Legal framework of RankStudio

DOC 0 Controller identification data Complete first

Until this block is filled in, no other document is valid. Replace each marker once the structure exists:

Golden rule for the rest of this document: we only describe what the site actually does today (auditable with DevTools: no runtime fetch, one technical localStorage). When something new goes into production — analytics, a payment gateway, a real waitlist — this page gets updated first and the feature is turned on second, never the other way around.

DOC 1 Privacy notice GDPR + LFPDPPP

What data we process (and what we don't)

This site, today, receives no content data. The editor demo, the calculator and the glossary run entirely in your browser: the text you type never travels to any server (verifiable in the Network tab of DevTools with the demo open). The only data flows that exist or are planned:

Principles

We expressly bind ourselves to the principles of GDPR art. 5 (lawfulness/transparency, minimization — this notice demonstrates ours: almost nothing is processed —, accuracy, storage limitation, integrity and confidentiality) and to those of LFPDPPP art. 14 (lawfulness, consent, information, quality, purpose, loyalty, proportionality and accountability).

Retention periods

• Waitlist emails (if a waitlist is ever activated): until you unsubscribe or the product launches; if we don't launch within 18 months, the list is deleted (a commitment, not just a policy).
• Customer data (invoices): tax obligations: 5 years MX (CFF) / 6 years ES (general) — whichever is longer applies to your entity. COMPLETE per entity
• localStorage rsx: until you clear your browser data; it never expires because it is never sent.

Your rights and how to exercise them

GDPR (EU/EEA): access, rectification, erasure, portability, restriction and objection, and withdrawal of consent. LFPDPPP (Mexico): ARCO (Access, Rectification, Cancellation, Opposition) + use limitation. To exercise them: write to COMPLETE legal email from the holder's address (sufficient verification for minimal data; we will never ask for more ID than necessary). Response: 1 month (GDPR art. 12.3) / 20 business days + 15 for verification (LFPDPPP arts. 32-33). Complaints, without prejudice to: AEPD (Spain/EU) COMPLETE authority: INAI, https://www.inai.org.mx and your country's authority if you reside elsewhere.

Processors and transfers

Today: no processor handles any of your content data (there are no product servers). Once we operate, each processor will go through an art. 28 contract (see DPA doc 4) and will be listed here and in Annex B of the DPA. International transfers (non-EEA/non-MX providers): they will be covered by adequacy decisions, Standard Contractual Clauses (Decision 2021/914) or, for Mexico, the safeguards of LFPDPPP art. 37. COMPLETE per actual provider

Automated decisions and profiling

No. The Reach Score is a deterministic rubric that runs in your browser on your text; it creates no profiles of individuals and makes no decisions about people. There is no GDPR art. 22 to trigger — and we're the ones saying it, not something you deduce from a footer.

Minors

B2B service aimed at people over 18 (or 14/16 with consent depending on your jurisdiction of residence); not deliberately processed.

Security

HTTPS across the site; no user-content database in the demo (there is nothing to steal); TLS ≥1.2 in transit and encryption at rest with contracted providers, who certify in writing (DPA Annex A).

Changes

Any material change is announced on this page 14 days in advance when it affects new purposes; registered users (when they exist) get an email.

DOC 2 Terms of service Presale and product

Nature of the service

RankStudio is a writing and content-optimization tool for social media. This website is today a functional demo + presale: the calculator, the Reach Score editor and the glossary are real and free; the product with accounts and export is delivered according to what each plan includes. The scoring engine is indicative and auditable (public, deterministic formula): no score guarantees distribution, because the platform controls that, not us.

No affiliation with platforms

RankStudio is not affiliated with, sponsored by or endorsed by LinkedIn (Microsoft Corporation), X Corp., Instagram/Meta Platforms or Google. Trademarks mentioned belong to their owners and are used descriptively. No product feature guarantees the goodwill of someone else's algorithm.

Account, BYOK and your text

• You keep ownership of everything you write; using the product grants us nothing except the minimal technical license to operate (processing what you send us once the paid product exists).
• On BYOK plans, your third-party API keys are used only to run your requests against your provider; we never resell them or use them for training. Their custody, rotation and provider cost are yours.
• Don't use the product for automated spam at scale, impersonation, disinformation or illegal content; we may suspend accounts that breach this, with notice whenever possible.

Plans, pricing and founder presale

Founder Lifetime Pass (one-time $99 USD, founder pricing — seats limited by API capacity; guaranteed to whoever buys it), Pro ($19 USD/mo, currently sold out — waitlist) and Agency ($249 USD/mo, Concierge by invitation only). Prices exclude taxes: applicable VAT/ISR depends on the tax entity COMPLETE: MX/ES regime, CFDI invoicing / European invoice. The Pass is a one-time payment with no renewal. Subscriptions (when available) are cancelled from the dashboard before the next charge, taking effect at the end of the paid period — no lock-in penalties, ever.

