Privacy Policy

TopRankAgent.com | Effective Date: November 5, 2026

TopRankAgent.com ("TopRankAgent," "we," "our," or "us") operates an AI-powered, multi-tenant Software-as-a-Service (SaaS) platform designed for digital marketing agencies, SEO professionals, and their business clients. Our platform offers services including, but not limited to: AI agent orchestration, SEO analysis, Answer Engine Optimisation (AEO), Generative Engine Optimisation (GEO), keyword research, rank tracking, backlink analysis, website technical auditing, content intelligence and planning, editorial content brief generation, content workflow and approval management, competitor analysis, internal link analysis, automated CMS publishing, agency and client revenue management, white-label workspace deployment, and performance reporting.

NDVTECHSYS SOLUTIONS LLP, a Limited Liability Partnership incorporated under the Limited Liability Partnership Act, 2008 in India (LLPIN: ACL-0157, RoC - Hyderabad), with its registered office at Unit 1012, 10th Floor, Manjeera Trinity Corporate, Beside Lulu Hyper Market, KPHB Phase 3, Kukatpally, Tirumalagiri, Hyderabad, Telangana, India - 500072 and corporate operational office at MyScape Weave, Sy No 322, Ground & First Floor, Nanakramguda, Financial District, Hyderabad, Telangana, India - 500032, is the Data Fiduciary in respect of personal data processed through our platform as defined under the Digital Personal Data Protection Act, 2023 ("DPDPA") and the Information Technology Act, 2000 ("IT Act").

Dual Data Role: Where our platform stores and processes personal data belonging to end-clients of agencies that subscribe to our Services (e.g., client contact data stored within an agency's workspace), we may act as a Data Processor processing data on behalf of our agency subscribers (the Data Fiduciary in that context). Such processing is conducted solely as per our contractual obligations, our Data Processing Agreement, and applicable law.

This Privacy Policy ("Policy") explains how we collect, use, store, process, disclose, transfer, and protect personal data. This Policy must be read together with our Terms of Service, Cookie Policy, and Refund and Cancellation Policy.

By accessing our website, registering an account on any tier (Platform, Agency, or Client), subscribing to any Service, or continuing to use the platform, you:

(a) Acknowledge that you have read and understood this Policy in its entirety;

(b) Provide free, specific, informed, unconditional, and unambiguous consent (signalled by a clear affirmative action — pre-ticked boxes are not used) to the collection, use, and processing of your personal data as described herein, in accordance with Section 6 and Section 7 of the DPDPA, 2023 and Rule 5 of the IT (SPDI) Rules, 2011;

(c) Confirm you have the legal capacity to provide such consent under the Indian Contract Act, 1872;

(d) Where you are representing a business entity, confirm you are duly authorised to bind that entity.

You have the right to withdraw consent at any time as described in Section 11. Withdrawal of consent does not affect the lawfulness of processing conducted before withdrawal. Where consent withdrawal relates to processing essential to deliver contracted Services, we may be unable to continue providing those Services.

3.1 Data Provided Directly by You

3.2 Sensitive Personal Data or Information (SPDI)

The following categories constitute SPDI under Rule 3 of the IT (SPDI) Rules, 2011 and are handled with heightened security measures:

• Passwords: Stored in hashed, salted, and encrypted form; never in plaintext.
• Financial information: Limited billing identifiers. Full financial instrument data is exclusively handled by RBI-authorised payment processors.

We request that you do not submit sensitive personal information (including Aadhaar numbers, PAN numbers, biometric data, health information, or similar) through our platform, as it is not designed or required to collect such data.

3.3 Data Collected Automatically

• Device and Technical Data: IP address (retained in audit logs for security purposes), browser type, operating system, device identifiers, referring URL.
• Usage and Behavioural Data: Pages visited, features accessed, session duration, click-stream data, platform interactions, error logs, analysis run activity.
• Audit Log Data: For security and compliance, our platform maintains an Audit Log recording significant administrative actions (e.g., user role changes, subscription modifications, integration updates, platform configuration changes) including actor identity, actor role, target entity, action taken, timestamp, and IP address.
• Cookie and Tracking Data: As described in Part 3 (Cookie Policy).

3.4 Data from Third-Party Integrations

When you connect third-party services to our platform, we receive data via authorised API calls. The specific integrations and data accessed are:

Third-party integration data is processed under this Policy and the respective third-party provider's terms of service. You should review those third parties' privacy policies before connecting integrations.

