Rankaro Privacy Policy

Rankaro is a software-as-a-service application developed, owned, and operated by Arventa Ventures ("Company", "we", "our", or "us"). We provide reputation enablement software, dynamic vector QR generation, and assisted feedback formulation tools for independent businesses ("Merchants") and their visiting consumers ("End Users" or "Patrons"). This Privacy Policy describes our practices regarding the collection, storage, processing, transfer, and protection of personal data when you interact with our website (rankaro.com / arventaventures.online), our merchant administration consoles, our public review landing pages, and associated APIs. By accessing or using our Services, you acknowledge that you have read and understood this Policy.

For the purposes of the EU General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and relevant international data privacy laws, the primary Data Controller is Arventa Ventures. For inquiries, data access requests, or to reach our designated Data Protection Officer (DPO), please contact: • Entity: Arventa Ventures • Support Desk: support@arventaventures.online • Data Protection Officer: dpo@arventaventures.online • Registered Website: https://arventaventures.online

We collect minimal, purpose-specific information categorized as follows: A. Merchant Account Information: When a business registers on Rankaro, we collect the account owner's legal name, corporate business name, verified email address, hashed authentication credentials, physical storefront address, Google Business Profile place identifiers, and selected industry vertical. B. Patron / End User Interaction Data: When an end customer scans a Rankaro countertop QR code or visits a public review page (/r/[slug]), we temporarily process transient operational data: IP address (strictly for rate-limiting and DDoS mitigation), browser user-agent string, selected service tags (e.g. "Pain-Free Cleaning"), chosen sentiment tone, and timestamp. We DO NOT require patrons to create an account, log in with social profiles, or submit their phone number to generate a review draft. C. Private Resolution Form Data (Optional): If an end user elects to utilize the direct private management feedback channel, they may voluntarily submit their name, telephone number, email, and a written description of their grievance. This data is delivered directly to the designated business owner and is never shared, rented, or sold.

We process personal data solely under recognized lawful bases: • Contractual Necessity (Art. 6(1)(b)): To provision merchant dashboards, process payments, and generate scannable review codes. • Legitimate Interests (Art. 6(1)(f)): To maintain network security, detect brute-force attacks, prevent fraud, and optimize scan latency across edge networks. • Legal Compliance (Art. 6(1)(c)): To maintain financial accounting records, verify tax compliance, and honor legal requests from regulatory authorities. • Explicit Consent (Art. 6(1)(a)): Where a user voluntarily submits feedback via our contact forms or private resolution mechanisms.

We maintain an unconditional commitment to customer privacy: 1. WE NEVER SELL, RENT, OR MONETIZE PERSONAL DATA. 2. We never build cross-site behavioral advertising profiles on visiting patrons. 3. We do not participate in third-party data broker networks. 4. Patron interactions with our QR codes are strictly transaction-isolated: their scan history is never linked to third-party ad networks or data aggregators.

Rankaro adheres to a strict cookie-minimization architecture: • Strictly Necessary Cookies: Used solely for merchant session authentication, CSRF security tokens, and load balancer routing. • Local Storage: Used to cache non-sensitive interface preferences (e.g., active dashboard tab or dark/light display settings). • We do not deploy intrusive third-party cross-site advertising cookies or fingerprinting trackers.

To ensure global high availability, sub-second latency, and bank-grade security, we partner with industry-leading cloud infrastructure providers who undergo strict vendor security assessments: • Cloudflare Inc. (Edge CDN, DDoS Shield, DNS) • Amazon Web Services (AWS) / DigitalOcean (Encrypted cloud application hosting) • MongoDB Atlas (Encrypted multi-tenant database clusters) • Resend / Nodemailer SMTP (Transactional account emails and OTP delivery) All sub-processors are bound by executed Data Processing Addenda (DPAs) with standard contractual clauses.

Personal data may be transferred to and maintained on computer servers located outside of your state, province, or country. When transferring data from the European Economic Area (EEA) or the United Kingdom to countries not deemed to provide an adequate level of data protection, Arventa Ventures relies on standard contractual clauses (SCCs) approved by the European Commission, supplemented by technical safeguards including AES-256 encryption.

• Merchant Account Data: Retained for the duration of the active subscription plus 90 days following account termination to accommodate reactivation requests. • Patron Scan Logs: Aggregated into anonymous statistical counters (e.g., total scan counts per month) and stripped of raw IP addresses within 30 days. • Private Resolution Inquiries: Retained for up to 180 days to allow merchants to audit customer service remediation, after which records may be permanently purged upon request.

Depending on your jurisdiction, you possess statutory rights regarding your personal data: • Right of Access & Portability: You may request a machine-readable export of all data associated with your profile. • Right to Rectification: You may correct inaccurate or incomplete account records directly within your dashboard or via support. • Right to Erasure ("Right to be Forgotten"): You may request the permanent deletion of your account and associated data. • Right to Restrict or Object: You may object to the processing of your data based on legitimate interests. • Non-Discrimination: We will never discriminate against you, alter pricing, or degrade service quality for exercising your privacy rights. To exercise any of these rights, email privacy@arventaventures.online with the subject line "Data Subject Request".

We implement state-of-the-art administrative, technical, and physical safeguards: • AES-256 encryption for data at rest. • TLS 1.3 encryption for all data in transit across public networks. • Automated brute-force lockout mechanisms and rate-limiting. • Strict role-based access control (RBAC) limiting production access strictly to vetted engineering personnel.

Our services are designed strictly for commercial enterprises and adult consumers capable of forming legally binding agreements. We do not knowingly solicit or collect personal data from individuals under the age of 16. If we become aware that a child under 16 has provided us with personal data, we will immediately take steps to delete such information.

Rankaro operates in strict adherence to Google’s Content Policies for Maps and Local Business Profiles. Specifically: • We do not incentivize reviews (no payments, discounts, or gifts in exchange for reviews). • We do not engage in review gating (filtering negative reviewers away from Google). • All review drafts formulated by our natural language engine require deliberate, manual confirmation and posting by the customer through their own Google account.

We reserve the right to amend this Privacy Policy at any time to reflect legislative developments, industry best practices, or operational modifications. When updates are published, the revised date at the top of this document will be updated. In the event of material changes affecting your rights, active merchants will receive prior notification via electronic mail.