Subprocessors list.

A subprocessor is a vendor that processes personal data on behalf of Rank On Maps or on behalf of our business customers through Rank On Maps. Vendors that only provide non-personal data are documented separately so the scope stays clear.

This list is based on the current implementation. If a new vendor starts processing personal data, we should update this page and any customer data processing terms before or when that vendor is introduced.

Railway — Application hosting and infrastructure. Role: Processor / subprocessor. Purpose: Hosts application services, routes traffic, and supports deployment and operational availability. Data processed: Application traffic, operational logs, and any personal data processed by hosted Rank On Maps services. Transfers: May process data in provider-controlled hosting regions. Where required, transfers should be covered by Railway's data processing terms and appropriate transfer safeguards.

Supabase — Database services. Role: Processor / subprocessor. Purpose: Stores and retrieves application data needed to provide Rank On Maps. Data processed: Account and contact records, business profile data, connected Google Business Profile data, review/post data, configuration, and operational metadata stored in the application database. Transfers: May process data in the selected Supabase project region and through Supabase infrastructure. Where required, transfers should be covered by Supabase's data processing terms and appropriate transfer safeguards.

Google APIs — Google OAuth and Google Business Profile APIs. Role: API provider; processor or independent controller depending on the specific Google service and data flow. Purpose: Connects Google accounts and lets Rank On Maps read, analyze, and manage Google Business Profile data that the customer authorizes. Data processed: Google OAuth authorization data, API scopes, listing details, reviews, posts, and related Google Business Profile data needed to operate the service. Transfers: Google may process data globally under its applicable service terms, data processing terms, and transfer safeguards.

DataForSEO — SEO and local search data. Role: Data provider. Purpose: Provides SEO and ranking data used to enrich local search analysis. Data shared: Rank On Maps does not intentionally send customer personal information to DataForSEO based on the current implementation. Requests should be limited to SEO, keyword, location, ranking, or business research data needed for analysis. Transfer note: Because no customer personal information is intentionally shared, DataForSEO is documented separately from personal-data subprocessors. This should be re-reviewed if the integration changes.

Rank On Maps uses Google APIs only after a customer authorizes access. Google Business Profile data should be used to provide the requested service, such as profile auditing, review management, posts, and local visibility analysis. We do not use Google Business Profile data to train AI models made available to other customers.

If Google API scopes, products, or data flows change, this page and the Privacy Policy should be reviewed before launch.

Business customers can request a data processing addendum or more detail about vendor safeguards by contacting hello@rankonmaps.app.

Where required, processor and subprocessor relationships should be governed by written data processing terms, confidentiality commitments, appropriate security measures, breach notice obligations, deletion or return obligations, and international transfer safeguards.

Questions about this list or vendor data flows can be sent to hello@rankonmaps.app.