Privacy Policy

Last updated: 24 August 2026

This Privacy Policy describes how your personal information is collected, used, and shared when you visit surerank.com, when you use the SureRank plugin on a site we operate, and when you install the SureRank plugin on a site of your own.

Where SureRank is installed on someone else’s website, that website’s owner decides what their site collects and is responsible for the privacy policy shown to their visitors. Most of what the plugin does happens inside that WordPress installation and stays there. This policy covers our own sites, and it covers the specific BSF-operated services where information leaves a WordPress installation and reaches us. Those services are described under What SureRank Collects From Your Website below.

Who We Are

We are Brainstorm Force US LLC. You can find more information about us, including our full address, on our company website.

Contact for all privacy matters: [email protected]

What Personal Information We Collect

When you visit our website, we automatically collect information about your device, including your web browser type, IP address, and time zone. As you browse the Site, we also collect information about the individual web pages or products you view, what websites or search terms referred you to the Site, and how you interact with the Site.

Cookies and Similar Technologies

“Cookies” are small data files placed on your device, often including an anonymous unique identifier. We use cookies and similar technologies (such as pixels and tags) across our sites for the following purposes:

• Essential — required for core site functionality, including security, bot protection, and load balancing
• Functional — remember your preferences and settings, and run the support chat widget
• Analytics — help us understand how visitors use our sites and test improvements to site design
• Marketing — used for advertising measurement and remarketing

Our consent system is configured to prevent non-essential analytics and marketing technologies from running until the required consent has been provided. Functional technologies are handled according to their purpose and the applicable consent requirements. You can change your preferences at any time by clicking Cookie Preferences in the footer.

We honor the Global Privacy Control (GPC) signal where required by law. If your browser or extension sends a GPC signal, we treat it as a valid request to opt out of the sale or sharing of your personal information.

A list of the cookies and tracking technologies our scanner detects on this site is available on our Cookie Policy page, linked from the cookie preference banner. That list is updated when the scanner detects a change. A scanner sees what loads on the pages it visits, so a technology that appears only on a page it has not yet scanned may not be listed straight away.

Retention: Records of your cookie consent choices are retained for up to 365 days, or less if manually cleared sooner, so we can demonstrate compliance with applicable consent requirements and honor your prior preferences on return visits.

What SureRank Collects From Your Website

SureRank is an SEO plugin. Most of what it does happens entirely inside your own WordPress installation, and the data stays there. The sections below cover the cases where information leaves your site and reaches us or a provider we use.

Search Console Connection

If you connect your site to Google Search Console, you authorize us through Google’s own consent screen. We receive an access token that lets SureRank read your site’s search performance data and display it in your dashboard. We do not receive your Google account password, and you can revoke access at any time from your Google account security settings or from within SureRank.

Instant Indexing

If you use Instant Indexing, SureRank submits the URLs of your published content to search engines so they can crawl those pages sooner. Only the URL is sent. No visitor data and no page content is included.

SEO Analysis

When you run an SEO analysis, SureRank examines the content of the page you selected in order to produce recommendations. Where that analysis runs on our servers rather than on your own site, the page content is sent to us, processed to generate the result, and not stored in the SureRank application database afterwards. Ordinary server and error logs may hold a short-lived record of the request.

Email Reports

If you turn on Email Reports, we store the recipient email addresses you enter and the schedule you set, so we can send the report. Reports contain your own site’s SEO data. You can turn this off and remove the addresses at any time.

License Activation and Your Account

Your license and billing are managed through my.surerank.com. Activating a license sends us your website URL, name, and email address, as described under License Keys below.

Use of AI Features

We offer optional features that use artificial intelligence to assist with tasks such as content suggestions, improvements, checks, and generation. These are opt-in. SureRank works normally if you never use them.

You do not need to supply your own API key. AI requests are routed through infrastructure we operate, which means the request reaches the provider from us rather than directly from your site. Only the text or image data required for the task is sent.

What we do with AI data. We do not save the inputs you send to an AI feature, or the outputs returned to you, in the SureRank application database once the result has been delivered, other than any output you choose to keep on your own site. We do not use your data to train models or to build datasets of our own.

What the AI provider does with it. The task itself is handled by a third-party AI provider. We currently use OpenAI and Google. We access them through their developer APIs rather than their consumer chat products, and under those API terms the data sent this way is not used to train their models by default. Provider-side retention is a separate matter from our own: a provider may hold the request and response for a limited period for abuse monitoring and security purposes under its own terms. We do not claim otherwise on their behalf, and if you need to know the current arrangement for a particular provider, write to us at [email protected].

