Privacy Policy

Indexed Lab Marketing Management (“Lua Rank,” “we,” “us,” or “our”) operates the website at https://luarank.com and the related Service. We are the data controller responsible for the personal data described in this Policy. Our registered address is Rahaal 2, 27th Street, 910A, Um Suqueim 3, Dubai, United Arab Emirates, and you can reach us at hello@luarank.com.

This Privacy Policy explains how we collect, use, share, and protect personal data when you visit the Website or use the Service. It applies to individuals in the European Economic Area and the United Kingdom (under the GDPR / UK GDPR), in the United Arab Emirates (under Federal Decree-Law No. 45 of 2021 on Personal Data Protection, the “PDPL”), in the United States (including California under the CCPA/CPRA), and elsewhere. Where local law gives you stronger protections, those apply.

Information you provide

• Account data — your name, email address, password, and company details when you register.
• Billing data — your billing name, address, and transaction history. Card details are collected and processed directly by our payment processor; we do not store full card numbers on our servers.
• Customer Content — the brand information, keywords, prompts, and other content you submit to generate output.
• Communications — messages you send us for support or other enquiries.

Information collected automatically

• Usage and device data — IP address, browser and device type, pages viewed, and interactions with the Service, collected through cookies and similar technologies.

Information from connected services

If you choose to connect a third-party account (for example, a search console, analytics tool, e-commerce platform, or cloud storage), we receive data from that service as needed to provide the features you enable, in line with the permissions you grant.

We use personal data to:

• provide, operate, and secure the Service and your account (legal basis: performance of a contract);
• process payments and manage subscriptions (legal basis: performance of a contract);
• provide customer support and respond to your requests (legal basis: legitimate interests and contract);
• improve, troubleshoot, and develop the Service, and produce aggregated analytics (legal basis: legitimate interests);
• send you service-related and, where permitted, marketing communications (legal basis: legitimate interests or consent, which you may withdraw at any time);
• comply with legal obligations and enforce our terms (legal basis: legal obligation and legitimate interests).

Where we rely on consent (for example, certain cookies or marketing), you may withdraw it at any time without affecting prior processing.

We use strictly necessary cookies to operate the Service, and, where permitted, analytics and preference cookies to understand usage and improve the experience. You can control non-essential cookies through your browser settings or any cookie controls we provide. Disabling some cookies may affect how the Website functions.

We do not sell your personal data. We share it only with the following categories of recipients, under appropriate confidentiality and data protection terms:

• Hosting and infrastructure providers that store and run the Service;
• Payment processors that handle billing and fraud prevention;
• Communication and email providers used to send transactional and marketing messages;
• Analytics and product-monitoring providers that help us understand and improve usage;
• AI and large-language-model providers that process content to generate output;
• Professional advisers and authorities where required by law, to enforce our terms, or to protect rights and safety;
• Acquirers in connection with a merger, acquisition, or sale of assets.

These providers act as our processors and may only use your data to perform services on our behalf.

We operate internationally, so your personal data may be transferred to and processed in countries other than your own, including the UAE, the United States, and the EU. Where we transfer personal data out of the EEA, the UK, or the UAE to a country without an adequate level of protection, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism.

We keep personal data only for as long as necessary to provide the Service, comply with our legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we delete or anonymise it. Account and Customer Content are generally deleted within a reasonable period after your account is closed, subject to legal retention requirements.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including encryption in transit, access controls, and restricting access to those who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach is likely to result in a risk to your rights, we will notify affected users and regulators as required by applicable law.

Depending on where you live, you may have some or all of the following rights. To exercise them, email hello@luarank.com. We will respond within the timeframe required by applicable law and will not discriminate against you for exercising your rights.

EEA / UK (GDPR) and UAE (PDPL)

• access a copy of your personal data;
• correct inaccurate or incomplete data;
• delete your data (“right to be forgotten”);
• restrict or object to certain processing;
• data portability;
• withdraw consent at any time;
• lodge a complaint with your supervisory authority (in the UAE, the UAE Data Office).

California (CCPA/CPRA)

• know what personal information we collect, use, and disclose;
• access and delete your personal information;
• correct inaccurate personal information;
• opt out of the “sale” or “sharing” of personal information — note that we do not sell or share personal information as those terms are defined under the CPRA;
• limit the use of sensitive personal information;
• be free from discrimination for exercising your rights.

You may use an authorised agent to submit a request on your behalf where the law allows.

The Service is intended for business users and is not directed to children. We do not knowingly collect personal data from anyone under 18 (or under 16 in the EEA/UK). If you believe a child has provided us with personal data, contact hello@luarank.com and we will delete it.

The Service may link to or integrate with third-party websites and services that we do not control. This Policy does not apply to those third parties, and we encourage you to review their privacy policies.

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated Policy here with a new “Last updated” date and, where appropriate, notify you by email or through the Service.

If you have questions, concerns, or requests about this Policy or your personal data, contact us at hello@luarank.com, or by post at Indexed Lab Marketing Management, Rahaal 2, 27th Street, 910A, Um Suqueim 3, Dubai, United Arab Emirates.