Who we are
Serpkin is operated by [COMPANY LEGAL NAME], [ADDRESS] (“Serpkin”, “we”, “us”). We are the controller of the personal data described in this policy. For anything about privacy, email [CONTACT EMAIL].
This policy covers serpkin.com, the Serpkin app, the Serpkin command line tool and agent connection (MCP), the free SEO checker, and the emails we send.
What we collect
Account
Your email address, your name if you give one, and your password, which we store only as a salted hash. When you sign in we keep a session record that includes your IP address and browser user agent, used for security.
Workspace and sites
The sites you add (domain and settings), the missions, results, alerts and history Serpkin produces for them, and your email preferences.
Route map
When you run the Serpkin command line tool, it can upload a route map: a list of URL paths and the file names that serve them (for example /pricing → app/pricing/page.tsx). The route map does not contain your source code. Serpkin never receives the contents of your files.
Public page data
Serpkin fetches the public pages of the sites you add, plus their robots.txt and sitemaps, the same way a search engine would. It stores what it needs to find and check SEO issues, such as titles, headings, links, status codes and structured data.
Google Search Console data
If you connect Search Console, we ask for read-only access (webmasters.readonly). We read the list of properties you can access and the search performance data (queries, pages, clicks, impressions and positions) for the site you connect. The access tokens are encrypted at rest. See How we use Google data.
Agent API keys
When you connect a coding agent, Serpkin issues an API key. We store only a hash of the key and a short prefix so you can recognise it. We cannot show you a key again after it is created. When you sign in with the command line tool, it sends your computer’s hostname, which we use to name the key so you can tell your keys apart.
Billing
Payments are handled by Creem, our merchant of record. Creem collects your payment details. Serpkin never receives or stores your card number. We keep your plan, subscription status, billing period and the customer and subscription identifiers Creem gives us.
Logs and security records
Our servers write technical logs (time, request path, error codes) with secrets redacted. We keep an audit log of important actions in your workspace, such as connecting Google, changing plans or deleting an account. For most rate limits we store a one-way digest of your IP address, not the address itself. The sign-in system also keeps your IP address with the request path to rate limit sign-in attempts, and deletes it after 1 day.
Product analytics
To understand how Serpkin is used, we record product events, such as signing up, adding a site or finishing a scan. Each event stores your user id, your workspace id, the event name and a few limited details, such as a site’s host name, your plan or a count. We never store email addresses or full URLs in these events.
If page analytics are enabled on our public pages (not in the app), we use a privacy-friendly analytics script that counts page views and sign-up clicks without cookies and without identifying you.
Free SEO checker
The free checker fetches the URL you submit, its robots.txt and its sitemap, and shows you the result. We do not store the URL or the result in our database. A copy of the result is used from server memory for up to 10 minutes, so a repeat check of the same URL does not fetch the site again, and is then discarded. We count checks for rate limiting using a digest of your IP address, and record anonymous totals such as how many checks passed or failed.
How we use it and our legal bases
| Purpose | Legal basis (GDPR and UK GDPR) |
|---|---|
| Running your account, sites, missions and results | Performance of our contract with you |
| Reading the Search Console data you connect | Contract, and the permission you give on Google’s consent screen. You can withdraw it at any time by disconnecting. |
| Billing and tax records | Contract and legal obligation |
| Account and security emails (verification, password reset) | Contract |
| Product emails (weekly summary, site alerts) | Legitimate interest in telling you about your own sites. Every product email has a one-click unsubscribe link. |
| Product analytics (product events and cookie-free page analytics) | Legitimate interest in understanding how Serpkin is used so we can improve it |
| Security, abuse prevention, rate limits and logs | Legitimate interest in keeping Serpkin safe and available |
| Free SEO checker | Legitimate interest in providing the tool you asked for |
We do not sell your personal data, and we do not use it for advertising.
How we use Google data
Serpkin’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We use Search Console data only to provide the features you see in Serpkin: choosing and ranking missions, showing results, checking whether a fix worked, alerts and your weekly summary.
- We do not sell it, use it for advertising, or transfer it to data brokers or ad platforms.
- We do not use it to develop, improve or train generalized AI or machine learning models.
