Privacy & refund policy
Privacy policy for Serptoday.
Serptoday operates the www.serptoday.com website.
SerpToday provides search engine optimization tools. We process account information to provide the service, as described in this policy.
By using this website, you agree to the collection and use of information in accordance with this policy. Unless otherwise defined in this Privacy Policy, terms used in this Privacy Policy have the same meanings as in our Terms and Conditions, accessible at www.serptoday.com
Information Collection and Use
While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. Personally identifiable information may include, but is not limited to, your name, phone number, postal address, and other information.
Log Data
We collect information that your browser sends whenever you visit our Service. This Log Data may include information such as your computer’s Internet Protocol address, browser type, browser version, and the pages of our Service that you visit, the time and date of your visit, the time spent on those pages and other statistics.
Cookies
We use “cookies” to collect information. You can instruct your browser to refuse all cookies.
Service Providers.
SerpToday uses service providers to operate features such as email delivery, search-data retrieval, payments and AI analysis. The sections below explain the data use associated with these features and optional Google connections.
Security
The security of your Personal Information is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.
Links to Other Sites
Our Service may contain links to other sites that are not operated by us. External links are provided for reference. Following a link does not by itself improve Google rankings.
Children’s Privacy
Our Service does not address anyone under the age of 13.
We do not knowingly collect personally identifiable information from children under 13. If you are a parent or guardian and you are aware that your Child has provided us with Personal Information, please contact us. If we discover that a Child under 13 has provided us with Personal Information, we will delete such information from our servers immediately.
Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.
You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.
Contact Us
If you have any questions about this Privacy Policy, please contact us by filling out a form at our contact page.
Refund Policy
If you are not satisfied with the service and there is a compelling reason, SerpToday will refund the remaining days of the paid subscription. Refund requests are reviewed by support; cancelling renewal does not automatically issue a refund. Email [email protected] from your registered address with the payment reference and reason. Read the subscription, cancellation and refund terms for the request process. Applicable mandatory consumer rights are not limited by this policy.
We use registered account information to provide and support your account. We do not sell it; service-provider processing is explained in this policy.
Country at registration
When an account is created, we store the approximate country of its internet connection. This is estimated locally using an IP-to-country database and helps us understand which countries our customers come from. This feature does not store an additional copy of your IP address or send it to a geolocation API. The country may reflect a VPN or proxy rather than your physical location, and is separate from your project’s search market. You can contact [email protected] to correct this information or request account data deletion.
IP Geolocation by DB-IP (country data, CC BY 4.0).
Account activity
We keep a private, first-party activity log associated with your account for up to 90 days. It records pages and features used, such as AI Analysis, ranking checks, exports, favorites, project changes, and deletion actions, with timestamps and related project or keyword identifiers. Authorized site administrators use this information for support, reliability, and product improvement. This log does not record passwords, payment details, typed form contents, or activity on other websites, and is not sent to third-party analytics. Contact [email protected] about your account data.
Keyword preview usage
When you use the keyword preview before signing up, we use its existing session cookie to count preview sessions and record the submitted website domain, suggestion and signup stages, timestamps, and whether the session led to a new account or an existing-account login. Private records are kept for up to 90 days after the last recorded activity and are visible only to authorized administrators. Repeated requests in the same preview session do not count as additional visitors. This log does not store your typed keywords, website description, IP address, or password and is not sent to third-party analytics.
Free website preview limit
The free keyword preview is limited to one website per browser before registration. Its existing essential preview cookie and a server record of the first website enforce this limit for up to 90 days. Saved keyword drafts expire separately after 24 hours. You can retry the same website or create an account to continue.
Google user data: access, sharing, security and deletion
Updated October 19, 2026. This section applies to SerpToday at serptoday.com and its optional Google Search Console connection.
What we access and why
If you choose Continue with Google, we use your verified email address, name and Google account identifier to create, link and authenticate your SerpToday account. These account details remain while your account exists and are covered by the account-deletion process below. Google sign-in is separate from the optional Search Console connection.
When you connect Google Search Console, we request https://www.googleapis.com/auth/webmasters.readonly. We read the properties your Google account can access, the selected property, search queries and page URLs, and aggregate clicks, impressions, click-through rate and average position by date, country and device. We use this information to import keywords you choose, display Search Console reports, compare periods, identify opportunities and provide requested SEO recommendations. We do not edit your Search Console settings or website. This connection does not provide access to Gmail messages, Google Drive files or individual visitor records.
