Privacy Policy

What SERP DR stores about you and why, who processes it, how long we keep it and how to have it deleted.

SERP DR (“us”, “we” or “our”) runs dr.serp.co (the “Service”). This policy explains what personal information we collect when you use the Service, how we use it, who processes it for us and how long we keep it. We don’t use or share your information except as this policy describes.

What we collect

You can look up a site’s DR, view its page and embed its badge without an account. Looking up a site gives it a public page on the Service, and the page doesn’t say who looked it up. When you sign in, claim a site, submit a directory or pay, we store:

Your account: your email address. We don’t ask for your name or a password.
Sign-in codes: each code we email you is stored hashed, with the address we sent it to, and works for 10 minutes.
Sessions: each time you sign in, a record of the session with your IP address and your browser’s user agent, which names your browser and operating system.
Claims: the domains you claim, with your email address. We never show your email address on a site’s page.
Directory submissions: what you enter about a directory you submit, such as its website, name, descriptions, category and logo link, with its status and its review history. A published listing is public.
Payments: payments go through our payment provider, currently Stripe, so we never see or store your card details. For a plan, we store your email address, your Stripe customer and subscription IDs, the plan, its status and when it renews or ends, and a log of Stripe’s messages about it.

We also keep records about sites rather than people: each site’s DR history, its title and description, a link to its screenshot on Microlink’s servers, and our checks of its homepage for the badge, with when we checked, the result and the status code the homepage answered with.

How we use it

To sign you in and keep you signed in.
To run your claims, your plan and your listings.
To email you about your account, your sites, your plan and your listings, such as your sign-in codes. We don’t send marketing email.
To keep the Service working: we use your IP address to limit how often one visitor can use parts of it, such as lookups, rechecks, badge checks and sign-in codes. These counts cover an hour at most.

We don’t sell your information, and we don’t use it for advertising.

Cookies and local storage

We use only the cookies the Service needs to work. We don’t use analytics or advertising cookies.

__Secure-dr-serp.session_token keeps you signed in. Signing out deletes it; otherwise it lasts until 30 days after you last use the Service.
__Secure-dr_code_binding ties a sign-in code to the browser that asked for it, so the code works only there. It lasts 15 minutes.
__Secure-dr_known_device remembers that this browser has signed in to your account, so it can still ask for a code when someone else floods your address with requests. It lasts 180 days.
sidebar_state remembers whether your account area’s sidebar is open. It lasts 7 days.

The Service also keeps two values in your browser’s local storage, which isn’t sent to us:

dr-auth-email: the email address you signed in with, to show it in the header. Signing out removes it.
theme: the light, dark or system theme you chose.

You can delete cookies and local storage in your browser’s settings. Deleting the session cookie signs you out.

Who processes it

We use these services to run the Service, and each receives only what its part of the work needs:

Cloudflare hosts the Service, its database and its logs. Every request to the Service passes through Cloudflare, which sees your IP address and your browser’s details.
useSend sends our email, so it receives your email address and each email we send you.
Stripe takes payments and runs the billing portal. It receives your email address and what you enter at checkout, such as your card details.
Ahrefs provides the DR. We send it domain names only, never anything about you.
Microlink fetches a site’s title and description and takes its screenshot. We send it the site’s address only, but site pages show the screenshot from Microlink’s servers, so your browser loads it from Microlink, which sees your IP address and your browser’s details.

To check a site for the badge, we fetch its homepage ourselves.

How long we keep it

A sign-in code works for 10 minutes. Using it deletes it, and we delete an unused code within about an hour of it expiring.
A session lasts until you sign out or until 30 days after you last use the Service. Signing out deletes its record, with your IP address and user agent; otherwise we delete the record within about an hour of the session expiring.
Your account, your claims and your payment records stay until you ask us to delete them. Releasing a claim from your account removes your email address from it.
Cloudflare keeps the Service’s logs for a limited time.

Seeing, correcting or deleting your information

You can ask us for a copy of the personal information we hold about you, or ask us to correct or delete it. Email support+dr@serp.co from the address you sign in with, so we know the request is yours. Our team handles each request by hand.

When we delete your account, we also delete its sessions and release its claims. We keep only what the law requires, such as records of payments. A site’s public page and DR history are about the website, not about you, so they stay.

Without writing to us, you can release a claim from your account’s Sites page, cancel a plan from its Billing page, and sign out to end a session.

Security

We use commercially reasonable means to protect your information. Sign-in codes are stored hashed, the page’s scripts can’t read the sign-in cookies, and our sign-in and email logs record an email address’s domain at most, never the address or a code. No way of sending or storing information is completely secure, so we can’t guarantee its security.

Other websites

The Service links to other websites, such as the sites and directories it lists. We don’t run them and aren’t responsible for their content or their privacy practices, so read their own privacy policies.

Some pages also make your browser load files from other websites, and each of them sees your IP address and your browser’s details:

Site pages show a site’s screenshot from Microlink’s servers.
The home page, the directory pages and site pages show each directory’s logo from where it’s hosted, usually the directory’s own website.
Every page’s footer shows the “Featured on SERP” image from serp.co.
A badge opened on its own in your browser loads its font from Google Fonts.

Children’s privacy

The Service isn’t meant for anyone under 18. We don’t knowingly collect information about children, and if we find we have, we delete it.

Legal requests

We disclose personal information when the law or a valid legal request, such as a subpoena, requires it.

Changes

We may change this policy. The version on this page is the one that applies.

Contact us

For questions about this policy or your information, email support+dr@serp.co or see our Contact page.