This policy says what personal data Serpbit keeps when you use serpbit.com, the dashboard at app.serpbit.com and the API at api.serpbit.com, why, for how long, and who else handles it.
Who is responsible
The controller is Serpbit ("we"). Write to support@serpbit.com about anything in this policy.
What we keep
Your account
- Your email address, and a name if your sign-in provider gives one.
- If you sign in with Google or GitHub: that provider's identifier for your account. We do not receive your password there and ask for no other permissions.
- When the account was created and when you last signed in.
Signing in
- Sign-in links and dashboard sessions, kept only as one-way hashes. A link works once and for 15 minutes; a session lasts 30 days or until you sign out.
- Your IP address, held in memory for 15 minutes to limit how many sign-in links can be asked for. It is not written to our database.
Using the API
- For each request: the time, the key used, the status, how many pages and results came back, how many attempts it took, how long it took and how much data it moved. This is what the dashboard's usage charts and your balance are made from.
- We do not store your queries or the results. They pass through our servers to answer the request. To give the same answer back for free, an answer stays in the server's memory for an hour (the cache), or for a day when the request carried an
Idempotency-Key. It is never written to disk, and only your own account can get it back. - API keys are shown to you once. We keep a hash to check them and the last four characters to show you which is which.
- For each app you connect to our MCP server: the name the app gives itself, when it was connected and who allowed it. Its tokens are kept only as hashes.
Payments
- Your plan, its status and period, your balance of credits, and a record of each top-up.
- Stripe's identifier for you as a customer. Card numbers go straight to Stripe and never reach us. If you add a VAT number or an address at checkout, Stripe holds it and puts it on your invoices.
Support
What you write to support@serpbit.com, and our replies.
This website
serpbit.com sets no cookies and runs no analytics or tracking scripts. Its fonts are served from our own domain, so loading a page sends nothing to a third party. Our hosting provider sees the IP address and browser details of each request, as any web server does, to deliver the page and keep it safe.
Cookies in the dashboard
The dashboard sets one session cookie when you sign in and a short-lived cookie during a Google or GitHub sign-in. Both are strictly necessary for signing in; there are no advertising or analytics cookies.
Why, and on what legal basis
- To provide the service you signed up for: your account, keys, usage and billing (performance of a contract, Article 6(1)(b) GDPR).
- To keep invoices and payment records as tax and accounting law requires (legal obligation, Article 6(1)(c)).
- To keep the service secure and working, prevent abuse and fraud, and answer support requests (our legitimate interests, Article 6(1)(f)).
We do not sell personal data, do not use it for advertising, and do not make automated decisions about you that have legal effects.
Who else handles it
These providers process data for us, under contracts that bind them to our instructions:
| Provider | For |
|---|---|
| Stripe | Payments, invoices, the billing portal |
| Resend | Sending sign-in emails |
| Cloudflare | DNS, delivery of this website, routing of email to support@serpbit.com |
| Google (Gmail) | The mailbox that receives support email |
| Our hosting provider | The servers the dashboard and the API run on |
Google and GitHub receive your sign-in only when you choose them. Some of these providers are outside the European Economic Area. Where they are, the transfer relies on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework or on its Standard Contractual Clauses.
How long we keep it
- Account data: while the account exists. When you ask us to close it, we delete it within 30 days.
- API usage records: 13 months, then they are deleted automatically.
- Invoices and payment records: for as long as tax law requires, currently five years from the end of the year they relate to.
- Support email: up to two years after the conversation ends.
- Server logs: up to 30 days.
Your rights
You may ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Write to support@serpbit.com from the address on your account; we answer within one month. You may also complain to a data protection supervisory authority, such as the one where you live or work.
Security
Connections are encrypted. Keys, apps' tokens, sign-in links and sessions are stored only as hashes. Access to our servers and databases is limited to the people who run the service.
Children
Serpbit is a service for businesses and developers and is not meant for anyone under 16.
Changes
When this policy changes in a way that matters, we email account holders before the change takes effect. The date at the top says when it last changed.