Privacy Policy

1. Introduction

Serpverse ("we," "us," or "our") operates the Serpverse marketplace platform (the "Service"), accessible at https://serpverse.io(opens in new tab). This Privacy Policy describes how we collect, use, disclose, retain, and protect your personal information when you access or use our website, applications, and services.

This Privacy Policy applies to all users of the Service, including Buyers, Publishers, and visitors, and is incorporated into our Terms of Service. By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. Where we rely on your consent as a legal basis for processing, you may withdraw that consent at any time as described in Section 9 (Your Privacy Rights).

Data Controller: Serpverse is the data controller responsible for processing your personal data as described in this Privacy Policy.

2. Information We Collect

We collect information that you provide directly, information collected automatically through your use of the Service, and information received from third-party sources.

Information You Provide Directly

Account Information

• Name, email address, and profile picture provided through your sign-in provider (Google or Microsoft), or your email address when you sign in with an email link
• Display name that you choose during onboarding
• Optional biographical information (up to 500 characters)
• Your selected role on the Platform (Buyer or Publisher)
• Your acceptance of the Terms of Service and this Privacy Policy, recorded with the version accepted, the date, your IP address, and your browser's user-agent string

Publisher Website Information

• Website URL, domain name, and site name
• Website description and categories
• Content guidelines, accepted content types and niches, and editorial policies
• Pricing, estimated turnaround time, guarantee terms, and sample post URLs
• Supported languages, minimum word count, and maximum links allowed

Order and Transaction Information

• Content requirements: content type, word count, anchor text, target URLs, and special instructions
• Content submissions: article titles and body text
• Order reviews: ratings (1 to 5) and optional written comments (up to 200 characters)

Communications

• Messages exchanged with other users through the Platform's in-app messaging system, and file attachments shared in conversations
• Support tickets and their messages
• Contact form submissions (name, email, subject, message)
• Reports you file about order content or disputes you open, including the reason and description you provide

Information Collected Automatically

When you access or use the Service, we automatically collect certain technical information that the Service needs to operate securely:

• IP address and browser user-agent string — recorded with sign-ins, security-relevant account actions (such as accepting the Terms or switching roles), and our internal activity records described below
• Timestamps of access and actions — when you sign in, place orders, send messages, and take other actions
• Activity records (audit logs) — the Platform keeps internal, access-restricted records of significant account, order, financial, and moderation actions, including who performed the action, what changed, and the IP address and user-agent of the request. These records exist for security, fraud prevention, dispute resolution, and financial compliance.
• Rate-limiting counters — short-lived counters keyed to your user ID, your IP address, or (for sign-in emails) your email address, used to throttle abusive request patterns

Additional usage analytics — such as pages visited, session duration, device type, and approximate region — are collected only by the optional analytics services described in Section 7 (Cookies and Similar Technologies), and only if you consent to analytics.

Information from Third Parties

• Sign-in providers (Google, Microsoft): When you sign in using Google or Microsoft, these providers share your name, email address, profile picture, and email verification status with us. We do not receive your passwords.
• Stripe (payment processor): Stripe shares limited transaction information with us, including transaction amounts, payment and payout statuses, and related identifiers necessary for order tracking and balance management. To prevent abuse of promotional offers, Stripe also provides a card fingerprint — a non-reversible identifier that stays consistent for the same payment card without revealing the card number — which we store and use to detect when a single card is used to claim a first-order referral discount across multiple accounts (see Section 12, Automated Decision-Making).

Information We Do Not Collect

We do not directly collect, store, or process:

• Credit card numbers, CVVs, or full bank account details — payment details are entered on Stripe's hosted pages and held exclusively by Stripe, which is PCI DSS Level 1 compliant
• Government-issued identification or tax identification numbers — where required for Publisher payouts, these are collected and held by Stripe as part of Stripe Connect onboarding, not by us
• Biometric data, health information, or genetic data
• Racial or ethnic origin, political opinions, religious beliefs, or trade union membership

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom (UK), or another jurisdiction that requires a legal basis for processing personal data, we process your information on the following grounds:

Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms. You may contact us to request details of this assessment.

