service emails, such as sign-in links, alerts you have set up, reports you have scheduled and important account notices;
- measure our own costs and usage so we can set fair plan limits;
- comply with the law.
We do not use your information, or any data from connected services, to:
- sell it or share it with data brokers;
- serve or target advertising;
- determine creditworthiness or for lending purposes;
- train generalised artificial intelligence or machine learning models. [If CataRank later offers AI features, such as writing suggestions, we will explain what data they use and ask for your permission first.]
Google user data
CataRank's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular:
- We only request the Google permissions needed for the features you turn on. Today that is read-only access to Search Console ("View Search Console data for your sites"). Google Analytics, Merchant Centre and Google Ads are not connected yet, and when they are, CataRank will use them for reading reports only.
- We use Google user data only to provide and improve the user-facing features of CataRank that you can see in the app.
- We do not transfer Google user data to others except as needed to provide those features (for example, to our hosting and database providers), to comply with the law, or as part of a merger or acquisition with notice to you.
- No person reads your Google user data unless you ask us to for support, it is needed for security purposes or to comply with the law, or the data is aggregated and anonymised for internal operations.
- You can remove CataRank's access at any time from your CataRank integration settings or from your Google Account's security settings (myaccount.google.com/permissions).
Who we share information with
We share information only with service providers that help us run CataRank, under agreements that require them to protect it and use it only for that purpose:
| Provider | Purpose | Data involved |
|---|---|---|
| Vercel | Web application hosting | All data passing through the app |
| Railway | Database and background workers | All stored data |
| DataForSEO | Search results, keyword and competitor data | Keywords, domains and locations you track. No personal information |
| Loops | Email delivery (sign-in, account and product emails) | Your name and email address, email content |
| Sentry | Error monitoring | Technical information about errors, with personal information removed where possible |
| Chrome UX Report and PageSpeed Insights | Public URLs only | |
| [Stripe] | [Payments, when paid plans launch] | [Billing details] |
We may also disclose information if required by law, to protect the rights and safety of our users or the public, or to a buyer or successor if LinkWrangler or CataRank is sold or restructured. In that case we will tell you, and this policy will continue to apply to your information.
Where information is stored
LinkWrangler is based in Australia. Our hosting and database providers, Vercel and Railway, store data on servers in North America, and some other providers listed above may process data in other countries. When information is held outside Australia, we take reasonable steps to make sure it is protected to a standard consistent with the Australian Privacy Principles. For transfers from the EU or UK, we rely on the safeguards our providers offer, such as standard contractual clauses.
How we protect information
- All connections to CataRank use HTTPS.
- Access tokens for connected services are encrypted at rest and are never sent to your browser or written to logs.
- Each account's data is kept separate from every other account's.
- Access to production systems is limited to people who need it and is protected by multi-factor authentication.
No system is completely secure. If we become aware of a data breach, we will investigate and contain it, and assess the risk to the people affected. If it is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires. Where the GDPR applies, we will notify the relevant authority within 72 hours where required.
How long we keep information
| Information | Kept for |
|---|---|
| Account and settings | While your account is open |
| Ranking history, audit results and reports | While your account is open, so you can see trends over time |
| Data imported from a connected service | While the connection is active. When you disconnect, we ask the service to end our access and delete our access token immediately. You choose whether the imported data is deleted straight away or kept for 30 days in case you reconnect, and it is deleted after that. Deleted data leaves our backups within 30 days. You can also ask us to delete it at any time |
| Deleted sites and accounts | Hidden immediately and permanently deleted within 30 days |
| Backups | Up to [X] days after deletion |
| Billing and financial records | 7 years |
Your rights
You can:
- access the personal information we hold about you;
- correct it if it is wrong;
- export your data from CataRank;
- delete your account and its data;
- disconnect any integration at any time.
If the EU or UK GDPR applies to you, you also have the right to restrict or object to processing and to data portability. Our legal bases are: performing our contract with you (running the service), our legitimate interests (security, improving CataRank and tracking public search results), and your consent (connecting a third-party service, which you can withdraw by disconnecting it).
If you are a California resident, you have the right to know what personal information we collect and how we use it, to ask us to delete it, and not to be treated differently for exercising these rights. We do not sell or share personal information as the CCPA defines those terms.
To make a request, email privacy@linkwrangler.com. We will respond within 30 days. We may need to confirm your identity before acting on a request.
Marketing emails
We only send marketing emails, such as product news, if you opt in. You can unsubscribe at any time using the link in any marketing email or by emailing privacy@linkwrangler.com. Service emails, such as sign-in links, alerts you set up and important account notices, are part of the service and continue while your account is open.
Children
CataRank is a business tool and is not intended for anyone under 18. We do not knowingly collect information from children.
Changes to this policy
We will update the version number and effective date at the top of this page when the policy changes. For material changes we will email account owners at least 14 days before the change takes effect.
Contact and complaints
LinkWrangler Pty Ltd (ACN 694 414 152), Melbourne, Australia Email: privacy@linkwrangler.com Website: catarank.com
If you are not satisfied with our response to a privacy concern, you can contact the Office of the Australian Information Commissioner at oaic.gov.au. If you are in the EU or UK, you can also contact your local data protection authority. California residents can contact the California Attorney General.