---
title: "Serql privacy policy (summary)"
description: "What Serql collects, how it is used and shared, retention periods, and how to exercise data rights. Summary of the canonical privacy policy."
canonical: https://www.serql.io/privacy
markdown: https://www.serql.io/privacy.md
last-updated: 2026-10-12
section: legal
site: "Serql"
llms: https://www.serql.io/llms.txt
---

# Serql privacy policy (summary)

This is a machine-friendly summary. The canonical, binding policy is the HTML page at https://www.serql.io/privacy.

## What we collect

- **Account data** — name, email, and authentication credentials, managed by Clerk.
- **Google Search Console data** — accessed with read-only OAuth to produce insights, classifications, and reports. Search Console performance data is fetched from Google on demand, cached for up to 6 hours, and never stored in the app's database. What is stored: encrypted OAuth tokens, the property list (site URL, display name, permission level), and the annotations, classifications, tags, and share links you create.
- **Newsletter email** — only if you subscribe; passed to Kit.
- **Usage analytics** — only with consent: PostHog (sanitized paths, engagement, Core Web Vitals, device metadata, privacy-minimized session replay) and Vercel Web Analytics / Speed Insights.
- **Cookies** — Clerk session cookies (essential), theme and consent preferences (functional), analytics cookies (only with consent).

## How we use it

To provide and improve the service, generate insights from Search Console data, communicate product and security notices, and protect the platform. We do not sell personal data.

## Subprocessors

Clerk (authentication), Stripe (payments), Google (Search Console API), PostHog (consented analytics, proxied via Cloudflare), Vercel (hosting and consented analytics), Neon (Postgres), Upstash (temporary cache, request-replay records, and rate limiting), Kit/ConvertKit (newsletter signups, hosted only; email address only), and DataForSEO / Ahrefs only if you connect your own keys (queries for your properties are sent to them).

## Share links

Data in a report you share with a link is visible to anyone holding the link, without authentication, until you revoke it.

## Retention

Search Console performance data is fetched from Google on demand, cached for up to 6 hours, and never stored in the app's database.

Account data while the account is active; cached Search Console data up to 6 hours; audit logs 90 days; database backups up to 30 days after deletion; PostHog replays 30 days; Stripe records per Stripe's policy. Account deletion cascades through the Search Console connection and property list, classifications, team memberships, share links, and account details.

## Your rights

Access, correction, deletion, and portability. Logged-in users can self-serve: `GET /api/privacy/access` exports data as JSON; `POST /api/privacy/delete` (with the confirmation from Account & Data settings) deletes it. Other requests: support@serql.io.

## Children

The service is for businesses and professionals and is not directed at children under 13.

## Changes and contact

Material changes are announced on the policy page with an updated date. Questions: support@serql.io.