Leadrealizer Solutions GmbH – RankRealizer Website and Application
Effective: October 2026
The following information provides a simple overview of what happens to your personal data when you visit our website or use our application. Personal data is any data that can be used to personally identify you. For detailed information on data protection, please refer to the sections below.
Data processing on this website and in the application is carried out by Leadrealizer Solutions GmbH. Contact details can be found in Section 2 and in our legal notice (Imprint).
Your data is collected when you provide it to us (e.g., during registration, in contact forms). Other data is collected automatically or with your consent by our IT systems (e.g., technical data such as browser, operating system, or access time).
You have the right to access, rectify, delete, and restrict the processing of your data at any time. You can revoke consent and object to processing based on legitimate interests. Details can be found in Section 13.
The data controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws is:
Leadrealizer Solutions GmbH Industriestraße 170 50999 Cologne Germany
Commercial Register: HRB 120020, Cologne District Court VAT ID: DE400181258
Represented by Managing Directors: Thorsten Rolf Orendi, Moussa Bdeir, Christian Wilhelm Roth (Each managing director has sole power of representation.)
Phone: +49 (0) 221 7726660 Email: office@leadrealizer.com
Digital Services Act (DSA) Contact Point: Email: office@leadrealizer.com Communication may be conducted in German and English.
A Data Protection Officer has not currently been appointed. Should an appointment become necessary under Art. 37 GDPR or § 38 BDSG (German Federal Data Protection Act), we will promptly appoint one and publish the contact details here.
For data protection inquiries, please contact: team@rankrealizer.com or write to the postal address above with the note “Data Protection.”
This privacy policy applies to the processing of personal data in connection with:
| Legal Basis | Scope |
|---|---|
| Art. 6(1)(a) GDPR (Consent) | Cookies and tracking, marketing, certain analytics tools |
| Art. 6(1)(b) GDPR (Performance of Contract) | User account, app functionality, payment processing, contact inquiries |
| Art. 6(1)(c) GDPR (Legal Obligation) | Tax retention obligations, statutory archiving |
| Art. 6(1)(f) GDPR (Legitimate Interest) | Web analytics (where consent is not required), IT security, website operation |
Our website and application use tools from companies based in the USA. When these tools are active, your personal data may be transferred to US servers. Where the respective company is certified under the EU-US Data Privacy Framework (DPF), this provides an adequate level of data protection. For companies not certified under the DPF, we use Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR and additional technical and organizational measures.
This website and application use SSL/TLS encryption for security purposes. An encrypted connection is indicated by “https://” in the browser address bar and the lock icon.
Many data processing operations require your explicit consent. You may withdraw your consent at any time with effect for the future. The lawfulness of data processing carried out before the withdrawal remains unaffected.
IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS.
IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING FOR SUCH MARKETING PURPOSES; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING.
Our website is hosted by Webflow, Inc. (USA). When you visit the website, personal data (IP address, access data, meta and communication data) is processed on Webflow’s servers.
Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (legitimate interest in secure, efficient delivery).
We have concluded a Data Processing Agreement with Webflow.
Privacy Policy: https://webflow.com/legal/privacy
The RankRealizer application runs on Google Cloud (Google Cloud EMEA Limited / Google LLC) in the European Union (region europe-west1, Belgium). We use Cloud Run for the application, Cloud SQL (PostgreSQL) for the database, Memorystore for Redis for job queues, Cloud Storage for files and images, and Secret Manager for credentials. All data processed in the app is stored there. We do not use any other hosting, no-code, or automation platform to store or move your data.
Legal basis: Art. 6(1)(b) GDPR (performance of contract).
We have concluded a Data Processing Agreement with Google. Support or administration access from outside the EU may be covered by the EU-US Data Privacy Framework and/or Standard Contractual Clauses.
Privacy Policy: https://policies.google.com/privacy
We use Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) as a Content Delivery Network (CDN) and for DDoS protection.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and reliable delivery).
We have concluded a Data Processing Agreement with Cloudflare.
Privacy Policy: https://www.cloudflare.com/privacypolicy/
The hosting provider automatically collects and stores information in server log files:
This data is not combined with other data sources and is deleted after 30 days.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technically error-free delivery and security).