You may stop using AI features at any time and continue using the product normally.

Comments

When you leave comments on the site, we collect the data shown in the comments form, along with your IP address and browser user-agent string, to help with spam detection.

An anonymized string created from your email address (a “hash”) may be shared with the Gravatar service to check if you are using it. Gravatar’s privacy policy is available here. After your comment is approved, your profile picture is visible to the public alongside your comment.

Contact Forms

Information submitted through contact forms on our Site is sent to our self-hosted support desk.

We may collect information submitted through contact forms, including (but not limited to) your first and last name and email address. We use it to answer you and to manage your request, and it is stored in our self-hosted CRM for that purpose. Submitting a contact or download form does not add you to our marketing list. We only send you marketing email if you separately opt in, as described under Newsletter Emails below.

Our contact and download forms are protected by Cloudflare Turnstile, which checks that the submission comes from a person rather than an automated script. Turnstile receives basic signals about your browser and device to make that check.

Support Chat

Our support chat widget is provided by our own self-hosted helpdesk at help.brainstormforce.com. It loads only after you provide consent. If you start a conversation, we receive the messages you send along with any name or email address you provide, and the page you were on when you opened the chat.

Support

To help with our products, we may ask for temporary access to your website, such as an admin login or FTP or database credentials. We prefer to work on a staging copy wherever that is practical, and we will ask for one first. Where a problem cannot be reproduced on a staging copy, we may ask for temporary access to your live site instead, and it is your choice whether to give it.

We may also ask you to share a license key, name, or email address.

A few important points about access shared with our support team:

• We use any access you provide strictly for debugging your specific issue
• We do not share your access or your data with anyone outside the company, other than the service providers listed in this policy that host and operate our support systems
• We recommend keeping a working backup of anything you share with us

Retention: You are responsible for rotating or revoking any login, FTP, or database credentials you shared with us once your issue is resolved. We have no further use for them after the support ticket closes.

We retain support ticket records, including any screenshots, logs, or other materials shared as part of a ticket, for 3 years from the date the ticket is closed. We do this so we can refer back to how a past issue was resolved if it recurs, and to analyze recurring issues internally to improve our products.

If a site or staging copy we access contains your own customers’ or visitors’ personal data, we access that data only as necessary to resolve your issue and do not retain or use it beyond that purpose. You remain responsible for your own compliance obligations toward your site’s visitors and customers.

Purchase

If you purchase products or services from us, our payment gateway provider may require your credit card and billing information to process the transaction. Credit card details are not stored by us on any internal or external database accessible to us.

We use payment providers that state they maintain applicable PCI DSS compliance for their payment services. PCI DSS is administered by the PCI Security Standards Council.

When you make or attempt a purchase, we verify your card through a payment gateway and collect information including your name, billing address, payment information, email address, and phone number. Checkout and license management run through SureCart at my.surerank.com.

Retention: Billing and transaction records are retained for as long as your account or license remains active, including to support plan renewals. Because we are subject to tax, accounting, and audit-related legal obligations, financial records are retained for the period required by applicable law even after account deactivation or a data deletion request. This is a standard, legally recognized exception to deletion rights, not a workaround, and applies specifically to financial and transaction records rather than personal information generally.

Information About Your Website and Server Configuration

When you use our WordPress products, and only if you have opted in to usage tracking, we may receive website and technical usage information about your site, including (but not limited to) whether SSL is installed, Curl, PHP and MySQL versions, PHP ini settings, server software, WordPress version and language, timezone, whether the site is a Multisite installation, debug settings, site URL, active plugins and theme, and BSF Updater version.

Most of this describes software and server configuration rather than a person. Some of it, such as your site URL, can be connected to you or to your account, so we do not treat this information as categorically non-personal and we handle it under this policy.

This is switched off unless you turn it on, and you can turn it off again at any time. Learn more here.

We collect it to develop better, more compatible software and serve our customers more effectively.

License Keys

A license key is required to validate your purchase and unlock benefits like automatic updates, developer support, and extra resources. When you activate a license key, we receive your website URL, name, and email address, and we keep records of every website URL where the key has been activated.

Retention: License activation records are retained while the license is active, and afterwards for the period reasonably necessary for account history, support, fraud prevention, tax and accounting obligations, and dispute handling.

Who We Share Your Data With

We do not sell or trade your personal information for money.

