Privacy Policy

1.Who we are

Serpwright (“we”, “us”) is software that turns your Google Search Console data into researched, published articles. Serpwright operates serpwright.com and the Serpwright app, and is the controller of the personal data described here. You can reach us at hello@serpwright.com.

For the content and site data you put into a workspace, you decide what goes in and why. We process it on your behalf to provide the service.

2.What we collect

We only collect what the product needs to work.

• Account details: your name, email address and, if you sign in with Google, your Google profile picture. If you use a password, we store only a salted hash of it.
• Sign-in sessions: a session token, the IP address and the browser user agent of each signed-in session, so we can keep you signed in and spot abuse.
• Sign-up checks: a one-way hash of the IP address you signed up from, used only to limit free trials per network. Sign-up and sign-in forms use Cloudflare Turnstile, which checks your browser for signs of automation without tracking you across sites.
• Workspace settings: your site's domain, brand voice, target audience, focus topics, publishing preferences and team members.
• Search Console data: for the one property you connect, search queries, pages, clicks, impressions, click-through rate and average position. See Google user data below.
• Your site's pages: URLs, titles and text from the public pages listed in your sitemap, used to suggest internal links, map your site's topics and avoid duplicate articles.
• Content you create: titles, briefs, articles, revisions, images you upload or choose, author profiles, fact-check results, optimization suggestions and the publishing log.
• Credentials you give us: CMS credentials (such as a WordPress application password or a Shopify or Webflow token), webhook secrets, your Google refresh token, and any optional provider key you add under Advanced settings. These are encrypted before storage (see Security). API keys we issue to you are stored only as a hash.
• Billing records: your plan, subscription status and renewal date, the amount, currency, date and status of each payment, and your Stripe customer ID. Stripe collects your card details directly; we never see or store your card number.
• Usage records: for each AI call, the model used and its token counts, and the number of articles written each period, so we can apply your plan's allowance. We also keep server logs of requests and errors.

3.How we use it

• To run the service you asked for: find title ideas, research, write, publish and track articles.
• To sign you in, keep your account secure and prevent abuse.
• To send emails about your account: verification, sign-in links, trial and billing notices, receipts, and pipeline notifications and a weekly summary you can turn off.
• To take payment and keep the records the law requires.
• To fix bugs and keep the service running, using logs and error reports.
• To learn which pages people find useful, with cookieless counts and, only if you allow it, Google Analytics.

We do not sell your personal data, we do not use it for advertising, and we do not use your content or Search Console data to train AI models. Our legal bases, where the GDPR applies, are performing our contract with you, our legitimate interest in running a secure service, complying with legal obligations and, for Google Analytics, your consent.

4.Google user data

Serpwright asks Google for two kinds of access, and only when you choose to grant them.

• Sign in with Google (openid, email, profile): your name, email address and profile picture, used only to create and sign in to your account.
• Search Console (https://www.googleapis.com/auth/webmasters): requested separately, from a workspace's settings, when you connect Search Console. We use it to read search analytics (queries, pages, clicks, impressions, click-through rate and position) for the property you select, to submit your sitemap, and to check whether pages we published for you are indexed. We ask for this scope rather than the read-only one because sitemap submission requires it. We never add or remove users, properties or verification records.

How we use and share this data:

• Search Console data is used only to provide features you can see in Serpwright: title ideas, briefs, rank tracking and optimization suggestions for your own site.
• To generate titles and briefs, relevant queries and page data are sent to our AI provider (OpenAI), under Serpwright's own account and terms that don't allow it to use that data to train its models. Sites set up before AI was included may keep writing with the owner's own key until it's removed.
• We do not sell Google user data, use it for advertising, or use it to train or improve general AI or machine learning models.
• People at Serpwright do not read your Google user data unless you ask us to for support, it is needed for security or to comply with the law, or it has been aggregated and anonymized for internal operations.
• Your Google refresh token is encrypted at rest and used only on our servers. Disconnecting Search Console in Serpwright revokes it at Google. You can also remove Serpwright's access at any time from your Google Account permissions.

Serpwright's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5.Who processes your data

We use a small number of service providers, each only for the job listed:

• Cloudflare: hosting, database, file storage, email delivery, bot protection on sign-up and sign-in forms, and the built-in models that index your pages and draw AI cover images.
• Stripe: payment processing, tax calculation and receipts.
• Google: sign-in, the Search Console API and, only if you allow it, Google Analytics (see Cookies and analytics).
• OpenAI: receives the prompts needed to research and write your content, under Serpwright's account. Under OpenAI's API terms, it does not use that data to train its models.
• PostHog: cookieless visit and usage counts, never your name, email or content.
• Pexels and Unsplash: receive the photo search terms for your articles, never your account details.
• Brave Search: receives the search queries we research, never your account details. If you add your own SerpApi or DataForSEO key under Advanced settings, that provider receives them instead.
• The CMS or webhook you connect: receives the articles you publish.