When you submit inquiries via our contact form, your form data and contact details are stored for the purpose of processing the inquiry and for follow-up questions.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures / performance of contract) or Art. 6(1)(f) GDPR (legitimate interest in effective processing).
Retention: Until you request deletion, withdraw consent, or the storage purpose ceases. Statutory retention periods remain unaffected.
When you contact us by email or phone, your inquiry and all associated personal data are stored for processing purposes.
Legal basis: Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.
We use Google Web Fonts for consistent font display. When other Google services are used, a connection to Google servers may be established, potentially capturing your IP address.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
To create an account we collect:
For security we store the IP address and browser (user agent) of each login session and the IP address of each magic-link sign-in request, so that we can detect abuse and let you review and end your sessions.
Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (legitimate interest in security).
Retention: Duration of the user relationship. After you delete your account, we delete the data within 30 days.
The App integrates with Google Search Console (Google Ireland Limited / Google LLC) via OAuth 2.0 authorization. When a user connects their Google Search Console account, the following data is accessed and processed:
We use the Search Console permission that allows reading data and submitting sitemaps. We do not use it for any other change to your Search Console account. Access is limited to the properties you select during the OAuth consent flow. The user can revoke access at any time via the App settings or directly through their Google Account permissions.
If you sign in with Google, we receive only your Google identifier, email address, and basic profile (name, profile picture). Sign-in does not give us access to Gmail, Drive, or other Google data.
We also call Google services that do not require your Google account: PageSpeed Insights (to measure public pages) and the YouTube Data API (to read public video information for content you ask us to create).
Legal basis: Art. 6(1)(b) GDPR (performance of contract).
RankRealizer’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
1. Data Accessed from Google APIs:
When a user connects their Google account, the App accesses the following Google user data:
The App only requests the minimum scopes necessary to provide its functionality. Users are informed of the specific permissions requested during the OAuth consent flow and can review them before granting access.
2. How Google User Data Is Used:
Google user data accessed through the App is used exclusively for the following purposes:
Google user data is not used for:
We do not allow humans to read Google user data unless the user asks us to, it is necessary for security or support, or the law requires it.
3. How Google User Data Is Shared:
Google user data may be shared with the following categories of third parties, solely to provide the Services:
Google user data is never shared with data brokers, advertising networks, or any party for purposes unrelated to providing the Services.
4. Data Storage and Protection:
Google user data is stored and protected as follows:
5. Data Retention and Deletion:
We use the Claude API (Anthropic, PBC, USA) for text and the Gemini API (Google) for images and image descriptions. They power these features:
To do this we send the model the content it needs: your keywords and instructions, your brand voice and audience description, extracts of your website and of documents you uploaded, Search Console data, and information about competitor pages you ask us to analyze. We do not send passwords, payment data, or CMS credentials. Both providers act as our processors under their commercial API terms, under which they do not use API inputs or outputs to train their models. Your content is sent only when you trigger a feature that needs it.
AI output can be inaccurate or similar to existing text. You are responsible for reviewing it before you publish.
Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (legitimate interest).
When you add a website, we crawl its public pages and store their text, titles, links, and structure so we can plan and write content that fits your site. When you upload documents to your knowledge base, we store the files and the extracted text. We also store your brand voice, audience profile, keywords, the articles and images we generate for you, and your publishing schedule.
If you connect a CMS (for example WordPress, Webflow, or TYPO3), we store the credentials or tokens you provide, encrypted, and use them only to publish and update the content you approve. Removing a connection deletes the stored credentials.
You keep the rights to your content. We use it only to provide the service to you. If your uploads contain personal data of third parties, you are responsible for having a legal basis to share it with us.
Legal basis: Art. 6(1)(b) GDPR (performance of contract).
If you connect a Facebook Page, an Instagram professional account, or a Google Business Profile, we receive an access token and the data you authorize: the name and ID of the Page, account, or location, the posts we publish for you, and performance metrics such as reach, impressions, likes, and comments. For Facebook and Instagram we use Meta permissions to list your Pages, publish posts, and read engagement and insights. We do not read private messages and we do not access your personal Facebook profile or friends list.
We use this data only to publish what you approve and to show you how it performs. We do not sell it or use it for advertising. Tokens are stored encrypted. Data received from Google Business Profile APIs is subject to the Limited Use statement in Section 9.2.
