Privacy policy
RankingSolution is operated by Shadstone Limited, a company incorporated in Hong Kong SAR ("we", "us", "our"). We provide a domain, infrastructure, and SEO operations console together with this marketing site (the "Service"). Shadstone Limited is the data controller for information described in this policy. This policy explains what we collect, why, who we share it with, and how long we keep it.
1. Who this covers
This policy applies to visitors of rankingsolution.net and related hostnames, and to users of the RankingSolution console. The console is accessed by invitation and grant, and it authenticates with GFAVIP Wallet SSO. There is no password-based account on RankingSolution itself.
2. Information we collect
Information you provide
- Contact and access-request details such as name, email, company, and a description of your portfolio, when you submit a form or email us
- Operational content you or your organization enter in the console, including domain notes, tasks, comments, proposals, and configuration
Access-request forms on this site are hosted by MemoUpdate (build.memoupdate.com), which processes the submission so we can reply. Please do not submit credentials, API keys, or payment card data through the contact form.
Identity from GFAVIP Wallet SSO
- We receive identity assertions from GFAVIP Wallet sufficient to authenticate you and apply your role and domain grants
- We do not operate a separate password store for the console
- Tokens are validated on each request, so a revoked grant takes effect on the next call
Usage and technical data
- Log data such as IP address, browser type, pages viewed, timestamps, and diagnostic data
- Audit events recording who changed what in the console, and when
- Cookies used to operate the site and to measure traffic with Google Analytics, as described in section 5
Connected platforms
When you configure an integration, we process the data that provider returns so the console can display and act on it. Those providers remain authoritative for their own billing, security, and DNS records, and their own privacy policies apply to the data they hold.
3. How we use information
- To provide, maintain, and improve the Service
- To authenticate users and enforce roles and domain grants
- To respond to access requests and support enquiries
- To run scheduled jobs, SEO tooling, and proposal workflows that you or your organization enable
- To protect the Service, prevent abuse, and meet legal obligations
We do not sell personal information, and we do not use your operational content to train general-purpose machine learning models.
4. How we share information
We share information with the following categories of recipient:
- Service providers and sub-processors who host or operate parts of the Service, listed in section 5
- Integration providers you connect, as required to perform the action you requested
- Professional advisers, and parties to a merger or acquisition, where a transfer of the business occurs
- Law enforcement or regulators where required by law, or where necessary to protect rights and security
5. Sub-processors and cookies
We use the following categories of sub-processor to run the Service. Each is engaged under terms requiring it to protect the information it handles.
- Hosting and delivery: Netlify, Railway, Cloudflare, Amazon Web Services
- Identity: GFAVIP Wallet
- Search and analytics: Google (Analytics 4 on this site; Search Console, Analytics, and AdSense as connected client integrations), Microsoft Bing Webmaster Tools
- SEO data: DataForSEO, Ahrefs
- Forms: MemoUpdate
A current list of named sub-processors is available on request. Where we add a sub-processor that handles client operational data, we will make the updated list available before it starts processing.
This marketing site uses cookies needed to operate it, plus Google Analytics 4, which sets its own cookies to count visits and see which pages get read. We use it for aggregate traffic reporting. We have not enabled Google Signals, advertising features, or remarketing, and we do not run advertising cookies.
You can opt out with Google's browser add-on, by sending a Do Not Track or Global Privacy Control signal, or through your browser's cookie settings. The console at atlas.rankingsolution.net does not run Google Analytics.
6. Retention
- Contact and access requests: up to 24 months from your last contact with us, unless you become a client
- Console operational data: for the duration of your engagement, then deleted or de-identified within 90 days of termination unless we must keep it for legal or contractual reasons
- Audit and security logs: up to 12 months
- Backups: encrypted, on a rolling window of up to 35 days, after which they expire
Records we must keep for tax, accounting, or legal purposes are retained for the period the relevant law requires.
7. Security
We use administrative, technical, and organizational measures to protect information. These include SSO-only console login with no password store, role-based access with per-domain grants, authentication that fails closed on error, encrypted credentials for connected platforms, and audit logging of changes. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
To report a suspected vulnerability or unauthorized access, email hello@rankingsolution.net with the subject "Security report". Please do not include credentials or other secrets in your message.
8. Your rights
Under the Hong Kong Personal Data (Privacy) Ordinance, and under other laws that may apply to you, you can ask us to access, correct, delete, export, or restrict certain personal information, or object to certain processing. Email hello@rankingsolution.net with the subject "Data request". We will verify your identity before acting and respond within 30 days, or tell you why we need longer.
Some shared operational records, such as audit trails created for a team, may be retained or de-identified where deleting them would affect other authorized users or a legal obligation. Deleting RankingSolution data does not delete your GFAVIP Wallet identity, which is a separate service with its own request process.
9. Data processing agreements
Where we process personal data on behalf of a client, we act as a processor and the client is the controller. We will enter into a data processing agreement on request. Email hello@rankingsolution.net with the subject "DPA".
10. Children
The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.
11. International transfers
We operate from Hong Kong SAR, and our providers operate in the United States, the European Union, and other regions. Information may therefore be processed outside the country where you live. Where a transfer requires a safeguard, we rely on standard contractual clauses or another lawful mechanism.
12. Changes
We may update this policy. We will post the updated version here and revise the effective date. For a change that materially affects how we handle client operational data, we will give notice before it takes effect. Continued use of the Service after that means you accept the update.
13. Contact
Shadstone Limited, Hong Kong SAR · hello@rankingsolution.net · Contact form · shadstone.com