4. How We Use Your Information

Service Delivery and Operations

• Create and manage your account, authenticate your identity, and maintain your session
• Facilitate marketplace transactions between Buyers and Publishers, including order processing, escrow management, and payout disbursement
• Display Publisher listings with relevant website details and metrics to enable marketplace browsing and order placement
• Track order status and manage content workflows, revision requests, deadlines, disputes, and moderation reviews
• Enable in-platform messaging and file sharing between transaction parties
• Attribute referrals and apply referral discounts (see Section 12 for the associated automated checks)

Communication

• Send in-app notifications and transactional emails related to your orders, payments, account, support tickets, and messages — you can control which notification types also send email through your notification preferences
• Respond to your support requests, contact form submissions, and inquiries
• Send service-related announcements, including updates to our Terms of Service and this Privacy Policy

Security, Fraud Prevention, and Compliance

• Detect, investigate, and prevent fraudulent transactions, promotional abuse, and unauthorized access
• Enforce our Terms of Service and protect the rights, property, and safety of our users and the Platform
• Apply rate limiting and monitor for suspicious activity
• Maintain the activity records described in Section 2 for security, financial compliance, and dispute resolution
• Diagnose errors and performance: when something goes wrong in the application, technical details of the error may be reported to our error-monitoring service so we can fix it, and a small sample of visits reports page-timing data (see Section 5)

Platform Improvement

We use aggregated data — and, where you consent, the analytics services in Section 7 — to understand how the Service is used, identify areas for improvement, and develop new features.

Legal Compliance

We may process your information as necessary to comply with applicable legal obligations, including financial reporting, tax compliance, and responding to valid legal process such as subpoenas, court orders, or regulatory investigations.

5. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We share your information only in the following circumstances:

Between Platform Users

Limited information is shared between Buyers and Publishers as part of a transaction, always through your display name rather than your real identity — see Section 6 (What Other Users See) for exactly what a counterparty can and cannot see.

Service Providers and Data Processors

We share information with third-party service providers who process data on our behalf. These providers are permitted to use your information only as necessary to provide their services to us.

Legal and Compliance Disclosures

We may disclose your information if required or permitted by law, regulation, legal process, or governmental request, including in response to subpoenas, court orders, or regulatory investigations. We may also disclose information when we believe in good faith that disclosure is necessary to: (a) protect our rights, property, or safety; (b) protect the safety of our users or the public; (c) detect, prevent, or address fraud, security issues, or technical problems; or (d) comply with applicable law.

Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service before your personal information becomes subject to a different privacy policy.

6. What Other Users See

Serpverse is designed so that you transact under a chosen display name rather than your real identity:

• Other users see your display name and a generated initial avatar. Your real name, email address, and profile photo are never shown to other users — not in the marketplace, in orders, in messages, or in support conversations.
• Buyers and Publishers see each other's transaction details. A Publisher sees the Buyer's order requirements and submitted content; a Buyer sees the Publisher's listing details and content submissions. Draft content that has not yet been submitted for review is visible only to its author.
• Serpverse personnel can see more. Platform administrators can view your real name, email address, profile photo, role, account status, and account records as needed for moderation, support, trust-and-safety, and dispute resolution. Administrators can also view order conversations and order activity — for example, when resolving a dispute or reviewing reported content.
• Reports are confidential. If you report an order's content or open a dispute, your report and its details are visible to administrators, and the other party is not told who reported.

7. Cookies and Similar Technologies

We use cookies and similar browser-storage technologies to operate the Service, keep you signed in, remember your preferences, and — only with your consent — measure how the Service is used.

Cookies We Set

Over secure connections, the sign-in cookies carry browser security prefixes (for example __Secure-authjs.session-token), and all are set with protective attributes.

Browser Storage We Use

The Service also stores minor interface state in your browser's local or session storage — for example, marketplace filter preferences, dismissed interface tips, and unsaved order-form drafts. These entries stay in your browser and are not sent to our servers.