You can disconnect at any time in RankRealizer, in your Facebook settings under Business Integrations, or in your Google Account permissions. When you disconnect, or if Meta tells us that you removed the app, we delete the stored tokens and the account data we collected within 30 days. To request deletion of everything linked to your Facebook or Instagram connection, email team@rankrealizer.com or use the data deletion link we provide to Meta.
Legal basis: Art. 6(1)(b) GDPR (performance of contract).
To suggest keywords and measure search demand, we send your search terms, target country, and, for domain analysis, your domain or a competitor’s domain to keyword data providers (SE Ranking, and Keywords Everywhere or the Google Ads API). These requests contain business data, not personal data about you.
When you ask us to analyze a competitor, we fetch their public pages and keep titles, publication dates, page counts, and similar metrics. We do not store or republish their full text. For backlinks, we store the URLs of linking pages and the link status we observe on your own site. We do not collect personal data of the people behind those sites beyond what is publicly shown, such as an author name in a page title.
Legal basis: Art. 6(1)(b) GDPR (performance of contract).
Payment processing for subscriptions is handled by Stripe, Inc. (USA). Stripe processes payment data (credit card information, billing address) directly. We do not store credit card or bank details. We only receive information about payment status and billing data (subscription plan, billing cycle, invoice data, the last digits of the card).
If you take part in our referral program and receive payouts through Stripe Connect, we also process your legal name, country, address, and VAT ID, and issue self-billing documents for the payouts.
Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR (legal retention duties).
We have concluded a Data Processing Agreement with Stripe.
Privacy Policy: https://stripe.com/privacy
We send sign-in links, receipts, notifications, and, where you agreed, product emails through Brevo. You can unsubscribe from product emails at any time. If you book an Academy session, the booking is handled by Calendly, which receives your name, email address, and the time you choose.
Legal basis: Art. 6(1)(b) GDPR (performance of contract); Art. 6(1)(a) GDPR (consent) for product emails.
Our website uses cookies. Cookies are small text files stored on your device. They do not cause harm. Session cookies are automatically deleted after your visit; persistent cookies remain until you delete them or they expire.
Technically necessary cookies are stored on the basis of Art. 6(1)(f) GDPR. For all other cookies, we require your consent (Art. 6(1)(a) GDPR).
The tools described in Sections 10.2 to 10.9 apply to our marketing website. Inside the RankRealizer application we use only a first-party cookie that keeps you signed in and a cookie that remembers interface choices such as language. Both are strictly necessary for the service, and we do not use advertising or third-party analytics trackers there.
We use Cookiebot (Cybot A/S, Denmark) as our Consent Management Platform (CMP). On your first visit, you will be asked to set your cookie preferences. Cookiebot stores a cookie to assign your consent(s) or their withdrawal.
Data transmitted to Cookiebot: your consent(s), IP address (anonymized), browser/device information, time of visit.
Legal basis: Art. 6(1)(c) GDPR (legal obligation to obtain and document consent).
You can adjust your preferences at any time via the cookie banner or under [Cookie Settings].
We use Google Analytics 4 (Google Ireland Limited) for web analytics. GA4 uses technologies for user recognition (cookies, device fingerprinting). Information collected is generally transmitted to Google servers in the USA.
Data processed: pseudonymized usage data, page views, time on site, device/browser information, interaction data, IP address (anonymized).
Retention: Up to 14 months.
You can prevent data collection by Google Analytics by downloading the browser add-on: https://tools.google.com/dlpage/gaoptout
Legal basis: Art. 6(1)(a) GDPR (consent).
We have concluded a Data Processing Agreement with Google.
We use Google Tag Manager (Google Ireland Limited) for website tag management. Google Tag Manager itself does not collect personal data but enables the integration of other tags that may collect data.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
We use the Meta Pixel (Meta Platforms Ireland Ltd.) for conversion measurement and retargeting for Facebook/Instagram advertising.
Data processed: page views, interaction data, device information.
You can deactivate remarketing in Facebook ad settings: https://www.facebook.com/ads/preferences/
Legal basis: Art. 6(1)(a) GDPR (consent).
