Legal and compliance
Cookie Policy
The RankX AI marketing site loads Google Tag Manager, which can run Google Analytics, the Meta pixel and the LinkedIn Insight Tag, and an affiliate referral cookie, each only with your consent; the application sets one sign-in cookie and one product analytics cookie.
On this page
11 sections. Each one is linkable, so a clause can be cited on its own.
- 01What this policy covers
- 02What cookies and similar technologies are
- 03The short version
- 04Cookies on rankxai.com
- 05Cookies in the application at app.rankxai.com
- 06What RankX AI does not use
- 07How to control cookies in your browser
- 08Consent, and how to change your mind
- 09Third-party pages you may be sent to
- 10Do Not Track and Global Privacy Control
- 11Changes to this policy, and how to ask us about it
What this policy covers
This Cookie Policy explains how ALIM LTD, trading as RankX AI, uses cookies and similar technologies on the marketing site at rankxai.com and in the application at app.rankxai.com. It sits alongside the Privacy Policy, which covers everything else we do with personal data.
It is deliberately specific. A cookie policy that describes cookies in general, rather than the ones the site actually sets, tells a reader nothing they can act on, so every entry below names a real cookie you can find in your browser’s developer tools.
The short version
- Advertising tags only on the marketing site, and only with your consent. The application sets no advertising cookies. On the marketing site, the Meta pixel and the LinkedIn Insight Tag run only if you allow the Marketing category, as the next point explains.
- Google Tag Manager on the marketing site, only if you allow it. The public site loads a Google Tag Manager container, which is a loader: it runs measurement tags that set their own cookies, typically Google Analytics. The container itself loads for every visitor, but it starts with every consent category set to denied, so until you agree it sets no cookie, runs no advertising tag, and reports no identifier that could single you out. Google does receive the fact that a browser at your address opened a page. Section 8 explains the choices and how to change them. Three tags are enabled in the container today. Google Analytics 4 runs when you allow the Analytics category. The Meta (Facebook) pixel and the LinkedIn Insight Tag run only when you allow the Marketing category, and are what tell Meta and LinkedIn that one of their adverts for us led to your visit. Section 4 lists the cookies each of them sets.
- An affiliate referral cookie on the marketing site, only if you allow the Marketing category. If you arrive through a partner’s link, a ReferralStack script can record the partner’s code so that a trial you start is credited to them. It is not loaded until you allow Marketing on the banner, and withdrawing that choice later removes what it stored. Section 4 says exactly what it stores and what it sends.
- Security cookies on both, set by Cloudflare. These are strictly necessary and are how a free tool survives being pointed at by a botnet.
- In the application: one sign-in cookie and one analytics cookie. The sign-in cookie is strictly necessary. The analytics cookie is not, and section 8 is honest about the consent control we have not built for it yet.
What RankX AI does not use
Stating the absences is more useful than describing categories we do not have. We do not use:
- Google Ads or X advertising pixels. The advertising tags we do use are the Meta pixel and the LinkedIn Insight Tag, both listed in section 4 and both off until you allow the Marketing category. The affiliate referral cookie in the same section is the one cookie here used to attribute a sign-up to a partner, and it is off until you allow it too;
- social media sharing widgets that set cookies, and there are no embedded social feeds on either property;
- cross-site tracking, device fingerprinting for advertising, or data brokers;
- session recording, heat mapping or mouse tracking;
- data brokers, and any sale or sharing of what these cookies record.
Consent, and how to change your mind
Under the Privacy and Electronic Communications Regulations, storing information on your device requires your consent unless it is strictly necessary to deliver a service you asked for. Consent must be a positive action, must not be inferred from inactivity or a pre-ticked box, and must be as easy to withdraw as it was to give.
On the marketing site we ask before anything non-essential loads. A banner appears on your first visit with three choices: accept everything, reject everything, or open the preferences and decide category by category. Accept and reject sit side by side, at the same size, and both are one click away on the first screen. Nothing is pre-ticked, and closing the page without choosing is not treated as agreement.
Refusing genuinely stops the tracking. If you reject, or simply never answer, no analytics or advertising cookie is written, the Meta pixel and the LinkedIn Insight Tag do not run at all, and nothing that could identify you is sent. The ReferralStack script is not loaded until you permit the Marketing category specifically, so refusing means no request to ReferralStack is made at all.
What refusing does not stop, stated plainly. The Google Tag Manager file itself is fetched for every visitor, before you answer, because that is what lets your answer be applied the moment you give it. Fetching it stores nothing on your device, but it does tell Google that a browser at your IP address opened a page on this site. If you would rather that did not happen, a tracker blocker or a browser that blocks third-party scripts will prevent it, and the site works normally without it. Strictly necessary security cookies still apply either way, because those are exempt and the site cannot run without them.
To change your answer at any time, use the Cookie settings link at the foot of every page. It reopens the same panel showing what you chose last time, and withdrawing is exactly as easy as granting was. Your choice is stored in your browser rather than in a cookie, so clearing site data resets it and you will be asked again.
Withdrawing the Marketing category reloads the page. The ReferralStack script has no off switch of its own. Once it is running, clearing what it stored is not enough, because it would write the cookie again on your next click. So withdrawing Marketing deletes the referral cookie and its local storage copy and then reloads the page, and the reload is what stops the script. After it, nothing referral-related is left on your device.
A gap we are stating openly
The product analytics cookie in the application is not strictly necessary, so under PECR it requires consent, and there is currently no consent control for it inside the application. It is set when you sign in. We are building an in-product control that will let you turn product analytics off and keep the choice, and this policy will be updated when it ships.
Until then, blocking eu.i.posthog.com as described in section 7 stops it completely, or you can email [email protected] and we will exclude your account from product analytics manually. We would rather publish this than describe a consent tool we do not have, which is what the previous version of this page did.
Third-party pages you may be sent to
Two flows hand you over to another company’s page. Their cookies are set on their domain, under their policy, and we cannot read them.
- Stripe Checkout and the billing portal. When you pay or manage a subscription, you are on a Stripe page. Stripe sets its own cookies for fraud prevention and session management. See the Stripe privacy policy (opens in a new tab).
- Google’s consent screen. When you connect Search Console or Analytics, the permission screen is Google’s own page and Google sets its own cookies there. See the Google privacy policy (opens in a new tab).
Links from our blog or documentation to other websites are ordinary links. Following one takes you outside our control, and the site you land on has its own cookie practices.
Do Not Track and Global Privacy Control
Do Not Track never became a standard, browsers have largely removed it, and there is no agreed meaning for a site to honour. We do not respond to it, and no site that tells you it does can explain what it is responding to.
Global Privacy Control is a different matter: it is a legally recognised opt-out signal in several jurisdictions, and it means “do not sell or share my personal information”. We do not sell or share personal information for advertising in any case, as set out in section 17 of the Privacy Policy, so there is nothing for the signal to switch off. It changes nothing about what we do because there was nothing to change.
Changes to this policy, and how to ask us about it
We update this policy whenever a cookie is added, removed or changes purpose, and when the consent control described in section 8 ships. The date at the top of this page is the date of the current version.
If you find a cookie on either property that is not listed here, we want to know, because it means either a provider changed something or this page has fallen out of date. Email [email protected] and we will check it and correct the page.
The rest of the set
Every RankX AI policy, in one place.
These documents are written to be read together. The Terms of Service is the agreement; the others are the detail it points at.
Start here
See where you show up in AI answers today.
Add your site and RankX AI suggests prompts, tracks your keywords and audits your pages, with first results minutes after setup.
7-day free trial. No credit card required. Cancel anytime.