Privacy Policy

1. Information we collect

Account data: your name or username, email address, and a hashed password. If you sign in through a third-party provider, we receive the profile fields that provider shares.

Billing data: your plan, billing cycle and payment metadata. Payments are processed by Stripe; we never store full card numbers.

Workspace data: the projects you create — brand domains, competitors, tracked prompts — and the AI-engine responses, scores and reports Maverank generates for them. Free-check scans store the submitted domain and the scan result.

Usage and technical data: page views, feature interactions, device, browser and log information, used to operate and improve the service and to prevent abuse. Free-check requests store a salted hash of the requesting IP address for rate-limiting; the raw address is not kept.

Communications: messages you send to support or through contact forms.

2. Legal bases for processing

We process personal data under the GDPR's lawful grounds:

• Contract performance — delivering your account, workspace and subscription.
• Legitimate interests — operating, securing and improving the service, preventing abuse, and producing aggregate analytics.
• Legal compliance — tax and accounting obligations.
• Consent — non-essential analytics cookies and marketing communications, which you can withdraw at any time.

3. How we use your data

To run your tracking projects and generate scores, reports and recommendations; to process payments; to provide support; to measure and improve the product; to prevent fraud and abuse; to comply with the law; and — with your consent — to send product updates.

4. Cookies

Essential cookies (session, authentication, CSRF, consent preference) are required for the service and need no consent. Analytics cookies load only after you accept them in the banner, and you can withdraw consent at any time.

5. Sharing and subprocessors

We never sell personal data. We share it only with service providers under GDPR-compliant agreements:

• Hosting and infrastructure: DigitalOcean.
• Object storage: Cloudflare R2.
• Payments: Stripe.
• AI platforms we query on your behalf: OpenAI, Anthropic and Google. Tracked prompts and brand domains are sent to these engines to produce your visibility results; they are not sent your account identity unless you include it in a prompt or project.
• Email and marketing: Brevo, for transactional messages and, where you opt in, product updates.
• Referral attribution: FirstPromoter, where its programme is enabled.
• Bot prevention: Google reCAPTCHA, when you create an account.
• Analytics: Google Analytics, only after you consent.
• Error and performance monitoring: Sentry. Diagnostic data may include technical request context and service-performance information.

We may disclose data when legally required or to protect rights and safety.

6. International transfers

Where data leaves the EEA, transfers rely on adequacy decisions or Standard Contractual Clauses as required by the GDPR.

7. Retention

We keep personal data only as long as necessary. If a trial ends without conversion, workspace data becomes read-only and is deleted 90 days after the trial ends. On account closure, account and workspace data is deleted or anonymized, except where the law requires retention (Spain requires keeping invoices for 6 years). Aggregated, anonymized statistics may be retained indefinitely.

Accounts created on the previous Maverank product ("v1") were transferred to Volcanic Labs when it acquired the product, and migrated to the current service. The v1 database is kept as a read-only archive for 12 months from the migration date and then deleted. If you had a v1 account and want it removed instead, contact us and we will delete it.

8. Your rights

You can access, correct, delete or restrict processing of your personal data, exercise data portability, object to processing, and withdraw consent at any time by contacting us. You may also lodge a complaint with the Spanish Data Protection Authority (AEPD).

9. Children

Maverank is not directed to anyone under 18, and we do not knowingly collect data from minors.

10. Changes to this policy

We post updates to this page with a revised date. Where applicable law requires separate or advance notice, we will provide it.

11. Contact

Volcanic Labs · Plaza de Galicia, Local 7, 38612, Santa Cruz de Tenerife, Spain · [email protected]