Privacy Policy: https://www.facebook.com/privacy/policy/
We use the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) for conversion tracking and retargeting for LinkedIn advertising.
Data processed: page views, professional profile information (aggregated), device information.
Legal basis: Art. 6(1)(a) GDPR (consent).
Privacy Policy: https://www.linkedin.com/legal/privacy-policy
We use Google Ads Conversion Tracking (Google Ireland Limited) to measure the effectiveness of Google Ads campaigns. A cookie is set when you click on a Google ad.
Data processed: IP address, user behavior, browser information, conversion data.
Legal basis: Art. 6(1)(a) GDPR (consent).
We use Hotjar (Hotjar Ltd, Malta) and/or Microsoft Clarity for UX analysis (heatmaps, session recordings, conversion funnels).
Data processed: anonymized click, scroll, and interaction data, device information, time spent.
You can deactivate Hotjar at: https://www.hotjar.com/opt-out
Legal basis: Art. 6(1)(a) GDPR (consent).
We have concluded a Data Processing Agreement with Hotjar.
We use PostHog for product and website analytics, event tracking, and service improvement. Depending on configuration, PostHog may process usage data such as page views, clicks, session and device information, browser data, IP address, and pseudonymous identifiers.
If PostHog is operated with cookies or other non-essential tracking technologies, processing takes place only on the basis of your consent via our consent management platform.
If PostHog is configured in a strictly privacy-preserving, cookieless manner and only processes data that is technically necessary or sufficiently anonymized/pseudonymized, processing may alternatively be based on our legitimate interest in improving the stability, usability, and performance of our website and application.
Legal basis: Art. 6(1)(a) GDPR (consent), or where applicable Art. 6(1)(f) GDPR (legitimate interest), depending on the technical configuration and the applicable legal requirements.
Where we use PostHog Cloud EU, data is hosted on servers located in Frankfurt, Germany. As PostHog is a US company, transfers to third countries may still occur in individual cases, in particular for support, administration, or access by the provider’s group entities.
For transfers to the USA, PostHog states that it relies on certification under the EU-US Data Privacy Framework where applicable; additionally, a Data Processing Agreement may be concluded, including Standard Contractual Clauses where required.
You can find more information here:
| Service Provider | Location | Purpose | Transfer Mechanism |
|---|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL, Storage) | EU (Belgium) | App hosting, database, files | EU internal; DPF / SCCs for support access |
| Cloudflare | USA | CDN, security | DPF / SCCs |
| Google (Analytics, Ads, GTM, Search Console, Gemini, Business Profile, sign-in) | USA (via Ireland) | Analytics, marketing, SEO data, image generation, publishing | DPF |
| Meta Platforms (Pixel, Facebook, Instagram) | USA (via Ireland) | Marketing, retargeting, publishing and insights | DPF |
| USA (via Ireland) | Marketing, retargeting | DPF | |
| Anthropic (Claude API) | USA | AI content generation | SCCs |
| Stripe | USA | Payment processing, referral payouts | DPF / SCCs |
| Brevo | France/EU | Email delivery | EU internal |
| Calendly | USA | Academy bookings | DPF / SCCs |
| SE Ranking | Varies | Keyword and domain data | SCCs |
| Keywords Everywhere | Varies | Keyword volume data | SCCs |
| Hotjar | Malta/EU | UX analysis | EU internal |
| Microsoft (Clarity) | USA | UX analysis | DPF / SCCs |
| Cookiebot (Cybot) | Denmark/EU | Consent management | EU internal |
DPF = EU-US Data Privacy Framework; SCCs = Standard Contractual Clauses (Art. 46(2)(c) GDPR)
We have concluded Data Processing Agreements with all processors pursuant to Art. 28 GDPR.
| Data Category | Retention Period |
|---|---|
| User account data | Duration of user relationship; deleted within 30 days after account deletion |
| Google Search Console data | Duration of active connection; deleted upon disconnection request or within 30 days after account deletion |
| Website, documents, generated content (articles, images) | Duration of user relationship; deleted within 30 days after account deletion |
| Facebook, Instagram, and Google Business Profile tokens and data | Deleted within 30 days after disconnection or account deletion |
| Payment, billing, and payout data | 10 years (German statutory retention: § 147 AO, § 257 HGB) |
| Server log files | 30 days |
| Database backups | Overwritten within up to 35 days |
| Cookie consent data | 12 months |
| Support correspondence | Duration of user relationship + 12 months |
Right of Access (Art. 15 GDPR): Information about stored data, processing purposes, recipients, and retention periods.
