Pre-Launch Legal Checklist and Recommendations
A. Pre-Launch Actions (Complete Before Going Live)
| Action | Priority / Jurisdiction | |
| Publish all 9 policies at https://neurorank.ai/legal | ALL – REQUIRED | |
| Set up a monitored contact form at https://neurorank.ai/contact | ALL – REQUIRED | |
| Set up legal@neurorank.ai as a monitored inbox for formal legal and data protection notices | ALL – REQUIRED | |
| Record ToS acceptance at signup (checkbox + timestamp logged in database) | Contract law – REQUIRED | |
| Implement cookie consent banner with granular category opt-in for EU/UK visitors | GDPR / ePrivacy – REQUIRED for EU/UK users | |
| Configure Google Analytics with IP anonymisation enabled and restrict data sharing | GDPR – REQUIRED | |
| Execute DPAs with all AI providers (Anthropic, Google, OpenAI, Perplexity as applicable) | GDPR Art. 28 – REQUIRED | |
| Execute DPAs with all other key sub-processors (cloud hosting, payment processor, email provider) | GDPR Art. 28 – REQUIRED | |
| Add ‘Do Not Sell or Share My Personal Information’ link in site footer | CCPA / CPRA – REQUIRED for California users | |
| Create privacy-request page at https://neurorank.ai/contact with category selector (California Privacy Request, GDPR Request, General Privacy) | CCPA / GDPR – REQUIRED | |
| Implement and test a data breach detection and response procedure with 72-hour internal escalation | GDPR Art. 33 / India IT Act – REQUIRED | |
| Ensure Stripe/Razorpay PCI DSS compliance is verified before accepting payments | Payment security – REQUIRED | |
| Register NeuroRank trademark in additional key markets (India done; consider EU, US, UK, UAE) | IP protection – RECOMMENDED | |
| Implement 2FA option for all user accounts | Security best practice – RECOMMENDED |
B. Growth-Stage Actions (When You Scale)
| Action | Trigger | |
| Appoint EU Article 27 representative (low-cost virtual service available) | When you actively market to EU users or reach ~10,000 EU users | |
| Register with UK ICO as a data controller | When you actively target UK users | |
| Register under India DPDPA when operative provisions are notified | When DPDPA provisions come into force | |
| Conduct DPIA for AI scoring features | Before significant scale of EU user processing | |
| Add standalone DPA template for enterprise clients who need to counter-sign | When first enterprise client requests one | |
| Add PDPA Notice for Thailand and POPIA Notice for South Africa | When actively marketing in those markets | |
| Activate API Terms of Service (Policy 8) and replace placeholder with full terms | When API is launched | |
| Add Accessibility Statement (WCAG 2.1 AA) | For enterprise sales and EU compliance | |
| Add Modern Slavery Statement | When company turnover exceeds relevant thresholds |
C. What We Have and What SEMrush Has – Coverage Comparison
| Policy / Document | Status | Notes |
| Privacy Policy | Included (Policy 1) | Covers GDPR, CCPA, India IT Act, DPDPA. Added: government authority requests, processor vs controller distinction, benchmarking, communications review. |
| Terms of Service | Included (Policy 2) | India governing law, New Delhi jurisdiction, strengthened IP, disclaimers, single login enforcement, sensitive data disclaimer. |
| AI Use Policy | Included (Policy 3) | Covers all points in SEMrush AI terms plus: no ranking guarantee, no visibility guarantee, user responsibility for professional judgment, no training on inputs. |
| Cookie Policy | Included (Policy 4) | Full cookie inventory, A/B testing cookies added, GPC signals, web beacons and conversion tags. |
| Acceptable Use Policy | Included (Policy 5) | Includes content standards section. Effectively replaces SEMrush’s separate Content Policy for NeuroRank’s use case. |
| Refund and Cancellation Policy | Included (Policy 6) | Standalone policy. Monthly (no refunds), Annual (pro-rata at full monthly rate), Consulting (non-refundable), Credits (non-refundable). Chargeback clause added. |
| CCPA / CPRA Notice | Included (Policy 7) | Full California compliance including annual metrics commitment. |
| API Terms of Service | Included (Policy 8) | Placeholder ready to activate on API launch. |
| Data Processing Addendum (DPA) | Included (Policy 9) | Covers all GDPR Art. 28 requirements. Standalone signed version available on request. |
| Content Policy | Covered within AUP (Policy 5) | NeuroRank users do not post public content so a separate Content Policy is not needed. Content rules are fully covered in the AUP. |
| Website Terms of Use | Covered within ToS (Policy 2) | SEMrush separates these because it has a large public-facing website. NeuroRank’s platform and website are one; the ToS covers both. |
| App Center Terms | Not applicable | NeuroRank has no third-party app marketplace. |