Privacy policy

, , is the data controller for Serpified. This policy says what personal data we hold, why, and what your rights are. Contact: [email protected].

What we collect

• Account data: email address, name, company name, password (stored as a salted hash, never readable by us), plan and billing status.
• Usage data: pages opened, actions taken, data fetched, credits spent, the IP address and browser of each sign-in. This is the activity log that keeps your account safe and lets us support you.
• Content you add: projects, keywords, domains, uploads, notes, outreach contacts and messages, connected-account data.
• Payment data: handled by Stripe. We store Stripe’s customer and subscription identifiers and your billing email, never card numbers.
• Connected accounts: when you link Google (Search Console, Analytics, Business Profile), Meta or LinkedIn we store an encrypted access token and the data those services return for the feature you enabled.

Why we use it

• To provide the service you signed up for (contract).
• To keep accounts secure, prevent abuse and meet legal duties (legitimate interest and legal obligation).
• To send transactional email: confirmations, password resets, invitations, alerts and reports you scheduled.
• To send a short onboarding sequence and occasional product tips, which you can stop with one click in any such email or from your Account page (legitimate interest; consent where the law requires it).

Who sees it

Processors acting on our instructions: our hosting provider, our database and backup storage, our email delivery provider, Stripe for payments, and our data providers (for example DataForSEO) who receive the keywords and domains you look up but not your identity. Connected platforms (Google, Meta, LinkedIn) receive the requests you authorise. We do not sell personal data and we do not share it with advertisers.

Email we send and your choices

Transactional emails are part of the service. Onboarding and tips emails carry an unsubscribe link, and the Account page has a switch for them.

Retention

Account data is kept while the account exists and deleted within 90 days of closure. Activity logs are kept for 12 months. Backups are kept for 14 days. Invoices are kept as long as tax law requires.

Your rights

Depending on where you live you can ask for access, correction, deletion, portability or restriction of your data, and object to processing based on legitimate interest. Email us and we respond within 30 days. You can also complain to your data-protection authority.

International transfers

Our providers may process data outside your country. Where that happens we rely on the provider’s standard contractual clauses or an adequacy decision.

Security

Passwords are hashed with scrypt, sessions are random tokens stored hashed, connected-account tokens are encrypted at rest, traffic is encrypted in transit, backups are taken daily, and every admin action on your account is logged.

Children

The service is for businesses and is not directed at anyone under 16.

Changes

We will post changes here and, for material ones, email account owners before they take effect.