Withdrawal and refunds

EU/United Kingdom: 14 calendar days of withdrawal (Dir. 2011/83/EU). If digital content starts being used before that, we will ask for your express waiver at checkout (art. 16.m) so charging you is lawful — the checkbox will exist, it won't be fine print. Our own commercial guarantee (both sides of the Atlantic): 14 days from the LTD purchase, full refund, no questions asked — it's the number the landing page already promises, and here it becomes binding. Partial refunds on subscription months: no; cancelling and using the service until the end of the period: yes.

Availability and SLA

The demo is provided "as is", with no SLA. The Agency plan will include an availability commitment and maintenance windows COMPLETE (suggested: 99.5%, windows announced 72 h in advance). There is no liability for campaign results or organic reach (see nature of the service).

Intellectual property

The interface, the engine rubric and our own documents © COMPLETE legal entity (2026). The PDFs and text you generate are yours: use them, sell them, publish them with no license from us.

Liability and limits

To the maximum extent permitted by law (which in EU consumer matters does not allow exempting willful misconduct, gross negligence or consumer rights), our total liability to a customer is limited to the amount paid in the previous 3 months; we are not liable for lost profits or for decisions made on third-party metrics. The limits do not apply where the law says they don't: that is stronger than an exemption, and we put it in writing.

Governing law, jurisdiction and language

These terms are governed by COMPLETE: suggested CDMX/Mexico or Spain depending on the entity you incorporate. For consumers, the mandatory law of their habitual residence still applies where more favorable. This document is drafted in Spanish; any translations are a courtesy — the binding text is the Spanish original.

Amendments and severability

Material changes with 30 days' notice by email to paying users; anyone who disagrees may cancel with a pro-rata refund of prepaid content (once an LTD with pending content exists). A void clause does not drag the rest down with it.

DOC 3 Cookie and local storage policy Honesty first

Verifiable status of this site

We install no advertising or third-party analytics cookies, now or by default. There is no consent banner because there is nothing to consent to: the only storage technology this site uses is local and technical.

Conditional future

If analytics (GA4, Plausible, Umami…), ad pixels or personalization are ever activated: (a) this policy and the privacy notice are updated first, (b) the script is turned on second, with prior opt-in consent in the EEA/UK (GDPR/ePrivacy; in Spain, loading outside the technical exemption group requires accept/reject at the same level — no buried "Reject" button) and equivalent notice in Mexico (privacy notice update, LFPDPPP art. 16). This paragraph is a self-imposed obligation so that today's "no" is credible.

How to delete rsx

DevTools (F12) → Application/Storage → Local storage → rankstudiolab.com → delete, or your browser's "clear site data" option. The demo keeps working; you only lose your local draft.

DOC 4 DPA — Data processing agreement Annex to the Agency plan

Template to attach as an annex to the Agency Studio contract when the product processes data on behalf of the customer (processor = RankStudio, controller = the customer). With sensitive data (health, political opinion…) or large volumes, this is a starting point, not a final product: get a lawyer for the specific case.

Minimum clauses (GDPR art. 28.3)

1. Instructions: we process only per the controller's documented instructions, transfers included; if an instruction breaks the law, we tell you before acting.
2. Confidentiality of authorized personnel (written or legal commitment).
3. Security art. 32: Annex A.
4. Sub-processors: Annex B; 30 days' notice of changes and a reasonable right to object; the sub-processor signs a mirror of art. 28.4.
5. Data subject rights: reasonable technical assistance (no legal advice to the data subject; we redirect).
6. Compliance and evidence: we make reasonable information available to demonstrate compliance and allow audits with 30 days' notice, once a year unless there is an incident, at the controller's cost.
7. Erasure or return at the end of the service, per instruction, within 30 days except where a legal retention obligation applies (we will tell you when it does).
8. Breach notification: without undue delay and in any event within 72 h of becoming aware (art. 33.2), with the minimum content of art. 33.3 (nature, categories, volumes, measures, contact) without waiting for the full picture.

Processing elements (art. 28.3, filled in at signing)

Annex A — Security measures (declared minimum floor)

• TLS ≥1.2 in transit; encryption at rest for databases and backups (AES-256).
• Authentication: mandatory MFA for staff with access; production access with justification and logging.
• Security logs ≥12 months; encrypted backups with quarterly tested restores.
• Organizational security: incident policy, annual training, access reviews every 90 days.
• Provider certifications (ISO 27001/SOC 2): COMPLETE per actual hosting — never claim without a certificate.

Annex B — Sub-processors

Mexico mirror

For Mexican customers: the processor undertakes not to process the data for its own purposes (LFPDPPP art. 81), to apply the measures of art. 82 + second annex of the Regulations, and to keep the data for whoever the controller designates. Processor transfers: only with the controller's consent or under the causes of art. 37.