Política de privacidad

This policy explains what personal data Autoranko collects, why we collect it, how long we keep it, who helps us process it, and the rights you have. We’ve tried to write it to be read, not skimmed past.

1. Who we are

Autoranko is the controller of your account data — for example your email address and subscription status. For the website content you connect and the content we generate for you, we act on your behalf as a processor. You can reach us about anything in this policy through our contact page.

2. What we collect

• Account data: your email address, an optional name, your preferred language, and your password — stored only as a bcrypt hash, never in plain text.
• Site data: the URL, name and admin email of each WordPress site you connect, plus content synced by the plugin, such as posts, pages, categories and products, and a versioned mirror of your articles.
• WordPress credentials: if you authorize publishing, a WordPress application password. It is encrypted with AES-256-GCM before it is stored and is used only to publish or update content you have asked for. You can revoke it in WordPress at any time (Users → Profile → Application Passwords), or disconnect publishing from the Autoranko plugin, which deletes it from our database.
• Content you create with us: topics, keywords, outlines, drafts, published post IDs and your AI model settings.
• Usage data: which AI actions ran, the model used and token counts — needed to enforce plan limits and keep the service healthy.
• Billing data: your Stripe customer ID, plan and subscription status. Card details go directly to Stripe and never touch our servers.
• Messages: the name, email address and message you send through our contact form or the plugin’s support form.
• Technical data: IP address, browser type and request logs that our servers record for security and debugging.

3. Why we use it, and our legal bases

• To provide the Service — run analyses, generate and publish content, enforce plan limits and support you. Legal basis: performance of our contract with you.
• To keep the Service secure and working — prevent abuse, debug problems and improve reliability. Legal basis: our legitimate interests.
• To handle payments, taxes and accounting. Legal basis: our legal obligations.
• To send product news — only if you opt in, and you can opt out at any time. Legal basis: your consent.

We don’t sell personal data, we don’t share it with advertisers, and we don’t use your content to train AI models.

4. AI processing through KIE

Autoranko’s AI features are powered by models accessed through KIE (kie.ai), an AI API provider. When a step runs — a site analysis, an outline, a draft, an image — we send KIE the information that step needs, such as your business profile, the topic, keywords and relevant excerpts of your site’s content. KIE runs the model selected for that step (for example a Claude, GPT or image-generation model), which can involve the model’s developer processing the request on KIE’s behalf.

We never send your password, your WordPress credentials or your payment details to AI providers. You can see and change which model handles each step in Dashboard → AI Models.

5. Who else processes your data

• KIE — AI processing, as described above.
• Stripe — payments and subscription management.
• Our hosting provider — the servers that run Autoranko and its database.

We may also disclose data when the law requires it, or to protect the rights and safety of our users or the public. If Autoranko is ever involved in a merger or acquisition, your data would stay protected by this policy, and we would notify you before it became subject to a different one.

6. International transfers

Our providers may process data outside your country, including in the United States. When data from the EU, the EEA or the UK is transferred, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7. How long we keep it

• Account data — while your account is open; deleted within 30 days after you ask us to delete your account.
• WordPress credentials — until you disconnect the site or your account is deleted.
• Site content and generated content — while the site is connected; deleted within 30 days after you ask us to remove the site or delete your account. Content already published on your website stays there — it’s yours.
• Usage records — up to 24 months, then deleted or anonymized.
• Billing records — as long as tax and accounting law requires, typically up to 10 years.
• Contact messages — up to 24 months after the conversation ends.
• Server logs and backups — up to 30 days.

8. Your rights

Wherever you live, you can ask us to access, correct, export or delete your personal data. If you are in the EU, the EEA or the UK, the GDPR also gives you the right to restrict or object to certain processing, the right to data portability, and the right to withdraw consent at any time without affecting earlier processing. You can also lodge a complaint with your local data protection authority.

To exercise any of these rights, write to us through our contact page from the email address on your account. We will respond within one month.

9. Cookies

We only use cookies that are needed to run the service — no analytics, advertising or tracking cookies, which is why you don’t see a cookie banner.

• ar_session — keeps you signed in to the dashboard. It is HTTP-only and cryptographically signed, and it expires after 30 days or when you sign out.
• NEXT_LOCALE — remembers which language you use on our website when it differs from your browser’s language. It is a session cookie, deleted when you close your browser.

10. Security

Traffic to Autoranko is encrypted with TLS. Passwords are hashed with bcrypt, WordPress credentials are encrypted with AES-256-GCM, and session tokens are signed with HMAC-SHA256. Access to production systems is limited to the people who need it. No system is perfectly secure; if a breach affects your data, we will notify you and the relevant authorities as the law requires.

11. Children

Autoranko is a business tool and isn’t directed at children. We don’t knowingly collect data from anyone under 16; if you believe we have, contact us and we will delete it.

12. Changes to this policy

If we change this policy in a material way, we will tell you by email or in the dashboard before the change takes effect. The date at the top of this page shows when it was last updated.

13. Contact

Privacy questions and requests: use our contact page.