With whom we share, transfer or disclose Google user data
- Google: authorization credentials and API requests are exchanged with Google to connect your account and retrieve the data you authorize.
- Hosting and infrastructure providers: the providers operating SerpToday’s servers, database and network process stored or transmitted data to deliver and protect the service. Authorized SerpToday personnel may access account data where needed for support, security and service operation.
- OpenAI: only when you separately enable Google data for AI Analysis and request an analysis, relevant Search Console queries, page URLs and aggregate metrics may be sent to OpenAI with the page evidence to produce your requested report. Connecting Google alone does not enable this sharing. We do not send Google OAuth tokens, passwords or individual visitor records to OpenAI.
- Search-data and email providers: if you choose to add imported queries as tracked keywords, those keywords become part of your project. Keywords, public domains and URLs may be sent to our search-data providers, including DataForSEO and a third-party keyword and backlink provider, to provide the ranking checks or diagnostics you request. Account emails are processed by our email delivery provider using your registered email address. Enabled ranking emails may also include those keywords and their ranks. These providers do not receive your Google OAuth credentials or your full Search Console account.
We do not sell Google user data, disclose it to advertising networks, use it for targeted advertising, or use it to develop or train generalized AI or machine-learning models. Google user data is used for the user-facing features described above. We may disclose data where required by applicable law. SerpToday’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How we protect sensitive data
SerpToday uses HTTPS for browser connections and Google API requests. Stored Search Console refresh tokens are encrypted using AES-256-GCM. Google connection requests use OAuth state validation and PKCE, and are tied to the signed-in account and session. Server-side ownership checks restrict project and Search Console data to the relevant account. OAuth credentials are kept server-side and are not included in public pages or AI prompts. These protections do not mean that every stored report is encrypted at rest, and no system can guarantee absolute security.
How long we retain data and how to delete it
We retain the encrypted refresh token while your Search Console connection is active so that authorized reports can refresh without repeated sign-in. Cached property selections and Search Console performance data remain associated with your account and project until refreshed, disconnected or deleted. Refreshing replaces the cached report; a cache refresh interval is not an automatic deletion deadline.
Use Disconnect in the project’s Search Console connection to remove the local refresh token, cached Search Console data, saved property selections and Search Console AI opt-in. This stops future retrieval through that connection. You can also revoke Google access in your Google Account permissions. Revoking access at Google stops authorization but does not itself delete reports already saved in SerpToday.
Keywords you explicitly imported, ranking history and previously generated AI reports remain in your project after disconnecting. Delete the related keyword or project to remove its saved records, or use Settings → Account → Delete my account to delete your account and retained Google-derived data. Account deletion requires a confirmation code sent to your registered email address. Any data that must be retained to comply with a legal obligation is retained only for that purpose and for as long as required.
Google Analytics account connections are no longer offered and no new connected Analytics data is retrieved. Historical reports may retain previously collected metrics until the related records are deleted. You can request deletion through the same support address. This retired integration is separate from analytics used to measure visits to the SerpToday website.
Retired Analytics integration
Google Analytics connections are no longer offered and no new Analytics data is retrieved. Previously saved reports may contain historical metrics. You can revoke previously granted access in your Google Account permissions or contact [email protected] about stored data.
Optional Google data in AI analysis
Connecting Google does not automatically share its data with AI. With your separate project permission, relevant aggregate Google metrics may be sent to OpenAI together with public page evidence when you request an on-page analysis. This provides recommendations for that project. OAuth tokens, passwords and individual visitor records are not sent to OpenAI. The resulting report stores a snapshot in your account; previously saved reports remain until the related keyword or project is deleted. Contact [email protected] to request deletion of your account data or saved reports.
Google data is used only to provide these user-facing reports and features. We do not sell Google user data, use it for advertising, or use it to train generalized AI or machine-learning models. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Backlink diagnostics
When you request a How to Improve Rankings report, we send the public landing-page URL, project domain and saved competitor domains to our third-party backlink provider for backlink measurements. Bounded samples are cached for up to 24 hours and saved with your report. Public backlink evidence may be sent to OpenAI to suggest specific verification and repair steps. No Google credentials or individual visitor records are sent to that provider.
Page speed diagnostics
Public page URLs are sent to Google PageSpeed Insights and, when configured, CrUX for speed diagnostics. These diagnostics are separate from your optional Search Console connection.