What we collect
- —Account data — when you sign up we store your name, email address and a bcrypt hash of your password (never the password itself).
- —Reviews and endorsements — your star ratings, written feedback and thumbs-up votes, linked to your account so every signal has a real person behind it.
- —Claim requests — the name, business email, role, website and message you submit when claiming a listing.
- —Listing data — company name, category, region, tagline, website, description and maker names submitted through Add Business or Owner Studio.
- —Uploaded media — thumbnail images and video files uploaded by Verified/Claimed owners, stored securely in managed object storage. We store the file URL and your account ID.
- —Discover interactions — per-post like counts (linked to your account if signed in, or to your anonymous session ID if not) and view counts (session-based, not linked to personal data).
- —Discover feature requests — business name, category, contact message and boost type you submit through 'Get Featured'. These are not published publicly until an admin approves them.
- —Payment data — when you activate a Boost, your payment is processed by Stripe. HighRank never receives or stores your card number, CVV or full payment details; Stripe returns only a session ID and payment status.
- —Usage signals — an anonymous visitor session ID (stored in your browser) with a periodic heartbeat so we can show a live visitor count, and per-company view counts. We do not run third-party analytics or advertising trackers.
Cookies and local storage
- —access_token — an httpOnly cookie that keeps you signed in. It cannot be read by JavaScript and expires after 7 days.
- —hr-theme — your light/dark preference, stored in your browser only.
- —hr-visitor-session — a random ID used solely for the live visitor counter and anonymous Discover like/view tracking.
- —We do not use advertising or cross-site tracking cookies.
How we use your data
- —To operate the leaderboard: displaying listings, reviews, endorsements, Rank Positions and HighRank Scores.
- —To operate Discover: displaying featured business cards, tracking view and like counts, and processing feature requests submitted for editorial review.
- —To generate share images: when a Discover card is shared, we use the post's public business name, tagline, category and media thumbnail to produce a branded 1200×630 PNG. No personal account data is embedded in these images.
- —To verify claim requests and to email you the outcome (approved or rejected) via our transactional email provider.
- —To notify business owners of media decisions (image or video approved or rejected) via transactional email.
- —To process Boost payments through Stripe and to activate or deactivate Boost placement based on subscription status.
- —To process refunds: if submitted media is rejected during admin review, your Boost payment is refunded via Stripe. Refund status is stored alongside your payment record.
- —To prevent abuse: login attempt throttling, file upload scanning, content moderation and one-review/one-thumbs-up-per-person-per-company enforcement.
Third-party services
- —Object Storage — images, videos and other media files uploaded to business profiles and Discover posts are stored in managed object storage. Files are served via CDN URLs.
- —Transactional Email (powered by Resend) — transactional emails only (claim decisions, media approval/rejection). We do not send marketing emails. Each message includes the business name you submitted.
- —Stripe — payment processing for Boost subscriptions. Stripe operates under its own privacy policy. HighRank stores only a Stripe session ID and payment status flag.
- —MongoDB Atlas — our primary database. Data is hosted in the cloud region selected at account setup.
What we never do
- —We never sell your personal data.
- —We never blend paid visibility (Boost) into the HighRank Score.
- —We never publish your email address on public pages.
- —We never use uploaded media for purposes other than displaying your business profile and Discover card.
- —We never send marketing or promotional emails — only transactional messages you explicitly triggered.
Your rights
- —You may request a copy, correction or deletion of your account data, reviews and endorsements at any time by emailing support@highrank.space.
- —Businesses may request correction or removal of an unclaimed listing via the same address.
- —You may request deletion of media you uploaded (GIFs, videos) by contacting us; we will remove the file from storage and the listing.
- —If you are located in the EU/EEA, you have rights under the GDPR including access, rectification, erasure, restriction and data portability. You also have the right to lodge a complaint with your local supervisory authority.
- —If you are located in California, you may have additional rights under the CCPA.
Data retention & security
- —Passwords are stored only as bcrypt hashes. Sessions expire automatically after 7 days.
- —Claim requests are retained while pending and for a reasonable audit period after a decision.
- —Discover feature requests are retained while pending review, and for an audit period after approval or rejection.
- —Uploaded media files are retained as long as the associated business listing exists, or until removed by the owner or admin. Rejected media may be deleted immediately after the review decision.
- —Payment and refund records are retained for accounting and dispute-resolution purposes as required by law.
- —Visitor heartbeat and anonymous view records expire automatically within minutes.
- —All admin credentials are seeded once at setup and are never overwritten by automated processes.
Questions about this policy or your data?