Ranked Technologies Ltd · RC 9522220

Privacy policy

What we collect, why we have it, where it physically sits, how long we keep it, and how to make us delete it. Written to be read rather than to be survived.

Last reviewed 23 August 2026

The short version. One cookie, which keeps you signed in. No analytics, no advertising, no tracking pixels, and no third party receives your data. The free calculators run entirely in your browser and send us nothing. Your company profile is private until you choose to list it. You can have the whole account deleted by asking.

Who is responsible

Ranked Technologies Ltd (RC 9522220), a company registered in Nigeria, operates GTM at gtm.ng and is the data controller for the personal data described here. We are registered with the Nigeria Data Protection Commission.

For anything in this policy, including a request to see or delete your data, write to support@ranked.ng and say what you need.

What we collect and why

Everything below is data you give us directly. We do not buy personal data, we do not scrape it, and we do not enrich your profile from outside sources.

Your account

Name, email address, whether you are a founder or an investor, and your password stored only as a bcrypt hash. We never hold the password itself and cannot read it.

Your session

A random token, stored only as a SHA-256 hash, so a stolen database row cannot be replayed as a login.

Email verification codes

The address being verified and a hash of the six-digit code, kept only until the code expires or is used.

Your company profile, if you are a founder

What you type into the profile, including commercially sensitive figures: revenue, monthly recurring revenue, growth rate, cost to acquire a customer, lifetime value, burn, runway, customer count, your largest customer's share of revenue, previous funding, what you are raising, valuation and market size, plus links to any deck or data room you supply.

Verification records

Which checks were performed on your company, by what method, on what date, and the result.

Your thesis, if you are an investor

Firm name, cheque range and currency, and the stages, industries, countries, business models, minimum growth and pre-revenue preference you say you invest against.

Which companies an investor viewed

When an investor opens a listed company, we record that. This is personal data about the INVESTOR, and it is why founders are shown counts rather than identities.

The lawful basis for each of those

Under the Nigeria Data Protection Act 2023 we have to say why we are allowed to hold each thing, not just that we hold it.

Your account and session exist to perform the contract you entered when you signed up. Without them there is no service.
Your company profile and your thesis are also contract: they are the service. You decide what to put in them and whether to list.
Verification records are contract where you asked for the check, and legitimate interests in keeping an accurate record of what was checked and when.
Email verification codes are a security measure, held on legitimate interests, and deleted when they expire.
Which companies an investor viewed is legitimate interests: founders need to know whether a listing is attracting attention. It is deliberately reported as counts, never as identities, because who an investor is researching is their business.

Where your data physically is

Not in Nigeria. GTM runs on a machine in Türkiye, and requests reach it through the United States and Cloudflare's global network. The database sits on that same machine.

That makes storing your data a cross-border transfer under the NDPA, and we would rather state it plainly than let the company's Nigerian registration imply something untrue. If you are not comfortable with your data being held outside Nigeria, do not create an account, and tell us if you already have one so we can delete it.

The machine is under our sole control, full-disk encrypted, and not shared with anyone. Traffic to it is encrypted in transit.

Cookies

One cookie. That is the whole list.

Name	Purpose	Lasts
gtm_session	Keeps you signed in.	30 days

It is strictly necessary, so there is no consent banner to click. It is HttpOnly, so page scripts cannot read it, SameSite=Lax, and marked Secure in production. There are no analytics cookies, no advertising cookies and no third-party cookies, because there is no analytics, advertising or third party.

The free tools send us nothing

The calculators for CAC and LTV, runway, market sizing and dilution run entirely in your browser. There is no form submission and no network request behind them. What you type about your revenue, your burn and your cap table never reaches us, is never stored, and is gone when you close the tab.

That is deliberate. Those are figures founders are rightly cautious about, and the tools are more useful if using them costs nothing and reveals nothing. You can confirm it by reading the page source.

Who we share it with

Nobody. No analytics provider, no advertising network, no email marketing platform, no data broker. We do not sell personal data and we do not share it for anyone else's marketing.

The only exception would be a legal obligation: a valid court order or a lawful demand from a regulator. If that happens and we are permitted to tell you, we will.

What other users see

Your company profile is private until you list it. Once listed, verified investors can see it. Investors see the profile; founders see interest as counts, and an investor is named to you only if they request an introduction. Nothing about you is public to the open web unless you put it in a field intended to be public.

How long we keep it

Account, company profile and thesis: while your account exists, and deleted when you ask us to delete it.
Sessions: 30 days, then they expire.
Email verification codes: minutes. They expire on a timer and are single use.
Verification records: retained while the company profile exists, because a check without its date and method is worthless to the investor relying on it.

Your rights

Under the Nigeria Data Protection Act 2023 you have the following rights. To use any of them, write to support@ranked.ng. We will respond within one month, and we will not charge you for it.

Access: Ask for a copy of the personal data we hold about you.
Rectification: Have anything inaccurate corrected.
Erasure: Ask us to delete your account and the data attached to it.
Restriction: Ask us to stop processing while a dispute is resolved.
Objection: Object to processing we carry out on the basis of legitimate interests.
Portability: Receive the data you gave us in a structured, machine-readable form.
Withdraw consent: Where we rely on consent, withdraw it at any time.
Complain: Complain to the Nigeria Data Protection Commission if you think we have handled your data wrongly.

Security, and what we would do if it failed

Passwords are hashed with bcrypt and never stored or logged in readable form. Session tokens are stored only as hashes. The database is not exposed to the public internet and the machine holding it is full-disk encrypted.

No system is beyond compromise. If personal data here were breached in a way likely to harm you, we would notify the Nigeria Data Protection Commission within 72 hours and tell the affected people directly, rather than waiting to be asked.

Children

GTM is for people running or funding businesses and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has an account, tell us and we will delete it.

Changes

If this policy changes materially we will update the date at the top and, where the change affects how we use data you have already given us, tell account holders by email rather than relying on you to re-read the page.

This policy is general information about our own practices. It is not legal advice.