Some of our advertising and analytics tools involve sharing personal information with third parties for cross-context behavioral advertising, as that term is defined under California law, meaning those partners may use information about your activity on our sites to show you relevant ads elsewhere. This sharing only happens for the categories marked below, and only after you have provided consent through our cookie preference banner, or is subject to your California opt-out rights described further down.

Category	Service (domain detected)	What they receive	Purpose	Sale / Share / Service Provider
Tag management	Google Tag Manager (googletagmanager.com)	IP address, browser and device information, page URL	Loads and manages our other scripts and tags, and reads your consent status to decide which may run	Service provider, not sold or shared. See the note below on how tags behave before you answer the banner
Advertising / conversion measurement	Google Ads and DoubleClick (googleads.g.doubleclick.net, ad.doubleclick.net, stats.g.doubleclick.net, www.google.com, www.google.fi)	Page views, device and browser identifiers, cookies	Ad performance measurement, remarketing, targeted advertising	Shared for cross-context behavioral advertising
Advertising / conversion measurement	Meta Pixel (connect.facebook.net, www.facebook.com)	Page views, device and browser identifiers, cookies, and only where you have consented, hashed contact information via Meta’s Advanced Matching	Ad performance measurement, remarketing, targeted advertising	Shared for cross-context behavioral advertising
Website analytics	Google Analytics (region1.analytics.google.com)	Page views, device and browser identifiers, cookies	Understand site usage. GA4 data may also build Google Ads audiences via Ads Linking	Shared for cross-context behavioral advertising
Performance analytics	Cloudflare Web Analytics (static.cloudflareinsights.com)	IP address, request metadata, page URL, and page timing information	Measure how quickly our pages load. It sets no advertising or analytics cookie and is not linked to advertising audiences	Service provider, not sold or shared. Loads with the page
Session analytics	Microsoft Clarity (www.clarity.ms)	Session interactions including clicks, scrolling, and mouse movement	Understand user experience and identify usability issues	Service provider, not sold or shared
On-site experimentation	Sigmize (api.sigmize.com)	Browsing behavior, page interactions, assigned test variant	A/B testing to improve user experience and site design	Service provider, not sold or shared
Support desk and chat	Our self-hosted helpdesk (help.brainstormforce.com)	Name, email, message content, and the page you were on	Provide support ticketing and live chat	Service provider, not sold or shared
Bot protection	Cloudflare Turnstile (challenges.cloudflare.com)	Device and browser signals for bot detection, IP address	Prevent spam and automated abuse on our forms	Service provider, not sold or shared
Payments and checkout	SureCart (js.surecart.com), Stripe, PayPal	Billing and payment details, IP address	Take and process payments and manage your license	Service provider, not sold or shared
Typeface delivery	Google Fonts (fonts.googleapis.com, fonts.gstatic.com)	IP address, browser information	Serve the typefaces used on our pages	Service provider, not sold or shared
WordPress core services	WordPress.org (s.w.org)	Basic request metadata	Core WordPress functionality such as emoji support and update checks	Service provider, not sold or shared
Sibling BSF product sites	sureforms.com, wpastra.com	Page request metadata	Load shared assets and cross-product links	Service provider, not sold or shared
Email delivery	Amazon SES	Email address	Transactional and marketing email, sent from our servers	Service provider, not sold or shared
Profile pictures	Automattic Inc. (Gravatar)	Hashed email address	Show a profile picture next to a comment, on pages that have comments	Service provider, not sold or shared
Affiliate attribution	AffiliateWP cross-domain tracker	Referral and click identifiers	Track and pay affiliate referrals	Service provider, not sold or shared
AI processing	OpenAI, Google	Only the text or image data required for the task you requested	Generate AI output for optional SureRank AI features	Service provider, not sold or shared. Accessed through their developer APIs, under which the data is not used to train their models by default. Each provider may retain the request for a limited period under its own terms, as described under Use of AI Features

How we classify these recipients: the last column reflects the written agreement and data-processing terms we have in place with each provider, and the way we have configured the service. It is our assessment rather than a guarantee about a provider’s own practices, and we review it when we add a provider or change a configuration.

How tags behave before you answer the banner: our consent tool controls when advertising and analytics tags may run. Depending on the page and the rules that apply where you are, either our tag container is not loaded at all until you answer the banner, or it loads with Google Consent Mode signalling that consent has not been given, which lets it read your choice while sending no identifiers and setting no advertising or analytics cookies. In either case, no advertising or analytics cookie is set, and no identifier is sent to Meta or to Google Ads, until you have consented to marketing. Meta’s Advanced Matching, which lets Meta match hashed contact information to a Meta account for better ad targeting, is active only for visitors who have consented to marketing cookies.