- We do not transfer it to anyone else, except to service providers that help us run Serpkin under the same restrictions, to your own connected coding agent when it asks for a mission, to our search data provider (the text of your top search queries only, to run the AI visibility and rank checks you see in Serpkin), for security, or where the law requires it.
- People at Serpkin do not read it unless you ask us to for support, it is needed for security, or the law requires it.
- You can disconnect Search Console at any time in the app. We then revoke the token at Google and delete the stored tokens and the synced Search Console data for that site. You can also remove access in your Google account permissions.
Who we share it with
We use a small number of service providers (processors) who act only on our instructions:
- Hosting and database: to run the app and store your data.
- Email delivery: to send account emails and product emails.
- Payments: Creem, as merchant of record, for checkout, subscriptions, invoices and tax.
- Search data providers: to look up public search data such as keyword volumes, search results and backlinks. We send them keywords and domains, not your account details. For AI visibility and rank checks, the keywords can include the text of your top Search Console queries, but never your clicks, impressions or other Search Console data.
- Google APIs: to read the Search Console data you connect.
A current list of providers is available on request at [CONTACT EMAIL]. We may also disclose data where the law requires it, or as part of a merger or sale of the business, in which case this policy continues to apply to your data.
How long we keep it
| Data | Kept for |
|---|---|
| Account, sites, missions and results | Until you delete your account |
| Search Console tokens and synced data | Until you disconnect the site or delete your account |
| Fetched page and search evidence | Expires after 7 to 30 days depending on the type, then deleted |
| Finished background jobs | 90 days |
| Routine “site checked” events | 180 days (alerts and wins stay with your history) |
| Audit log (security events for your workspace) | 365 days, including after you delete your account |
| Product events | 400 days, or until you delete your account |
| Log of product emails we sent you (subject and content) | 180 days |
| Request and payment webhook records | 30 days |
| Rate limit counters | About 1 hour |
| Sign-in rate limit records (IP address and request path) | 1 day |
| Free SEO checker results | Not stored; used from server memory for up to 10 minutes, then discarded |
| Billing records held by Creem | As Creem’s own policy and tax law require |
We keep encrypted database backups for disaster recovery for about 14 days: we take a backup every day and keep the newest 14. Deleted data drops out of backups as they roll over.
Export and delete your data
You can download a JSON export of your workspace from the app at any time. You can delete your account in the app: confirm with your password, and we immediately delete your workspace, its sites and all their data, and your user account. If you have a paid subscription that is running or paused, cancel it in Plan and billing first. The audit log of security events for your workspace, including the record that the account was deleted, is kept for up to 365 days after deletion and then removed.
Cookies
Serpkin sets one kind of cookie: a session cookie that keeps you signed in. It is strictly necessary, so we do not ask for consent. We do not use advertising or tracking cookies.
If page analytics are enabled, they are privacy-friendly, aggregate statistics about page views that do not use cookies and do not identify you.
Security
We encrypt Google tokens with AES-256-GCM, store passwords and API keys only as hashes, use TLS in transit, and encrypt backups with a separate key. Access to production systems is limited to the people who run Serpkin. No system is perfectly secure. If we learn of a breach that affects you, we will tell you as the law requires.
International transfers
Our providers may process data outside your country, including outside the EEA and the UK. Where they do, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses, with the UK addendum where needed. Ask us at [CONTACT EMAIL] for details.
Your rights (EEA and UK)
You can ask to access, correct, delete or export your personal data, and to restrict or object to how we use it. Where we rely on consent, you can withdraw it at any time. You can do most of this yourself in the app. Otherwise email [CONTACT EMAIL] and we will reply within one month.
You can also complain to a data protection authority. Our lead authority is [SUPERVISORY AUTHORITY]. In the UK it is the Information Commissioner’s Office (ico.org.uk).
California residents
Under the CCPA you can ask what personal information we collect, use and disclose, and ask us to delete or correct it. We do not sell personal information or share it for cross-context behavioural advertising, and we use sensitive personal information (such as your password) only to provide the service. We will not treat you differently for using these rights. Email [CONTACT EMAIL].
Children
Serpkin is a tool for businesses and is not meant for anyone under 16. We do not knowingly collect data from children.
Changes and contact
If we change this policy in a meaningful way, we will email account holders before the change takes effect. Questions: [CONTACT EMAIL], or write to [COMPANY LEGAL NAME], [ADDRESS].