Privacy policy

1. Scope and responsibility

This policy describes how PirateSERP handles personal information in its software as a service (SaaS) application, public pages, account services, and affiliate program. PirateSERP is responsible for the account and operational information described here. Third-party sites and services you connect have their own privacy policies.

If you submit personal information about clients or other people, you are responsible for having authority and a lawful basis to do so. Contact us before using the service for regulated sensitive information or if your organization requires a separate data-processing agreement.

2. Information we collect

• Accounts and communications: email address, account identifiers, authentication and verification records, optional display name, bio and social links, and information you send us for support.
• Contact form: the name, email address, topic, and message you enter on the Contact page. The form sends them to PirateSERP by email.
• Workspace content: project domains, URLs, keywords, website and business information, research, audit and ranking results, connected analytics data, prompts, drafts, generated output, and content you save or publish.
• Connected credentials: API keys, service-account credentials, Google account refresh tokens you authorize for Web Analytics, Google Ads refresh tokens you authorize for Google Ads Audit (one for each project), their provider labels, and related configuration. These credentials can grant access to your third-party accounts.
• Billing: Stripe customer and subscription identifiers, invoice and payment records, amounts, currency, status, dates, and refund or dispute information. Stripe collects payment details directly; we do not store full card numbers or card security codes.
• Affiliates and access grants: referral codes and account associations, application and approval status, accepted program version, commission and adjustment records, payment contact or provider reference, payout records, and lifetime deal (LTD) invitation and redemption records.
• Activity and security: page paths, referral source, timestamps, browser and operating-system information, device and visit identifiers, sign-in and session records, and diagnostic or administrative logs. Our servers receive IP addresses when you connect. We store IP addresses and browser user agents with sign-in, session, and security records, including records of blocked addresses. Visit statistics store an approximate location (city, country, and map coordinates) derived from your IP address. Activity may be associated with your signed-in account.

We obtain information from you, your browser and activity, the services you connect or request data from, and payment and email providers. Research tools also process public website and business information relevant to your requests.

3. Why we use information

We use information to create and secure accounts; run your projects, integrations, and scheduled tools; save and display results; process billing and refunds; administer referrals and payouts; deliver service messages; provide support; understand usage and troubleshoot problems; prevent abuse; and comply with legal obligations.

Where European or UK data-protection law applies, our legal basis depends on the activity: providing a requested service under a contract, legitimate interests such as security and service administration, legal obligations, or consent where required. You may contact us to object to processing based on legitimate interests or withdraw consent without affecting prior lawful processing.

4. AI, integrations, and service providers

Using a connected feature sends the information necessary for that request to the relevant provider. For example, prompts and selected content may go to OpenRouter and the model provider it routes to. Content Alignment sends the page text it compares to Google Gemini. Web Analytics questions send your question and selected aggregate report metrics to OpenRouter and its model provider. Google Ads Audit sends findings from your Google Ads account, such as spend, search terms, and keywords, and the business details you enter to OpenRouter and its model provider to write the audit summary, action plan, ad copy, and negative keyword review. Search and keyword requests may go to DataForSEO. Authorized property, query, account, or business information may go to Google Search Console, Google Analytics 4 (GA4), Google Ads, Google Maps (Places API), or Bing Webmaster Tools. The actual provider depends on the tool and configuration you choose.

The maps in Business Search and GeoPin Generator load map tiles from OpenStreetMap (tile.openstreetmap.org). When you look up a location or address, your browser sends the text you typed to OpenStreetMap's Nominatim geocoding service (nominatim.openstreetmap.org). OpenStreetMap receives your IP address with these requests.

Saved provider secrets are encrypted at rest and decrypted by the server when needed for authorized requests. Encryption does not prevent the destination provider from processing the request. Provider retention, model-training practices, and account settings differ; review those settings before submitting confidential material. We do not promise that every selected AI provider excludes inputs from training.

After you accept the cookie notice, a chat helper appears in the corner of each app page. Bot9 (bot9.ai) runs it. The messages you type into it go to Bot9 so it can answer, and Bot9 keeps the conversation. We don't send Bot9 your name, email address, account details, or project data. Don't type passwords, API keys, or payment details into the chat.

We also use infrastructure, storage, payment, and email services to operate PirateSERP. Stripe processes billing. Our listmonk newsletter system and configured email delivery service process addresses, list membership, message content, and delivery records for customer, newsletter, affiliate, and LTD communications. Authorized staff receive access appropriate to their role, including restricted newsletter access where assigned.

We may disclose information when legally required, to respond to lawful requests, to protect rights and safety, or in a business transfer subject to appropriate privacy protections. We do not sell personal information or share it for cross-context behavioral advertising.

5. Public information and referrals

Your chosen display name and contribution counts may appear on the public Top contributors leaderboard. Published author profiles may include your bio and social links. Content you publish through public features can be read and copied by others. The public visitor globe displays grouped visit counts by city and country, not individual account names. If you are a PirateSERP team member, your profile photo, name, bio, titles, and social links appear publicly on the Meet the team and Contact pages.

