# Privacy Policy

**Effective 23 Oct 2026.** This policy explains what personal data SerpWiz ("we") collects when you use serpwiz.com, our dashboard, API and MCP server, why we collect it, and your choices.

## What we collect

| Data | Why | Kept for |
|---|---|---|
| **Account:** email address, password (stored only as a one-way hash), sign-up and login times | Running your account, security, service emails | While your account is open, then up to 30 days |
| **API keys:** stored only as a one-way hash, plus the first characters (the prefix) so you can tell keys apart | Authenticating requests | Until you revoke the key or close your account |
| **Request logs:** time, endpoint, request parameters including search terms, response status, queries charged, latency, API key prefix and IP address | Billing accuracy, resolving disputes, abuse prevention and your own [request history](/dashboard/requests) | 120 days |
| **Usage totals:** hourly counts of requests, successes, failures and queries charged | Your usage charts and our capacity planning | About 13 months |
| **Billing:** Stripe customer ID, plans, purchases, refunds | Billing, tax and accounting | As long as the law requires (typically up to 7 years) |
| **Security records:** failed login attempts with IP address; one-time email links | Preventing account takeover | Up to 30 days |
| **Fraud prevention:** IP addresses your account uses on the website and API, and a random identifier for each browser you sign in with | Preventing abuse of free queries and referral bonuses | While your account is open, then up to 30 days |

**Card details** go directly to Stripe. We never see or store your full card number.

**Search terms you send through the API** are processed to fetch results and are kept in your request logs for the period above. Don't put sensitive personal data in queries unless you have a lawful basis to do so.

## Cookies and tracking

- We use one essential cookie (`sw_sess`) to keep you signed in. It's removed when you close your browser or sign out.
- A browser identifier cookie (`sw_did`), a random value with no personal data, helps us prevent abuse of free queries and referral bonuses. A copy is kept in your browser's local storage. It lasts up to 2 years.
- If you arrive through an affiliate's link, a cookie (`sw_ref`) remembers their code for 60 days so the referral counts if you sign up.
- Your browser's local storage also remembers your light/dark theme and Playground language choice. That data never leaves your device.
- We don't use advertising or third-party analytics cookies, and we don't sell or share personal data for advertising.

## Who we share data with

We use these service providers ("processors") to run SerpWiz. They may only use your data to provide their services to us.

- **Stripe:** payments and invoices.
- **Cloudflare:** network delivery and security. All traffic passes through it.
- **Amazon Web Services (SES):** sending account and service emails.
- **Akamai (Linode):** server hosting.
- **Our search infrastructure providers:** they receive the search parameters needed to fetch results, together with an internal account number. They don't receive your email address or other personal details.

We may also disclose data if the law requires it, to protect our rights or users' safety, or as part of a merger or acquisition, in which case this policy continues to apply.

## Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to or restrict its processing.

- You can download your request logs yourself from your dashboard.
- For anything else, email support@serpwiz.com from your account's email address. We'll respond within 30 days.
- If you're in the EU, the UK or a similar jurisdiction, you can also complain to your local data-protection authority.
- Where GDPR applies, our legal bases are:
  - performing our contract with you (account, API, billing)
  - our legitimate interests (security, abuse prevention, service improvement)
  - legal obligations (tax records)

## Security

We use these security measures:

- Encrypted connections (HTTPS)
- Hashed passwords and API keys
- Access restricted to staff who need it
- Regular backups

No system is perfectly secure. If a breach affects your personal data, we'll notify you as the law requires.

## International transfers

We and our providers may process data in the United States and other countries. Where required, transfers are protected by appropriate safeguards such as Standard Contractual Clauses.

## Children

SerpWiz is a developer service and isn't intended for anyone under 18. We don't knowingly collect data from children.

## Changes

- We'll post changes on this page and update the "Effective" date.
- For material changes, we'll email account holders before they take effect.

## Contact

SerpWiz. Email: support@serpwiz.com.