Your data and privacy: what Serpkin stores, and how to remove it

Serpkin needs enough data to find SEO work, hand it to your agent and check the result. It does not need your source code, and it does not sell data or run ads. This page explains what is stored, how long it is kept, who processes it, and how to export or delete it. The legal terms are in the privacy policy; this page is the practical version.

#What Serpkin stores

• Your account: name, email, a password hash and session records. Agent keys are stored as hashes, so the key is shown once and never again.
• Your workspace: sites, their public URLs, business description, audience, country and language.
• Missions and results: the missions Serpkin created, the changes your agent submitted, the verification checks and the measurements at 14 and 28 days.
• Site evidence: public pages Serpkin fetched, search results, competitor sitemap entries and the checks it ran. This is what a mission points at.
• Operational records: jobs, audit events, technical logs and product analytics, with secrets redacted.

You do not upload a database dump or a copy of your repository. Serpkin builds its picture from public URLs and, if you connect it, Search Console.

#Your source code stays yours

The CLI can upload a route map: a list of URL paths and the file names that render them, such as /pricing to app/pricing/page.tsx. That is how a mission can name the file to edit. The route map contains paths and file names, not file contents. Serpkin never receives your source code, your git history, your environment variables or your secrets.

Your coding agent works in your repository on your machine or in your CI. It reads the mission from Serpkin and makes the change locally. The code never passes through Serpkin's servers.

#Search Console data

If you connect Search Console, Serpkin asks for read-only access and stores the queries, pages, clicks, impressions, positions and URL inspection results it needs for missions and results. OAuth tokens are encrypted at rest with AES-256-GCM. Disconnecting revokes the token at Google and deletes the stored tokens and synced data for that site.

Google's API terms impose Limited Use obligations. Serpkin uses Search Console data only to provide the features you see: missions, results, charts and reports. It does not sell the data, use it for advertising, or let humans read it except for security, support at your request, or where the law requires it.

#Who processes your data

AI content reviews are routed only to providers that do not store requests for training. The search data provider receives the queries you ask about, not your site's private analytics. A current list of providers is available on request.

Some providers process data outside your country, including outside the EEA and the UK. Where they do, Serpkin relies on adequacy decisions or standard contractual clauses.

#How long data is kept

Retention is enforced by a scheduled purge, not by hand. Evidence past its expiry stops being served immediately, even before the purge removes the row. Deleting a workspace removes its sites and records; the security audit log and rolling backups are the two exceptions, and both are time limited.

#Export or delete your data

1. Export first

   Account settings has a JSON export of your workspace: sites, missions, results, history and settings. Download it before deleting anything. The export does not include credentials or other people's data.

2. Cancel a live subscription

   If a paid subscription is running or paused, cancel it in Plan and billing first. Deleting an account with a live subscription would leave a charge nobody can manage. The subscription has to be ended before deletion.

3. Confirm deletion

   Deleting the account asks for your password. Serpkin then deletes the workspace, its sites and all their data, and the user account. The audit record that the account was deleted is kept for up to 365 days.

#How it is protected

Traffic uses TLS. Google tokens are encrypted with AES-256-GCM using a key separate from the database. Passwords and agent keys are stored only as hashes. Backups are encrypted with a separate key. Production access is limited to the people who run Serpkin.

Rate limits mostly store a one-way digest of your IP address rather than the address itself. The sign-in system keeps the IP address with the request path to stop credential stuffing, and deletes it after one day. Technical logs redact secrets. If a breach affects you, Serpkin tells you as the law requires.

#Your rights

You can ask to access, correct, delete or export your personal data, and to restrict or object to how it is used. Where processing relies on consent, you can withdraw it at any time. Most of this is self-service in the app; anything else goes to the contact address on the About page, and Serpkin replies within one month.

Under the CCPA you can ask what personal information is collected, used or disclosed, and ask for deletion or correction. Serpkin does not sell personal information or share it for cross-context behavioural advertising, and it will not treat you differently for exercising these rights.

#Changes and questions

If the privacy policy changes in a meaningful way, account holders are emailed before the change takes effect. Questions about data, a processor or a deletion go to the contact address on the About page. For payment records, the invoice in the Creem portal is the fastest source.