Optional Analytics (Consent Required)

If — and only if — you consent to analytics via the cookie banner, the following third-party services are loaded. No analytics scripts load before you consent, and none load if you decline:

Google Analytics (GA4) — operated by Google LLC. Collects usage data such as pages visited, session duration, device type, and approximate region, and sets cookies (for example _ga). We enable IP anonymisation. See Google's Privacy Policy(opens in new tab).

Microsoft Clarity — operated by Microsoft Corporation. Records anonymised session interactions and generates heatmaps to help us improve usability, and sets cookies (for example _clck, _clsk). See Microsoft's Privacy Statement(opens in new tab).

We do not use advertising cookies, advertising pixels, or ad networks, and we do not serve targeted advertising. The consent banner's "marketing" category is reserved and not currently used.

Separately from the consent banner, our error and performance monitoring (Section 5) runs to detect application errors and measure page timing on a small sample of visits. It is used for diagnostics, not marketing or cross-site tracking.

Managing Your Choice

The consent banner appears on your first visit. Your choice is stored in your browser's local storage under cookie-consent; to make the banner reappear and change your choice, clear that entry from local storage or use a private/incognito window. Most browsers also let you control or delete cookies through their settings — but blocking the essential cookies above will prevent sign-in and other core features from working.

Do Not Track

Serpverse does not currently respond to "Do Not Track" (DNT) browser signals, as there is no universally accepted standard for interpreting them. We will update this policy if a standard is established and we adopt a responsive approach.

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Our retention approach:

When personal data is no longer needed for any legitimate purpose, we delete or irreversibly anonymize it. Where a deletion request conflicts with a legal retention obligation (for example, financial transaction records) or with records needed to evidence contract acceptance or prevent fraud, we retain only the minimum data necessary for that purpose and restrict all other processing of it.

9. Your Privacy Rights

Rights for All Users

Regardless of your location, we provide the following rights with respect to your personal data:

• Right of Access: You may request a copy of the personal data we hold about you. We will provide it in a commonly used, machine-readable format.
• Right to Correction: You may request correction of inaccurate or incomplete personal data. You can update much of your account information directly through your profile settings.
• Right to Deletion: You may request the deletion of your personal data, subject to the retention exceptions described in Section 8.
• Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format, or that we transmit it to another controller where technically feasible.
• Right to Withdraw Consent: Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

Additional Rights for EEA and UK Residents (GDPR)

If you are located in the European Economic Area or the United Kingdom, you additionally have:

• Right to Restrict Processing: You may request that we restrict processing in certain circumstances, such as while we verify contested data or assess a legitimate-interest objection.
• Right to Object: You may object to processing based on our legitimate interests. We will cease that processing unless we demonstrate compelling legitimate grounds that override your rights.
• Right to Lodge a Complaint: You may lodge a complaint with your local data protection supervisory authority.

California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know the categories and specific pieces of personal information we collect, the sources, purposes, and the categories of third parties we share it with; the right to delete and to correct, subject to legal exceptions; and the right to opt out of sale or sharing — we do not sell your personal information and do not share it for cross-context behavioral advertising.

Categories collected (CCPA), in the preceding 12 months:

• Identifiers: name, email address, account identifiers, IP address
• Commercial information: transaction records, order history, account balance
• Internet activity: the technical and activity records described in Section 2; analytics data only if you consented under Section 7
• Geolocation data: approximate location derived from IP address
• Professional information: website ownership details and categories (Publishers)

We have not sold personal information in the preceding twelve (12) months.

How to Exercise Your Rights

To exercise any of these rights, please contact us. We will respond within the timeframes required by applicable law (generally within thirty (30) days). We may need to verify your identity before processing your request. You may designate an authorized agent to submit requests on your behalf, subject to verification.

