← Back to Serse

Legal

Privacy Policy

Last updated October 1, 2026

Serse collects the minimum information required to operate the product, secure accounts, process billing, and improve search performance workflows for customers. This policy explains what we collect, why, and how you can control it.

1. Information we collect

Account information. When you sign up, we collect your name, email address, authentication provider (email/password or Google OAuth), and billing details. Passwords are never stored in plain text.

Connected data. When you connect Google Search Console, Google Analytics, or other integrations, we receive and store the data those services expose — including clicks, impressions, rankings, pages, and queries — to power your dashboard and agents.

Google connections. Google sign-in identifies your Serse account. Connecting reporting is a separate choice: we receive your Google account identifier and email address, the Search Console sites or Analytics properties you can access, and OAuth credentials. After you select a property, Search Console supplies search queries, pages, clicks, impressions and position; Analytics supplies aggregate traffic, engagement and conversion reports. These reporting permissions are read-only and do not let Serse change your Google property settings.

Usage and operational data. We log agent runs, approvals, audit events, content drafts, technical findings, and integration status to provide the service and detect abuse.

Technical data. We may collect browser type, IP address, referring URL, and session data for security, fraud prevention, and product analytics.

2. How we use your information

We use the information we collect to:

  • Authenticate users and maintain secure sessions
  • Operate the application and run AI agents on your behalf
  • Process subscription payments and manage billing state
  • Send transactional emails such as password resets, invoices, and product alerts
  • Diagnose errors, investigate incidents, and improve reliability
  • Enforce these policies and detect abuse or unauthorized access

We do not sell your personal information to third parties, and we do not use your connected SEO data to train AI models.

We use connected Google data for the reporting, recommendations and SEO workflows you choose in Serse. Google data and information derived from it are not used for advertising, sold to data brokers, or used to train general-purpose AI models. Serse’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

3. Third-party services

Serse relies on trusted infrastructure and service providers to operate:

  • Supabase — authentication and database storage
  • Stripe — subscription billing and payment processing
  • Vercel — hosting and edge delivery
  • Google APIs — Search Console and Analytics data you explicitly authorize
  • Google Analytics — optional usage measurement when you allow analytics cookies
  • Anthropic / OpenAI — AI model providers powering the agent system
  • Sentry (Functional Software, Inc.) — error monitoring and crash reporting
  • DataForSEO — search engine results data provider (when keyword research is enabled)
  • Common Crawl — public web crawl index, queried by your site's domain to find pages we would otherwise miss
  • Resend — transactional email delivery (welcome emails, alerts)

Each provider processes data under their own terms and privacy policies. We only share information necessary to provide the service.

Connected Google data is stored in our hosted database and processed by our application infrastructure. Relevant information may be supplied to our AI providers when needed for the user-facing SEO workflow you request. It is not shared with advertising providers. Access by our staff is limited to your specific consent, security investigation, legal requirements, or permitted internal operations using aggregated data.

4. Cookies and tracking

We use session cookies to maintain authentication state. We do not use third-party advertising cookies or fingerprinting.

If you allow analytics on this browser, Google Analytics uses cookies to measure page visits and engagement. We send general page names, with customer and document identifiers removed, and do not send URL query parameters, fragments, form contents or account email addresses. Advertising features are disabled. Google processes this usage data under its Privacy Policy.

You can change your browser choice below. The public website and app remember this choice separately. Turning off Usage analytics in your Serse account also stops this collection while you are signed in. Declining analytics does not affect essential features.

5. Data retention

Trial expiry, cancellation or a plan change does not automatically delete your websites, content or work history. You can request permanent account or owned-website deletion in Privacy and security. Review the scope before confirming: erasure cannot be undone.

You can disconnect Google reporting in website Settings to stop further collection. You can also review and withdraw Serse’s Google access in Privacy and security, or revoke it through your Google Account connections. Disconnecting does not erase previously collected reports; those remain subject to the account or website deletion process below. Stored OAuth credentials are encrypted and are not included in reports or data-record exports.

Deletion stops new work for the affected scope and shows its progress. Existing uncertain external operations, recurring billing and ambiguous ownership must be resolved before erasure. Published content on your connected website is not removed automatically. Shared credentials and records needed by another owner are preserved.

Anonymous scan links expire after seven days; scan content is then removed by scheduled cleanup. If a scan is copied into a workspace, that retained copy follows the workspace’s data lifecycle. Minimal platform spending records (request identifiers, model, pricing, usage and unresolved reservations) and staff reconciliation records remain separate from scan content; expiry does not record an unknown charge as zero. Shared public catalogs and limited internal security and staff-access audit records are handled separately from account content. External providers retain their own records under their policies. Removal from managed infrastructure backups follows the hosting provider’s configured backup retention.

6. Your rights and choices

Depending on your location, you may have rights to access, correct, export, or delete your personal data. You can update profile settings and connected integrations directly in the app.

Use Privacy and security to prepare a data-record export or review account deletion. Website owners can also review deletion from that website’s Settings; other members can leave through their membership settings. Export copies expire after 48 hours. A minimal deletion receipt remains for 30 days after completion. Contact us below if you need help with a request.

7. Security

We use commercially reasonable security measures including encrypted connections (TLS), hashed credentials, row-level database security, and access controls. No system can guarantee absolute security. You are responsible for protecting your login credentials and controlling access to your workspace.

8. Children

Serse is not directed at children under 16. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, contact us immediately.

9. Changes to this policy

We may update this policy periodically. When we do, we will revise the "last updated" date at the top. Continued use of Serse after changes take effect constitutes acceptance of the revised policy.

10. Contact

For privacy questions, data requests, or concerns, contact the Serse team at privacy@serse.ai.