1. Who we are
SerpDad is a software service for planning website content. It is run by SAAS SEO AGENCY LLC, a Wyoming limited liability company ("SerpDad", "we", "us"). This policy covers serpdad.com, the SerpDad app at app.serpdad.com and the free intent checker.
SerpDad is a business-to-business service. Our customers are companies and professionals. When a customer uses SerpDad for its own website, it decides what data goes into its workspace.
For personal information we handle for our own purposes, such as accounts, billing and our website, SAAS SEO AGENCY LLC is the controller. For personal information inside a customer's workspace, the customer is the controller and SerpDad processes it on the customer's behalf.
Questions about privacy go to contact@serpdad.com.
2. What we collect
We collect only what we need to run the service:
- Account details: your name, work email address, password (stored as a one-way hash) and any passkeys you add.
- Workspace content: projects, site addresses, keyword lists you import, the plans, briefs, drafts, comments and sign-offs you create, and the search results and volumes fetched for your work.
- Provider keys: the API keys you add for DataForSEO, your AI provider and optional providers such as Ahrefs. We store them encrypted and show only their last 4 characters.
- Search Console data, if you connect it: clicks, impressions, positions, pages and queries for the property you choose.
- Billing details: your billing contact, plan and invoices. Card details go straight to Stripe; we never see or store full card numbers.
- Technical data: IP address, browser type, sign-in times and security logs, used to keep the service safe and working.
- Messages: emails you send us and our replies.
- Waitlist: if you join the waitlist on serpdad.com, your email address and any referral code in the link you followed. We use them only to email you about SerpDad opening.
3. How we use it, and our lawful bases
We use your data to provide SerpDad and for nothing unrelated. Under the GDPR, these are our lawful bases:
- To provide the service you signed up for, including running plans, sending account and run emails, and billing: performance of a contract.
- To keep the service secure, prevent abuse, fix problems and improve how the product works: our legitimate interests.
- To keep tax, accounting and other records the law requires: legal obligation.
- To use analytics cookies on serpdad.com, where they are switched on: your consent.
We do not sell your personal information. We do not share it for cross-context behavioral advertising.
4. Your content and AI
Your workspace content belongs to you. SerpDad does not use your content to train AI models.
When SerpDad sends text to an AI provider, it does so on your own account with that provider, and only to do the work you asked for. That provider's terms decide whether it may use the text. Check its settings and terms before you connect it.
If you turn on the optional Spiral voice pass, draft text is sent to your own Spiral account. The settings page shows Spiral's training policy before you opt in.
5. Providers you connect with your own keys
DataForSEO, your AI provider (for example OpenRouter or Anthropic), Ahrefs (optional) and Spiral (optional) run on accounts and keys that you own. You choose them and they bill you directly. Their own terms and privacy policies apply.
They are your vendors, not SerpDad subprocessors. SerpDad sends them only the requests your work needs, using your key. SerpDad never resells provider usage.
We store your keys encrypted and use each key only for its own workspace. Keys are never written to logs. You can delete a key at any time; it still works at the provider until you revoke it there.
6. Google Search Console
Connecting Search Console is optional. SerpDad asks Google for read-only access through Google's sign-in (OAuth) and stores the access token encrypted.
You can disconnect at any time in SerpDad, or remove SerpDad's access in your Google account. When you disconnect, we revoke the access and stop syncing. Data already synced stays in your workspace so your plans and receipts keep working. Deleting the project or the workspace deletes that data.
SerpDad's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Lawyerto confirm: confirm this wording for Google OAuth verification
7. The free intent checker
The free intent checker sends the keyword you type to DataForSEO and an AI provider on SerpDad's own accounts, so it costs you nothing. We keep the keyword and the result, and a rate limit uses your network address. Do not enter personal information as a keyword. Lawyerto confirm: confirm whether these platform accounts belong on the subprocessors list
8. Companies that process data for us
We use a small number of subprocessors to run SerpDad: hosting, network protection, payments, the Search Console connection and email. The full list, what each one does and where, is on the subprocessors page.
9. Where your data is stored
SerpDad's servers and backups are hosted by Hetzner in Germany. Some subprocessors, such as Stripe, Google, Cloudflare and Resend, may process data in the United States or elsewhere.
Where data leaves the European Economic Area or the United Kingdom, we rely on safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. Lawyerto confirm: confirm transfer mechanisms
10. Cookies
serpdad.com and the app use essential cookies only: to keep you signed in, protect forms and remember your session. They are needed for the service to work, so they do not need consent.
serpdad.com uses analytics cookies (Google Analytics) only when we switch analytics on. When we do, we ask for your consent where the law requires it, and the site works the same if you say no. Lawyerto confirm: confirm the consent approach before analytics is switched on
11. How long we keep data
- Workspace content stays while the workspace exists. Deleting a workspace removes its projects, plans, briefs, keys, Search Console connection and synced data.
- Provider keys are erased 30 days after a subscription ends, unless you subscribe again or erase them sooner.
- Search results fetched for your work are reused free for 30 days and kept behind your plan's receipts for the life of the plan.
- Backups are encrypted and roll off on their schedule: daily backups for 30 days and monthly backups for 12 months. Deleted data, keys included, can stay in a backup until that backup expires. After a restore, every key is blocked until its owner checks it again.
- Waitlist addresses are kept until you ask us to remove yours. Lawyerto confirm: confirm waitlist retention and the lawful basis
- Billing records are kept as long as tax and accounting law requires.
- Security logs are kept for a short period and then deleted. Lawyerto confirm: confirm log retention period
12. Your rights
Depending on where you live, you can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct it;
- delete it;
- send it to you or another service in a portable format;
- stop or limit some uses, or object to uses based on our legitimate interests;
- withdraw consent you gave, without affecting earlier use.
Under the GDPR and UK GDPR you also have the right to complain to your data protection authority. Under the CCPA, California residents have the right to know, delete and correct, and to opt out of sale or sharing (we do neither). We will not treat you differently for using your rights.
To make a request, email contact@serpdad.com. We may need to confirm who you are. We answer within one month under the GDPR and 45 days under the CCPA. An authorized agent can make a request for you with proof of authority. You can also delete your account and workspaces yourself in the app.
If your data is in a workspace owned by a customer, such as your employer or agency, that customer controls the workspace. We will pass your request to them or help them answer it.
13. Security
We encrypt provider keys and access tokens, encrypt backups, use HTTPS everywhere, keep each workspace's data separate, and limit who can reach our servers. No system is perfectly secure. If a breach affects your personal information, we will tell you as the law requires.
14. Children
SerpDad is for businesses and is not meant for anyone under 16. We do not knowingly collect data from children.
15. Changes to this policy
If we change this policy in a way that matters, we will update the date at the top and tell account owners by email or in the app before the change takes effect.
16. Contact
To ask a question or make a privacy request, contact:
- Company: SAAS SEO AGENCY LLC, a Wyoming limited liability company
- Mailing address (mail and documents only): 145 W 25th St, Fl 7, New York, NY 10001, United States
- Phone: +1 (747) 365-5431
- Email: contact@serpdad.com