Cross-BSF-product tracking: Because Brainstorm Force operates multiple distinctly branded product sites (SureRank, Astra, Spectra, SureForms, and others), each site runs its own independent cookie consent tool. Your consent choice on one BSF site does not carry over to another. When you visit any BSF-operated site, you will see that site’s own cookie banner, and that site applies its own consent configuration, so technologies that require consent run according to the choice you make there. If you want to opt out across multiple BSF properties, you will need to do so on each site individually.

How Long We Keep Your Data

We keep personal information only for as long as we need it for the purpose we collected it, or for as long as the law requires. In practice:

• Cookie consent records are kept for up to 365 days.
• Support ticket records are kept for 3 years from the date the ticket is closed.
• Purchase and license records are kept for as long as you hold a license with us, and afterwards for the period our tax and accounting obligations require.
• Email report recipients are kept until you remove them or turn the feature off.
• Search Console access tokens are kept until you disconnect the integration or revoke access from your Google account.
• AI inputs and outputs are not stored in the SureRank application database once the result has been returned. The AI provider may retain the request for a limited period under its own terms, as described under Use of AI Features.
• Newsletter subscriptions are kept until you unsubscribe.

You can ask us to delete your data sooner. See “What Rights You Have Over Your Data” below.

Where Your Data Is Processed

We are based in the United States, and several of the providers listed above process data in the United States and other countries. Where personal information is transferred out of the European Economic Area, the United Kingdom, or India, the safeguard we rely on depends on the destination and on the region the data came from:

• From the EEA: an adequacy decision where one covers the destination, the European Commission’s Standard Contractual Clauses, or the EU-US Data Privacy Framework where the recipient is certified under it.
• From the United Kingdom: the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it. EU Standard Contractual Clauses on their own do not cover a UK restricted transfer, which is why the Addendum or the IDTA is used.
• From India: contractual safeguards with the recipient, and transfers are made consistent with the restrictions applying under the Digital Personal Data Protection Act, 2023 and the rules made under it.

You may ask us at [email protected] for details of the safeguards applying to a particular transfer.

California Privacy Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• Right to know what personal information we collect, use, disclose, and if applicable sell or share, and to request a copy of it
• Right to delete personal information we have collected from you, subject to certain exceptions
• Right to correct inaccurate personal information we maintain about you
• Right to opt out of the sale or sharing of your personal information. Based on the categorization above, this means opting out of the advertising and conversion-measurement tools (Meta Pixel, Google Ads, DoubleClick, and Google Analytics) that involve cross-context behavioral advertising. We do not treat the other recipients listed above as sales or shares of personal information: each is engaged under a written agreement that limits their use of personal information to providing their service to us
• Right to limit the use and disclosure of sensitive personal information, where applicable
• Right to non-discrimination for exercising any of the above rights

To opt out of the sale or sharing of your personal information, click Do Not Sell or Share My Personal Information or Cookie Preferences in the site footer. We also honor Global Privacy Control (GPC) signals as a valid opt-out request. We action opt-out requests as soon as feasible, and no later than 15 business days from receipt.

To exercise your other rights, contact us at [email protected]. We will verify your request and respond within 45 days, as required by law, with a possible 45-day extension for complex requests, in which case we will notify you of the extension and the reason.

You may also designate an authorized agent to make a request on your behalf, subject to our ability to verify the agent’s authority to act for you.

Your Rights Under India’s Digital Personal Data Protection Act (DPDP)

If you are located in India, you have the following rights as a Data Principal under the Digital Personal Data Protection Act, 2023:

• Right to access a summary of the personal data we hold about you and how we process it
• Right to correction and erasure of your personal data
• Right to grievance redressal, as described below
• Right to nominate another individual to exercise your rights on your behalf in the event of your death or incapacity
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before your withdrawal

We do not knowingly collect personal data from individuals under the age of 18 without verifiable parental consent, consistent with the DPDP Act’s requirements for children’s data.

Grievance Officer: Mohit Sharma, [email protected]

If you have a grievance regarding how we handle your personal data, you may contact our Grievance Officer at the address above, or write to us at [email protected] and ask for your message to be passed to the Grievance Officer. Either route starts the same process.