We do not conduct automated decision-making that produces legal or similarly significant effects on individuals without appropriate human review (our content recommendation, approval, and CMS publishing workflows require explicit human-in-the-loop approval from authorised agency or client users before execution).

We engage the following categories of third-party processors to deliver our Services. These providers process data under written contracts that require them to maintain adequate security safeguards and process data only as instructed:

Important: Data submitted to AI/LLM providers (such as prompts, keyword data, and business context) may be processed by those providers in accordance with their own terms. We take reasonable steps to select providers with adequate data protection provisions. We advise you not to include personally identifiable information or sensitive business secrets in AI prompt fields beyond what is strictly necessary for the requested functionality.

Our platform operates a three-tier multi-tenant architecture:

• Tier 1 — Platform Level: Operated by TopRankAgent's internal team (Platform Super Admin, Platform Operations User, Head of Client Services). Has oversight access to all agency and client data for administration, support, and security purposes.
• Tier 2 — Agency Level: Agencies and their team members (Agency Admin, SEO Manager, Content Writer) access only their own agency workspace, their own client accounts, and project data scoped to their agency.
• Tier 3 — Client Level: Client users (Client Admin, Client Viewer) access only data belonging to their own client organisation.

Data from one agency's workspace is strictly isolated from other agencies through role-based access controls enforced at every API endpoint. Cross-tenant data leakage is prevented by scoped database queries and RBAC middleware checks. This architecture is maintained for all client data, project data, analysis results, integrations, and billing records.

White-Label Workspaces: Agencies with the white-label feature enabled may deploy our platform under their own branded domain. In such cases, end-clients of that agency interact with the agency's branded interface. TopRankAgent remains the underlying Data Fiduciary for personal data processed through the platform. The white-labelling agency is responsible for ensuring their end-clients are informed of this Policy or an equivalent policy meeting applicable legal requirements.

Our platform uses a multi-tier AI agent pipeline — including Pure Rule-Based Agents (Technical SEO, Rank Tracking, Backlink, Website Analysis), Hybrid Engines (Keyword Research, Competitor Analysis, Internal Linking, Reporting), and Generative Agents (Content Planner, Content Brief, Content Refresh) — to produce SEO recommendations, content calendars, editorial briefs, and reports.

You expressly acknowledge and agree that:

(a) AI-generated outputs are probabilistic and non-deterministic — they may contain inaccuracies, outdated information, or content similar to that generated for other users;

(b) No guarantee of search engine rankings, organic traffic, Google AI Overview citation, AEO/GEO performance, leads, conversions, revenue, or specific business outcomes is made or implied;

(c) Search engines and AI answer platforms (including Google, Bing, ChatGPT, Perplexity, and similar) independently and autonomously determine how they index, rank, cite, and display content;

(d) AI outputs are not professional legal, financial, medical, or regulated advisory services;

(e) Our platform includes a human-in-the-loop content approval workflow (draft → approved → applied/rejected) for AI-generated content. No content is auto-published to your CMS without an explicit approval action by an authorised user, unless you have specifically enabled and consented to the auto-publish setting;

(f) You are solely responsible for reviewing, editing, verifying, and approving all AI outputs before publication or reliance.

We do not sell, rent, or trade your personal data for monetary or other consideration. We may share personal data only as follows:

• Service Providers / Sub-Processors: With vetted technology providers as described in Section 5, subject to data processing obligations.
• Multi-Tenant Architecture: Within your tier (e.g., agency team members can access client data scoped to that agency; Platform administrators can access data for support and operations).
• CMS Publishing Partners: When you authorise CMS publishing, relevant content data is transmitted to your connected CMS (WordPress, Shopify, Webflow) using your provided credentials.
• Legal Authorities: To comply with court orders, government directions, or law enforcement requests under Indian law, including the IT Act, 2000, the Code of Criminal Procedure, 1973, or the Bharatiya Nagarik Suraksha Sanhita, 2023.
• Business Transfer: In a merger, acquisition, restructuring, or asset sale, data may transfer to the successor entity under equivalent data protection obligations and with notice to you as required by applicable law.
• Explicit Consent: For any sharing not covered above, we will seek your prior explicit consent.

Our cloud infrastructure and sub-processors (including AI providers, Stripe, and DataForSEO) may be located outside India. Cross-border transfers are conducted subject to:

(a) The negative-list framework under Section 16 of the DPDPA, 2023 — transfers are permitted to countries not restricted by notification of the Central Government of India;

(b) Adequate contractual safeguards (data processing agreements, standard contractual clauses where applicable) with sub-processors;

(c) Compliance with any sector-specific data localisation requirements that may apply.

