This policy explains how serpfast ("we", "us") handles personal data when you visit serpfast.com, create an account or use the serpfast API. Questions about it go to [email protected].
Data we collect
- Account data. When you sign in with Google we receive your name, email address and profile picture. We never receive your Google password.
- Sign-up and security data. The IP address you first signed in from, used to prevent abuse of the free credits, and the IP addresses of requests, used for rate limiting.
- API usage. For each request: the endpoint, the query and parameters you sent, the status, credits charged, latency and time. This powers your usage history, refunds and support.
- API keys. We store only a hash of each key and its first characters. The full key is shown once, when you create it.
- Billing data. Payments are processed by Stripe. We store your Stripe customer and subscription identifiers, plan and billing status. Card and wallet details are handled by Stripe and never reach our servers.
How we use it
- To provide the service: authenticate you, run your requests, count and refund credits, and show your usage.
- To bill you and manage your subscription.
- To protect the service: rate limits, fraud and abuse prevention, and enforcing our Terms of Service.
- To contact you about your account, billing or important changes to the service.
We do not sell personal data, and we do not use it for advertising.
Cookies
We use only cookies the site needs to work: a session cookie that keeps you signed in, and a cookie that remembers your language. We do not use advertising or third-party analytics cookies.
Service providers
We share data only with providers that help us run serpfast, and only as much as they need:
- Google, for sign-in.
- Stripe, for payments and invoices.
- Our hosting and infrastructure providers, which store and process data on our behalf.
We may also disclose data when required by law or to protect the rights and safety of our users and the service.
Retention
We keep account data and usage history while your account exists. Rate-limit records expire automatically. When you ask us to delete your account, we delete your personal data within 30 days, except billing records we must keep for tax and accounting purposes.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete your account and data by writing to [email protected] from the email address of your account. Depending on where you live, you may have further rights, such as objecting to processing or complaining to a data protection authority.
Security
Data is sent over HTTPS, API keys are stored hashed, and access to production systems is restricted. No system is perfectly secure; if you believe your account or a key is compromised, revoke the key in your dashboard and contact us.
Children
serpfast is a developer service and is not directed at children under 16. We do not knowingly collect their data.
Changes
We may update this policy. The date at the top shows the latest version; for significant changes we will notify account holders by email.
Contact
Privacy questions and requests: [email protected].