As our own service commitment, we aim to acknowledge your grievance within 72 hours of receipt, including a reference number and expected resolution timeline, and to resolve most grievances within 30 days and in any event within 90 days. These are timelines we set for ourselves rather than statutory deadlines. The Digital Personal Data Protection Rules, 2025 come into force in phases, with several provisions taking effect later than the date of this policy, and we will update this section as those provisions apply to us.

How Secure Is My Information

We maintain technical and organizational measures appropriate to the risk, in order to protect your personal information from being inappropriately lost, misused, accessed, disclosed, altered, or destroyed. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Card information, when provided, is encrypted in transit using TLS (also known as SSL).

What Rights You Have Over Your Data

To exercise the privacy rights available to you, including access, correction, deletion, objection, restriction, or withdrawal of consent, contact us at [email protected]. Some requests are subject to legal exceptions, and some processing must continue for legal, security, accounting, contractual, or other permitted purposes.

You can also request information about the source of your personal data if it was not provided directly by you, or how long it will be retained. You have the right to request deletion of data no longer needed for its original purpose, or to cease its processing. Certain records, such as financial and transaction records, may be retained even after a deletion request, where retention is required by applicable tax, accounting, or audit obligations, consistent with the recognized legal exceptions to the right of deletion. You can request we stop using your data for direct marketing purposes, and you may withdraw consent at any time by clicking “unsubscribe” in our emails.

Legal basis for processing (EEA and UK visitors): Depending on the purpose, we process your data based on your consent (for example, non-essential cookies and marketing communications), the necessity of processing to perform our contract with you (for example, fulfilling a purchase or running a feature you enabled), our legitimate interests (for example, improving our services, spam prevention, and fraud prevention), or compliance with a legal obligation.

If you believe we have not complied with applicable data protection laws, you have the right to lodge a complaint with your local data protection authority. Within technical limits, we will provide your personal data to you or your data protection authority upon request.

If we cannot provide requested data within a reasonable timeframe, we will let you know when it will be available. If we deny a request, we will explain why.

Children’s Online Privacy Protection Act Compliance

We do not knowingly collect personal information from children under the age of 13. If we determine we have collected personal information from a child under 13, we will take reasonable measures to remove it from our systems. If you are under 13, please do not submit personal information through the Site, service, or Software.

Third-Party Links

We may include or offer third-party products or services on our website. These third-party sites have separate, independent privacy policies, and we hold no liability or responsibility for their content or activities.

Affiliate Disclosure

Some third-party links on our store may be affiliate links. We earn a referral fee when you buy services from companies we recommend. We only recommend products we believe add value to our customers. If you purchase after clicking an affiliate link, we receive a commission.

These affiliate commissions help us generate free content on our blog and free courses on SkillJet.

Affiliate tracking cookies are subject to the same consent preferences described in the Cookies section above.

Remarketing and Targeted Advertising

We work with third parties including Google Ads, Google Analytics, and Meta (Facebook) to provide targeted advertisements or marketing communications that may interest you, based on your browsing activity on our sites. This may include cross-context behavioral advertising as defined under California law. For more on how targeted advertising works, see the Network Advertising Initiative’s educational page.

You can opt out of targeted advertising through Facebook or Google directly, or by clicking Cookie Preferences in the site footer, which applies to the advertising partners listed in this policy.

Newsletter Emails

We send product announcements, software updates, and special offers by email. You will receive these only if you ask for them, by signing up to our newsletter or by ticking the marketing option on a form, and you can stop them at any time using the “unsubscribe” link in every email.

Becoming a site user, member, or customer does not by itself sign you up for marketing email, and neither does downloading or installing one of our plugins.

Marketing email is separate from the service email we need to send you about a purchase, a license, a security notice, or a support ticket. Unsubscribing from marketing does not stop those.

If you are in the EEA or the UK, we will only send you marketing email where you have given consent, and we will never make that consent a condition of buying or using our products.

Will This Privacy Policy Ever Change

We may update this Policy to keep pace with changes in our Site, Software, Services, business, and applicable laws. When we do, we will post the updated Policy here and change the date at the top. Where a change is significant, we will take reasonable steps to tell you about it. Where a change means we need your consent for something new, we will ask for that consent rather than treat your continued use of our products as agreement.

Contact Us

For questions about our privacy practices or to make a complaint, contact us by email at [email protected] or by mail:

Brainstorm Force US LLC, 2093 Philadelphia Pike #3090, Claymont, DE 19703, United States

If you are in India and want to raise a grievance under the DPDP Act, you can write to our Grievance Officer, Mohit Sharma, at [email protected], or use [email protected] and we will route it.