SerpSidekick is operated by Andrius Butkevicius, self-employed and registered in Lithuania, who is the controller of the personal data described here. This policy covers serpsidekick.com and the MCP server at https://serpsidekick.com/mcp. The way to reach the operator is support@serpsidekick.com. It is written to be read rather than to be defensible, so if something here is unclear, mail that address and it will be fixed.

What we collect

• Your Google account identity. Email address, display name, and Google's stable account identifier. This is what an account is; we have no password and no separate signup form.
• A session. One opaque cookie so you stay signed in to the dashboard.
• An analytics cookie. A first-party PostHog cookie that gives your browser a stable id, so we can see how a visit becomes an account. It honours your browser's Do Not Track setting, and signing out clears the link to your account.
• Advertising cookies. X's conversion pixel sets its own cookies so X can measure our ads. If you arrive from an X ad, we also keep its click id in a first-party twclid cookie for 30 days, so a later sign-up or top-up can be matched to that ad.
• Search Console credentials, if you connect them. The refresh and access tokens Google issues, stored encrypted with a key we hold separately from the database.
• Usage history. One row per tool call: which tool, when, whether it succeeded, what it cost, and which provider endpoints it hit. This is what the usage list on your dashboard is reading, and it is how a charge can be explained.
• A credit ledger. Every top-up, charge and refund, as amounts in credits with the order or usage row that caused them.
• Server logs. Request metadata including IP address, kept briefly for debugging and abuse handling.

We run product analytics and session recordings through PostHog on every page of this site, including the dashboard, and record account-level events on the service: signing up, connecting a client or Search Console, each tool call and what it cost, and each top-up. Every input is masked in recordings, and on the dashboard your email, balance and usage are masked too. We use X's conversion pixel on every page to measure our ads on X, which tells X which pages you visit. When you sign up or top up, we tell X that it happened, identified by a one-way hash of your email address and, if you came from an X ad, its click id. We do not sell anything, and we do not share anything with anyone not named below.

Google permissions, precisely

Two separate consents, asked at two different moments.

• openid, email and profile, at sign-in. Your email address and name, so we know whose account and whose credits these are.
• https://www.googleapis.com/auth/webmasters.readonly, only when you choose to connect Search Console from your dashboard. Read-only. We can read your search performance, index status and property list. We cannot submit sitemaps, request indexing, change settings or modify anything about your site.

Limited Use. SerpSidekick's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Search Console data is used only to answer the questions you ask through the tools, is never used for advertising, is never sold or transferred to third parties, is not used to train any machine-learning model, and is not read by a human except with your explicit permission for support you have asked for.

Your Search Console data is never sent to our paid data provider. When you ask a paid question, the provider receives only the keyword, domain or URL in the question.

Who else processes your data

Five, and here is what each one actually receives. Nothing else has access to any of it.

• Cloudflare — Hosting, database and edge network. Everything stored by the service: your account record, session, encrypted Search Console tokens, credit ledger and usage history. Also request metadata such as IP address, in logs retained for a short period.
• Google — Sign-in and Search Console data. Your sign-in is a Google OAuth flow, so Google knows you authorised this application. Search Console queries are made against Google's API with your own read-only grant.
• DataForSEO — Paid SEO data provider. The query you asked about — keywords, domains or URLs — sent under our master account. It does not receive your identity, your email address or your Search Console data.
• Polar — Payments, as merchant of record. Your email address, the amount paid, and the payment details you enter on their checkout. Card numbers never reach us.
• PostHog — Product analytics, EU region. Your account id, email address and name; which pages you viewed and what you clicked, including a recording of how the page moved under your cursor, with anything you type masked; which tools you called and what they cost; and whether you topped up. It never receives your queries — the keywords, domains or URLs you ask about — your Search Console data, or your IP address, which is discarded on arrival.
• X — Advertising measurement. Which pages you visit on this site, through its pixel and cookies. When you sign up or top up: that it happened, a SHA-256 hash of your email address, the amount of a top-up, and the ad click id if you came from an X ad. Never your queries, your Search Console data, or your IP address from our servers.

Some of these process data outside the EU. Those transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses, whichever the provider has in place.

How long we keep it

• Search Console tokens: until you disconnect that Google account, at which point the stored credential is deleted.
• Usage history and the credit ledger: for as long as the account exists. These are the records that explain a charge, so they cannot be pruned while a balance exists.
• Sessions: until they expire or you sign out.
• Server logs: days, not months.

Deleting your data

Disconnecting a Google account from your dashboard deletes its stored credential immediately. To delete the whole account, mail support@serpsidekick.com from the address you signed in with; the account, its sessions and its Search Console credentials are removed, and so is the person PostHog holds for it, with its events and recordings. Payment records held by Polar as merchant of record are subject to their own retention obligations and are outside our control.

You can also revoke our Search Console access from your Google account's permissions page at any time, without telling us. Nothing breaks except the tools that needed it, which will say so.

Your rights

Wherever you are, you can ask to access, correct, export, restrict or delete your personal data, and object to how it is processed. Mail support@serpsidekick.com from the address you signed in with and expect a reply from a person within a month. If the answer does not satisfy you, you can complain to the data protection authority where you live. The legal bases we rely on are performing the contract you entered by using the service, your consent for Search Console access, and our legitimate interest in keeping the service working and unabused.

Children

The service is not intended for anyone under 16 and we do not knowingly hold data about them.

Changes

Material changes will be announced on this page with a new effective date before they take effect. This version is in effect from 9 October 2026.