Right to Rectification (Art. 16 GDPR): Correction of inaccurate or completion of incomplete data.
Right to Erasure (Art. 17 GDPR): Deletion of your data, provided no statutory retention obligations apply.
Right to Restriction (Art. 18 GDPR): Restriction of processing, e.g., when contesting accuracy.
Right to Data Portability (Art. 20 GDPR): Provision of your data in a structured, machine-readable format.
Right to Object (Art. 21 GDPR): Objection to processing based on legitimate interests.
Right to Withdraw Consent (Art. 7(3) GDPR): Withdrawal of consent with effect for the future.
Right to Lodge a Complaint (Art. 77 GDPR): Complaint with a supervisory authority. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) Postfach 20 04 44, 40102 Düsseldorf, Germany https://www.ldi.nrw.de
We will respond within 30 days (extendable to 90 days for complex requests).
Residents of California have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
We may collect the following categories of personal information:
Right to Know: You have the right to request that we disclose what personal information we collect, use, disclose, and sell about you.
Right to Delete: You can request the deletion of your personal information, subject to certain exceptions.
Right to Correct: You can request the correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing: We do not “sell” your personal information in the traditional sense. To the extent that sharing data for cross-context behavioral advertising (e.g., via tracking pixels) constitutes a “sale” or “sharing” under the CCPA, you have the right to opt out. You can exercise this right via our cookie consent banner.
Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
Submit a verifiable consumer request by emailing us at: team@rankrealizer.com
We will verify your identity before processing your request. We will respond within 45 days (extendable to 90 days with notice).
For residents of the United Kingdom, the provisions of the UK GDPR and the Data Protection Act 2018 apply. Your rights are substantially the same as those described in Section 13 under the GDPR.
Supervisory authority: Information Commissioner’s Office (ICO), https://ico.org.uk
For residents of Switzerland, the provisions of the revised Swiss Federal Act on Data Protection (revFADP/revDSG) apply. Your rights are substantially the same as those described in Section 13, supplemented by specific provisions of the revFADP.
Supervisory authority: Federal Data Protection and Information Commissioner (FDPIC), https://www.edoeb.admin.ch
We implement appropriate technical and organizational measures:
We note that data transmission over the internet may have security gaps. Complete protection against third-party access is not possible.
Our services are intended for businesses and business customers (B2B) and are not intended for use by persons under 16 years of age. We do not knowingly collect personal data from minors.
The use of contact data published as part of the legal notice obligation for sending unsolicited advertising and information materials is hereby objected to. We expressly reserve the right to take legal action in the event of unsolicited sending of advertising information, such as spam emails.
We reserve the right to update this privacy policy to reflect changes in legal requirements, technical developments, or changes to our services. The current version is always available on our website and in the application. Registered users will be notified by email of material changes.
Last updated: October 2026
Leadrealizer Solutions GmbH – Industriestraße 170, 50999 Cologne, Germany
Industriestraße 170
50999 Köln/Cologne
NRW, Germany 🇩🇪
European Union 🇪🇺
This project is funded by:
European Regional Development Fund (ERDF)
State of North Rhine-Westphalia
Go-to-Market Voucher NRW
Grant Reference: EFRE-20801217
The project “AI-powered content generation for B2B distribution” is funded by the European Regional Development Fund (ERDF) and the State of North Rhine-Westphalia under the Go-to-Market Voucher Program.
Dieses Projekt wird gefördert durch:
Europäischer Fonds für regionale Entwicklung (EFRE)
Land Nordrhein-Westfalen
Go-to-Market Gutschein NRW
Förderkennzeichen: EFRE-20801217
Das Vorhaben “KI-gestützte Content-Generierung für B2B-Vertrieb” wird mit Mitteln des Europäischen Fonds für regionale Entwicklung (EFRE) und des Landes Nordrhein-Westfalen im Rahmen des Go-to-Market Gutscheins gefördert.
.png)
%2001%201.png)
