SERP DR
Add site

Privacy Policy

Privacy policy for SERP DR. Learn how we collect, use, and protect your information.

SERP DR (“us”, “we” or “our”) runs dr.serp.co (the “Service”). This policy explains what personal information we collect when you use the Service, how we use it, who processes it for us and how long we keep it. We don’t use or share your information except as this policy describes.

What we collect

You can view a site’s page and embed its badge without an account. Looking up a site that has no DR here yet needs a free account, made with just your email. Looking up a site gives it a public page on the Service, and the page doesn’t say who looked it up. When you sign in, claim a site, submit a directory or pay, we store:

  • Your account: your email address. We don’t ask for your name or a password.
  • Sign-in codes: each code we email you is stored hashed, with the address we sent it to, and works for 10 minutes.
  • Sessions: each time you sign in, a record of the session with your IP address and your browser’s user agent, which names your browser and operating system.
  • Claims: the domains you claim, with your email address. We never show your email address on a site’s page.
  • Domain email codes: the address you enter to prove you run a domain, with the domain and a digest of the code we send, so we can check the code and let you claim the domain without signing in first. We keep it for 24 hours after the code is sent, or 24 hours after you confirm it, and delete it when a claim uses it.
  • Directory submissions: what you enter about a directory you submit, such as its website, name, descriptions, category and logo link, with its status and its review history. A published listing is public.
  • Payments: payments go through our payment provider, currently Stripe, so we never see or store your card details. For a plan, we store your email address, your Stripe customer and subscription IDs, the plan, its status and when it renews or ends, and a log of Stripe’s messages about it.

We also keep records about sites rather than people: each site’s DR history, its title and description, a link to its screenshot on Microlink’s servers, and our checks of its homepage for the badge, with when we checked, the result and the status code the homepage answered with.

How we use it

  • To sign you in and keep you signed in.
  • To run your claims, your plan and your listings.
  • To email you about your account, your sites, your plan and your listings, such as your sign-in codes. We don’t send marketing email.
  • To keep the Service working: we use your IP address to limit how often one visitor can use parts of it, such as lookups, rechecks, badge checks and sign-in codes. These counts cover an hour at most.
  • To see how the Service is used, such as which pages people visit, through the analytics described under Cookies and local storage.

We don’t sell your information, and we don’t use it for advertising.

Cookies and local storage

The Service sets only the cookies below, which it needs to work. We don’t use advertising cookies.

  • __Secure-dr-serp.session_token keeps you signed in. Signing out deletes it; otherwise it lasts until 30 days after you last use the Service.
  • __Secure-dr_code_binding ties a sign-in code to the browser that asked for it, so the code works only there. It lasts 15 minutes.
  • __Secure-dr_known_device remembers that this browser has signed in to your account, so it can still ask for a code when someone else floods your address with requests. It lasts 180 days.
  • __Secure-dr_domain_proof ties a domain email code, and the proof it leaves once you enter it, to the browser that asked for it, so only that browser can use the proof to claim the domain. It holds a random token that only this browser sends, to the claims API alone. It lasts 24 hours and 10 minutes.
  • sidebar_state remembers whether your account area’s sidebar is open. It lasts 7 days.

The Service also keeps two values in your browser’s local storage, which isn’t sent to us:

  • dr_domain_email_v1: the address you typed to get a domain email code, for each domain, so the claim form opens with it filled in again. It is kept for 30 days and signing out removes it.
  • theme: the light, dark or system theme you chose.

On dr.serp.co, every page also loads two analytics services that count visits and the pages people view. Google Tag Manager runs the analytics tags we choose, such as Google Analytics, and those tags can set Google’s own cookies in your browser. Cloudflare Web Analytics measures visits and how fast pages load without cookies.

You can delete cookies and local storage in your browser’s settings. Deleting the session cookie signs you out.

Who processes it

We use these services to run the Service, and each receives only what its part of the work needs:

  • Cloudflare hosts the Service, its database and its logs. Every request to the Service passes through Cloudflare, which sees your IP address and your browser’s details. On dr.serp.co, Cloudflare Web Analytics also receives the pages you view and how fast they load.
  • Google runs Google Tag Manager and the analytics tags it loads on dr.serp.co, so it receives the pages you view, your IP address and your browser’s details.
  • Sentry receives reports of errors on dr.serp.co and its staging site. A report holds the page’s path without its query string and your browser’s and operating system’s details. Sentry also receives your IP address when your browser sends a report, and handles it under its own privacy policy.
  • useSend sends our email, so it receives your email address and each email we send you.
  • Stripe takes payments and runs the billing portal. It receives your email address and what you enter at checkout, such as your card details.
  • Ahrefs provides the DR. We send it domain names only, never anything about you.
  • Microlink fetches a site’s title and description and takes its screenshot. We send it the site’s address only, but site pages show the screenshot from Microlink’s servers, so your browser loads it from Microlink, which sees your IP address and your browser’s details.

To check a site for the badge, we fetch its homepage ourselves.

How long we keep it

  • A sign-in code works for 10 minutes. Using it deletes it, and we delete an unused code within about an hour of it expiring.
  • A session lasts until you sign out or until 30 days after you last use the Service. Signing out deletes its record, with your IP address and user agent; otherwise we delete the record within about an hour of the session expiring.
  • Your account, your claims and your payment records stay until you ask us to delete them. Releasing a claim from your account removes your email address from it.
  • Cloudflare keeps the Service’s logs for a limited time.

Seeing, correcting or deleting your information

You can ask us for a copy of the personal information we hold about you, or ask us to correct or delete it. Email support+dr@serp.co from the address you sign in with, so we know the request is yours. Our team handles each request by hand.

When we delete your account, we also delete its sessions and release its claims. We keep only what the law requires, such as records of payments. A site’s public page and DR history are about the website, not about you, so they stay.

Without writing to us, you can release a claim from your account’s Sites page, cancel a plan from its Billing page, and sign out to end a session.

Security

We use commercially reasonable means to protect your information. Sign-in codes are stored hashed, the page’s scripts can’t read the sign-in cookies, and our sign-in and email logs record an email address’s domain at most, never the address or a code. No way of sending or storing information is completely secure, so we can’t guarantee its security.

Other websites

The Service links to other websites, such as the sites and directories it lists. We don’t run them and aren’t responsible for their content or their privacy practices, so read their own privacy policies.

Some pages also make your browser load files from other websites, and each of them sees your IP address and your browser’s details:

  • Site pages show a site’s screenshot from Microlink’s servers.
  • The home page, the directory pages and site pages show each directory’s logo from where it’s hosted, usually the directory’s own website.
  • Every page’s footer shows the “Featured on SERP” image from serp.co.
  • A badge opened on its own in your browser loads its font from Google Fonts.
  • Every page on dr.serp.co loads Google Tag Manager, and the tags it runs, from Google’s servers, and Cloudflare Web Analytics’ script from Cloudflare’s.

Children’s privacy

The Service isn’t meant for anyone under 18. We don’t knowingly collect information about children, and if we find we have, we delete it.

We disclose personal information when the law or a valid legal request, such as a subpoena, requires it.

Changes

We may change this policy. The version on this page is the one that applies.

Contact us

For questions about this policy or your information, email support+dr@serp.co or see our Contact page.