When you supply a referral code, we associate the referral with your account to determine eligibility and commissions. This referral flow does not set an affiliate tracking cookie. Affiliates can see their referral count, commission history, and payout history; the affiliate dashboard does not list referred customers' email addresses or saved project content.

6. Cookies, local storage, and visitor statistics

We use browser storage for sign-in, session and device security, interface preferences, and the cookie notice choice. A persistent device identifier supports device security. If you accept analytics, that identifier and a tab-session identifier also support first-party visitor statistics. These statistics record visited page paths, referral source, browser and operating system, and approximate IP-based location; signed-in visits may be linked to your account.

The cookie notice lets you choose whether to enable analytics, which covers our first-party visitor statistics and Google Analytics, and the chat helper described above. You can accept both, reject both, or choose each one in Cookie settings. Until you accept analytics, the app sends no visitor statistics. The Google tag loads on every page with analytics storage denied, so it sets no analytics cookies until you accept. In the app, rejecting analytics also stops analytics page views; on the documentation and blog pages, Google may still receive cookieless page-view signals without an identifier. You can change or withdraw either choice at any time from Cookie settings, in the footer of the home and pricing pages, on these policy pages, and in Account Settings. Withdrawing analytics stops visitor statistics and changes Google Analytics storage consent back to denied. The chat helper loads only after you accept. If you reject, its code doesn't load and nothing is sent to Bot9. If you withdraw it later, the page reloads without it. After you accept, it stores a random visitor identifier and conversation identifier in your browser's local storage so a chat can continue across pages. Browser settings let you clear or restrict local storage and cookies, although doing so may affect sign-in and does not necessarily stop server-side processing of new requests.

We do not use cross-site advertising trackers in the app. The app doesn't change first-party visitor collection in response to a Do Not Track signal. To ask about or object to activity processing, contact privacy@pirateserp.com. For the privacy rights that may apply to you, see Your choices and privacy rights.

7. Customer emails and newsletters

Account verification adds your address to our customer email list so we can administer customer communications. Newsletter signup is available separately. We send account verification, password reset, billing or service information, and applicable affiliate or LTD messages to support the service.

You can unsubscribe from marketing using the message's unsubscribe link or by contacting us. Necessary account, security, billing, and program-administration messages may still be sent. Unsubscribing from email does not cancel a paid subscription or delete your account.

8. Retention and deletion

We retain account and workspace data while needed to provide the service, and retain other records according to their operational, security, accounting, and legal purposes. Retention depends on the record, the account relationship, outstanding payments or disputes, and applicable obligations; we do not promise one fixed deletion period for every category.

Subscription cancellation stops renewal but does not immediately erase your account or research. Contact us to request access, export assistance, or deletion. Some records, including financial ledgers, payment references, affiliate adjustments, access-grant history, visitor statistics, and evidence needed for security or disputes, may remain when necessary even after an account is deleted. Backups and provider-held records may follow separate retention cycles.

You can remove saved API keys in Account Settings, disconnect a Google account in Web Analytics, and disconnect Google Ads in Google Ads Audit. Disconnecting Web Analytics removes the local Google authorization and attempts to revoke it with Google; you can also review or revoke access in your Google Account. Disconnecting Google Ads deletes the stored Google Ads authorization but doesn't revoke access at Google. To remove that access, remove PirateSERP from the third-party connections in your Google Account. To invalidate an API key or service-account credential itself and stop use outside PirateSERP, revoke it with its provider.

9. Your choices and privacy rights

Depending on your location and which laws apply, you may have rights to know or access information, obtain a portable copy, correct inaccurate information, request deletion, restrict processing, object to certain processing, or withdraw consent. California residents may also have rights concerning sale or sharing and certain uses of sensitive personal information. We use account credentials to provide and secure the requested service, not to infer sensitive characteristics.

To make a request, send email to privacy@pirateserp.com. Include your account email address and what you want us to do, but not passwords, API keys, or full payment details. We may verify your identity or an authorized agent's authority before releasing or changing information. We respond within the time required by applicable law and explain any relevant exception. We do not discriminate for exercising protected rights.

You may also complain to the relevant data-protection authority. You can edit supported profile fields in Account Settings; contact us about information that cannot be changed there.

10. Security and international processing

We use access controls, authentication, encrypted saved provider credentials, and other safeguards designed to protect information. No service or transmission method is completely secure. Notify us if you suspect an account or credential compromise.

PirateSERP and its providers may process information in the United States and other countries whose privacy laws differ from your own. Where legally required, transfers must use an applicable safeguard or other lawful transfer basis. Contact us for information about safeguards relevant to your use; this policy is not itself a separate data-processing or international-transfer agreement.

11. Children and policy changes

PirateSERP is a professional tool and is not directed to children under 13. We do not knowingly collect their personal information. If you believe a child has provided information, contact us so we can investigate and take appropriate action.

We update this policy as our service and practices change, show the revision date, and provide additional notice or seek consent where required by law.