We will not transfer data to any country restricted by Central Government notification. This section will be updated promptly upon any such notification.

We retain personal data only as long as reasonably necessary for the purposes described in this Policy:

After applicable retention periods, data is securely deleted or anonymised in a manner that prevents reconstruction.

We implement reasonable security practices and procedures as required under Rule 8 of the IT (SPDI) Rules, 2011 and the DPDPA, 2023, including:

• Encryption in transit: All data transmitted between your browser/app and our servers uses TLS/HTTPS.
• Encryption at rest: Third-party integration credentials (GSC, GA4, WordPress, Shopify, Webflow) are stored using symmetric encryption in our database. Passwords are stored using bcrypt hashing with salting.
• Role-Based Access Controls (RBAC): Every API endpoint enforces RBAC middleware checks. Users can only access data scoped to their role and tenant.
• Brute-Force Protection: Authentication endpoints are protected by IP-based rate limiting (maximum attempts per IP within a sliding time window) with exponential backoff.
• Rate Limiting: API endpoints enforce role-based hourly quotas and IP-based limits to prevent abuse.
• Audit Logging: Administrative actions (role changes, subscription modifications, integration updates) are immutably recorded in our audit log with actor identity, role, action, and IP address.
• Security Headers: HTTP security headers (HSTS, CSP, X-Frame-Options, etc.) are enforced by our backend middleware.

Data Breach Notification: In the event of a personal data breach, we will notify the Data Protection Board of India (DPBI) and affected users in the manner and within timelines prescribed under the DPDPA, 2023 and applicable rules.

You are responsible for maintaining the confidentiality of your account credentials. Use of your account under your credentials by an unauthorised person remains your responsibility unless you notify us immediately of suspected unauthorised access.

Under the DPDPA, 2023 and applicable rules, you have the following rights:

To exercise any right, contact the Grievance Officer as described in Section 13.

In accordance with Rule 5(9) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Consumer Protection (E-Commerce) Rules, 2020, and the DPDPA, 2023, we have designated a Grievance Officer:

Grievance Officer

• Name: Designated Grievance Officer
• Designation: Grievance Officer, NDVTechSys Solutions LLP / TopRankAgent.com
• Email: grievance@toprankagent.com (CC: privacy@toprankagent.com)
• Postal Address: Unit 1012, 10th Floor, Manjeera Trinity Corporate, Beside Lulu Hyper Market, KPHB Phase 3, Kukatpally, Tirumalagiri, Hyderabad, Telangana, India - 500072
• Working Hours: Monday to Friday, 10:00 AM – 6:00 PM IST (excluding public holidays)

Statutory Timelines:

• Complaints acknowledged within 24 hours (IT Rules, 2021).
• Complaints resolved within 15 days from receipt (IT Rules, 2021).
• Privacy rights requests under DPDPA processed within 30 days or such period as prescribed by rules.

If you are unsatisfied with our resolution, you may escalate to the Data Protection Board of India (once operationally constituted) or the appropriate Consumer Forum under the Consumer Protection Act, 2019.

The Services are intended for users who are 18 years of age or older and legally competent to enter binding contracts under the Indian Contract Act, 1872. We do not knowingly collect personal data from minors below 18 years without verifiable parental or guardian consent as required under applicable law. If you believe a minor's data has been submitted, contact the Grievance Officer immediately and we will promptly delete it.

We may update this Policy to reflect changes in our Services, technology, business practices, or applicable law. Changes will be communicated by:

(a) Updating the "Effective Date / Last Updated" date at the top of this document;

(b) Posting a notice on our platform or website;

(c) For material changes or as required by law, sending a direct email notice.

Continued use after the effective date of a revised Policy constitutes acceptance, to the extent permitted by applicable law.

• Website: https://toprankagent.com (Corporate: https://ndvtechsys.com)
• Privacy / Contact Email: privacy@toprankagent.com
• Legal Entity Name: NDVTECHSYS SOLUTIONS LLP
• Registered Address: Unit 1012, 10th Floor, Manjeera Trinity Corporate, Beside Lulu Hyper Market, KPHB Phase 3, Kukatpally, Tirumalagiri, Hyderabad, Telangana, India - 500072
• Corporate / Operational Office: MyScape Weave, Sy No 322, Ground & First Floor, Nanakramguda, Financial District, Hyderabad, Telangana, India - 500032
• GSTIN: 36AAXFN5718P1Z7 (State Code: 36, Telangana)
• LLPIN (Limited Liability Partnership Identification Number): ACL-0157 (RoC - Hyderabad)