Privacy Policy

serp.ac (legal entity name not set) (“serp.ac”, “we”) is the controller of personal data processed through https://serp.ac. Contact us at [email protected].

• Account data: name, email address, hashed password, account settings and notification preferences.
• Billing data: your plan, subscription status and billing dates, add-ons, usage packs and quota usage, invoices, payments and refunds, coupons and referral credit, and the Stripe customer and subscription IDs that link your account to Stripe. Payments are handled by Stripe; we never receive or store your full card number. From Stripe we receive only limited card details (such as brand, last four digits, expiry and a card fingerprint, which we use to allow one free trial per card).
• Referral data: if you sign up through a referral link, which account referred you; if you refer others, a masked version of their email and the commission earned on their payments.
• Customer Data: domains, competitors, keywords, AI prompts, purchased link records (URLs, prices, sellers, dates) and the results we collect for them.
• Telegram: if you connect Telegram, your chat ID, username and first name.
• Technical data: IP address (used for security and rate limiting), browser information, and server logs.
• Support: messages you send us through the contact form or email.

• To provide the service: run checks, store results, send notifications you enabled. (Contract)
• To run your subscription: start and convert free trials, charge renewals, add-ons and usage packs, retry failed payments, issue refunds and invoices, and apply coupons and referral credit. (Contract, legal obligation)
• To prevent fraud and abuse, such as repeated free trials on the same card or self-referrals. (Legitimate interest)
• To keep the service secure, including login rate limiting. (Legitimate interest)
• To send service emails such as password resets, billing notices and important changes. (Contract)
• To answer your support requests. (Contract, legitimate interest)

We don't sell personal data. We share it only with providers that help us run the service, under contracts that protect it:

• Stripe — our payment processor: subscriptions and recurring billing, card, Apple Pay and Google Pay payments, invoices and receipts, refunds, fraud prevention and tax calculation. Stripe processes your payment details as an independent controller under its own privacy policy for some purposes (such as fraud prevention and compliance).
• Hosting and database providers — storing and running the service.
• Email delivery provider — sending service emails.
• Telegram — delivering bot notifications if you connect it.
• Search and AI data providers (such as DataForSEO, OpenAI, Google, Perplexity and Anthropic) — your keywords and prompts are sent to them to collect rankings and AI answers. We don't send your name or email.
• Favicon service (DuckDuckGo) — the dashboard loads site icons for the domains you track, which shares those domain names with that service.

We may disclose data if required by law or to protect our rights and users.

Our providers may process data outside your country. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

• Account and Customer Data: while your account is open. Deleting your account removes it from our active systems immediately and from backups within 30 days.
• Billing records (invoices, payments, refunds): as long as tax and accounting laws require (typically up to 10 years), even after account deletion. Stripe keeps its own records under its retention policy.
• Card fingerprints used to limit free trials: while your account is open.
• Security logs: up to 90 days.

Depending on where you live (for example under the GDPR or UK GDPR), you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent. You can update your profile and delete your account in Settings, or email [email protected]. You can also complain to your local data protection authority.

Passwords are hashed, connections are encrypted, sessions are signed and invalidated when you change your password, and access to production data is restricted. No system is perfectly secure; please use a strong, unique password.

We use only essential cookies and local storage. See our Cookie Policy.

The service isn't intended for anyone under 18, and we don't knowingly collect their data.

We'll post updates on this page and, for material changes, notify you by email or in the dashboard.