OUTRANKED.ME
List

Privacy Policy

What data Outranked.me collects, why, how long it is kept and your rights.

Last updated

Pre-launch review required

This document is an operator-ready draft that accurately describes how this system behaves. Passages in square brackets are placeholders for the operating entity’s details and must be completed and reviewed by a qualified lawyer before launch.

1. Who controls your data

[OPERATING ENTITY LEGAL NAME], [REGISTERED ADDRESS]. Contact: legal@outranked.me.

2. What we collect

We collect only what the Platform needs to function:

  • Account data: email address, display name, password (stored only as a salted scrypt hash, never in readable form), and your account preferences.
  • Listing data: everything you choose to publish about your listing. This is public by design.
  • Payment data: amounts, currency, provider, provider transaction identifiers, and billing details you supply for invoicing. We never receive or store your full card number.
  • Attribution data: outbound clicks, recorded against a rotating salted hash rather than your IP address, plus coarse country, device type and referring domain.
  • Session data: an opaque session token (stored hashed), the IP address and user agent of your sign-ins, for security and audit.
  • Usage analytics: on public pages, Microsoft Clarity records how pages are used (clicks, scrolling and page layout) as heatmaps and session recordings, with device, browser and approximate country. It never captures what you type into forms. It is not started on account, administration, checkout, claim or sign-in pages, and their content is never captured.
  • Page-view measurement: Google Analytics counts visits, meaning the address and title of each page viewed, the referring site, and approximate country and device type. It never receives what you type into forms.

3. What we deliberately do not do

We do not store raw IP addresses against click events. The visitor identifier is a salted hash that rotates every day, which makes it sufficient for same-day deduplication and useless for tracking anyone over time.

We do not sell personal data. We do not share it with advertisers or data brokers.

We do not build cross-site advertising profiles.

4. What is public

A listing on Outranked.me is public. Its name, description, destination, category, location, verified spend total, click totals, position and ranking history are all visible to anyone.

The identity of the person or account that made a payment is never published. Only the amount is, because the amount is what determines position.

5. Why we are allowed to process it

Performance of a contract: operating your account, publishing your listing, taking payment.

Legitimate interests: fraud prevention, abuse detection, security and service analytics.

Legal obligation: retaining financial records for accounting and tax.

Consent: marketing email, which is off by default, and analytics cookies, which are set only if you accept them. Both can be withdrawn at any time.

6. How long we keep it

Account data: while your account is open, then deleted or anonymised on request.

Payment and invoice records: retained for the period required by applicable accounting and tax law, even after account closure. We cannot delete these on request.

Click events: retained in raw form for analytics and fraud investigation, then aggregated.

Session records: pruned after expiry.

7. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to processing, and to complain to a data protection authority.

To exercise any of these, contact legal@outranked.me. We will respond within the period required by applicable law.

8. Cookies

We set a session cookie when you sign in, a CSRF token cookie to protect form submissions, a theme preference cookie, and a cookie that remembers your analytics cookie choice. All four are strictly necessary or purely functional.

We do not set advertising or cross-site tracking cookies ourselves.

Google Analytics and Microsoft Clarity set analytics cookies only if you accept them on the cookie banner. Until you choose, or if you decline, both are told that consent is denied, set no cookies, and cannot recognise you across pages or visits. You can change your choice with Cookie settings at the bottom of every page. The Cookie Policy lists each cookie.

9. Processors

We share data with the payment providers you choose to pay through, our email delivery provider, and our hosting provider. Each processes data only as needed to provide their service.

Microsoft processes usage analytics from public pages through Microsoft Clarity, under the Microsoft Privacy Statement.

Google processes page-view measurement through Google Analytics, under the Google Privacy Policy.

[LIST OF SUB-PROCESSORS AND THEIR LOCATIONS TO BE COMPLETED BEFORE LAUNCH.]