We may disclose data if the law requires it, or to a buyer if Serpwright is sold, in which case this policy continues to apply to your data.

6.Cookies and analytics

We use the cookies needed to keep you signed in and to protect sign-in flows, and Google Analytics cookies only if you allow them (below). Your light or dark theme choice is kept in your browser's local storage. If you type a keyword into the title and meta description generator or the keyword density checker and then click its “Start free trial” button, that keyword is kept in your browser's local storage for up to 7 days, so setup can fill it in as your first topic. It reaches us only if you save it there. We do not use advertising or cross-site tracking cookies.

We count visits and a few actions (sign-ups, Search Console connections, checkouts opened, drafts written, purchases, uses of our free tools) with PostHog in cookieless mode: no cookies, nothing kept in your browser and no personal data. When you click a sign-up link, we record which link it was (where the button sits, which page it is on, and whether it carried a keyword from a free tool, never the keyword itself), and the link passes that label to the sign-up form, so we can learn which pages lead to sign-ups. The link can also carry the name of the site that sent you here, such as a directory listing. We record that name, never anything about you. The sign-up form also asks “Where did you find us?”. It is optional, you pick from a short list, and we record only the option you pick. Web addresses are recorded without their query strings, other than campaign tags. If one of our scripts fails on a page, we send the type of error and where in our code it happened, never its message. Page views are not counted if your browser has Do Not Track or Global Privacy Control turned on.

Google Analytics is optional. It loads only after you choose “Allow analytics” in the small notice on our pages. Until then nothing is sent to Google, and what you did before choosing is not sent later. If you allow it, Google Analytics sets two first-party cookies (_ga and _ga_ followed by our measurement ID) that tell repeat visits apart for up to two years, and Google receives the page address (without query strings, other than campaign tags), the page title, the site that sent you, your browser and device type, and an approximate location derived from your IP address. Google Analytics does not store IP addresses. Inside the signed-in app it records only that an app page was viewed, never which page or its title. Advertising features, Google signals and ad personalization are off. Google Analytics never loads if your browser has Do Not Track or Global Privacy Control turned on. Your choice is kept in your browser's local storage; you can change it here at any time, and turning it off deletes the Google Analytics cookies.

7.How long we keep it, and deleting it

• Deleting a workspace removes its Search Console data, page index, titles, briefs, articles, revisions, performance history, publish log, credentials and settings from our database immediately. Published articles on your own site are not touched.
• Exporting: you can download your articles and workspace data from Settings at any time, including when your account is read-only.
• Disconnecting Search Console revokes our access at Google and deletes the stored token.
• Deleting your account: email hello@serpwright.com from the address on the account and we will delete your account and every workspace you own within 30 days.
• Backups and derived copies: database backups, and copies such as hosted cover images and the search index of your pages, are purged within 30 days of deletion.
• Purchase records are kept for as long as tax and accounting law requires, usually up to 7 years.
• Accounts without an active plan (an ended trial or a cancelled subscription) stay read-only, so you can come back or export your content. Ask us and we will delete one at any time.

8.Security

CMS credentials, webhook secrets, Google tokens and any provider keys are encrypted with AES-256-GCM before they are stored, and decrypted only inside the server step that makes the outbound call. They are never logged or sent to your browser; the app shows only the last four characters. All traffic uses HTTPS. Every database query is scoped to a workspace you belong to, with a role check. No system is perfectly secure; if we learn of a breach affecting your data, we will tell you without undue delay.

9.Your rights

You can ask to access, correct, export or delete your personal data, or object to or restrict how we use it. Email hello@serpwright.com and we will reply within 30 days. If you are in the EU, UK or a US state with a privacy law, you also have the right to complain to your local data protection authority. We don't sell or share personal data as those terms are defined under California law.

10.International transfers

Our providers run infrastructure in many countries, including the United States. Where personal data leaves the EU or UK, we rely on the providers' Standard Contractual Clauses or an equivalent safeguard.

11.Children

Serpwright is a business tool and is not meant for anyone under 16. We do not knowingly collect their data.

12.Changes to this policy

If we change this policy in a way that matters, we will update the date above and email account owners before the change takes effect.