10. Data Security

We implement technical and organizational measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption in transit: all connections to the Service use TLS/SSL, with HTTP Strict Transport Security (HSTS)
• Access controls: role-based access restricts internal access to personal data; cross-user requests return only the public identity fields described in Section 6
• Session security: encrypted, httpOnly session cookies with a 30-day maximum lifetime and periodic revalidation of account status
• Security headers: Content Security Policy and related browser protections are enforced on every response
• Rate limiting: tiered limits on all API endpoints, strictest on authentication and financial endpoints
• Payment isolation: card details are entered on and held by Stripe; webhook messages from Stripe are cryptographically verified
• Auditability: security-relevant actions are recorded in access-restricted activity records

No method of transmission or storage is completely secure; we cannot guarantee absolute security, but we are committed to maintaining appropriate safeguards and addressing security incidents promptly.

Data Breach Notification: In the event of a confirmed data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and relevant supervisory authorities within seventy-two (72) hours of becoming aware of the breach, as required by GDPR Article 33 and applicable data protection laws.

11. International Data Transfers

Your personal information may be transferred to, stored in, and processed in the United Kingdom and other countries where we or our service providers operate. These countries may have data protection laws that differ from those of your jurisdiction.

When we transfer personal data from the EEA, UK, or Switzerland to countries that have not been deemed to provide an adequate level of protection, we implement appropriate safeguards, including:

• Relying on adequacy decisions issued by the European Commission or the UK Secretary of State where applicable
• Implementing Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to countries without an adequacy decision
• Ensuring third-party providers processing your data are bound by data processing agreements with equivalent protections

You may contact us to request information about the specific transfer mechanisms in place for your data.

12. Automated Decision-Making

The Service uses certain automated processes that may affect your use of the Platform:

• Rate limiting: automated throttling of requests based on your user ID, IP address, or email address, to prevent abuse and ensure fair access.
• Account status enforcement: your account status (active, suspended, or banned) is checked automatically during each session to enforce access restrictions.
• Order auto-completion: if a Buyer does not act within the applicable review window, the order item is automatically approved and payment released, as described in the Terms of Service.
• Earnings hold and release: Publisher earnings are automatically held after order completion and automatically released when the hold period expires.
• Referral discount checks: eligibility for the first-order referral discount is determined automatically, including a check that associates payment-card fingerprints across accounts to prevent the same card from claiming the discount more than once. If this check disqualifies a discount, you are told at checkout that the discount is unavailable on your current payment method.

These automated processes are essential to the operation of the Service. If you believe an automated decision has significantly and adversely affected you, you may contact us to request review by a human. We do not use automated profiling to make decisions that produce legal effects or similarly significant effects on you.

13. Third-Party Links and Services

The Service contains links to third-party websites, including Publisher websites listed in the marketplace, payment processor interfaces, and sign-in provider pages. These are independent entities with their own privacy policies and practices. Serpverse is not responsible for the privacy practices, content, or security of any third-party website or service.

Publisher websites listed on the marketplace are operated independently by their owners. Content published on Publisher websites is subject to the Publisher's own terms and privacy practices, not this Privacy Policy.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. This Privacy Policy is versioned, and the current effective date is shown at the top of this page. You accept this Privacy Policy together with the Terms of Service in a single confirmation, both at onboarding and whenever re-acceptance of updated terms is required.

For material changes that significantly affect how we collect, use, or share your personal data, we will provide at least thirty (30) days' advance notice through one or more of: email to your registered address, a prominent notice within the Service, or an in-app notification. If you do not agree with the updated Privacy Policy, you should discontinue use of the Service and may contact us to request deletion of your data.

15. Children's Privacy

The Service is a business marketplace and requires all users to be at least eighteen (18) years of age (or the age of majority in their jurisdiction, if greater), as set out in our Terms of Service. The Service is not directed at children, and we do not knowingly collect personal information from anyone under eighteen (18).

If we become aware that we have collected personal data from a minor, we will take prompt steps to delete it. If you are a parent or guardian and believe your child has provided personal information to us, please contact us.

16. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Serpverse

Contact form: serpverse.io/contact

Website: serpverse.io(opens in new tab)

We will make every effort to respond within a reasonable timeframe, generally within thirty (30) days. If you are located in the European Economic Area or the United Kingdom and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection supervisory authority.