Legal

Privacy Policy

Effective
5th October 2026
Version
4

1. Introduction

Serpverse ("we," "us," or "our") operates the Serpverse marketplace platform (the "Service"), accessible at https://serpverse.io(opens in new tab). This Privacy Policy describes how we collect, use, disclose, retain, and protect your personal information when you access or use our website, applications, and services.

This Privacy Policy applies to all users of the Service, including Buyers, Publishers, Affiliates, and visitors, and is incorporated into our Terms of Service and, for Affiliates, into the Affiliate Agreement. Capitalized terms such as Buyer, Publisher, Affiliate, Listing, Order, and Payout have the meanings given to them in our Terms of Service or the Affiliate Agreement. By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. Where we rely on your consent as a legal basis for processing, you may withdraw that consent at any time as described in Section 9 (Your Privacy Rights).

Data Controller: Serpverse is the data controller responsible for processing your personal data as described in this Privacy Policy.

2. Information We Collect

We collect information that you provide directly, information collected automatically through your use of the Service, and information received from third-party sources.

Information You Provide Directly

Account Information

  • Name, email address, and profile picture provided through your sign-in provider (Google or Microsoft), or your email address when you sign in with an email link
  • Display name that you choose during onboarding, and any later changes to it
  • Your full name as you edit it in your settings, and optional biographical information (up to 500 characters)
  • Your selected role on the Platform (Buyer or Publisher)
  • Your notification preferences
  • Your acceptance of the Terms of Service and this Privacy Policy — and, if you join the Affiliate Program, of the Affiliate Agreement — recorded with the version accepted, the date, your IP address, and your browser's user-agent string
  • While the Affiliate Program is running, any referral code you enter, and your answer to the optional question "How did you hear about Serpverse?" (up to 200 characters), which we keep whether or not it matches an Affiliate

Publisher Website Information

  • Website URL, domain name, and site name
  • Website description and categories
  • Content guidelines, accepted content types and niches, and editorial policies
  • Pricing, estimated turnaround time, guarantee terms, and sample post URLs
  • Supported languages, minimum word count, maximum links allowed, target country, keywords, and the Listing's visibility setting
  • Ownership verification details: the method you used, the evidence we recorded (such as the email address of the Google account you connected, or a note that your account's email address matches the domain), and any request we sent you to verify ownership

Order and Transaction Information

  • Content requirements: content type, word count, anchor text, target URLs, and special instructions
  • Content submissions: article titles and body text
  • Order reviews: ratings (1 to 5) and optional written comments (up to 200 characters)
  • Campaigns: the names, descriptions, and target URLs you use to group your Orders

Payout Information

  • The PayPal address you add for PayPal withdrawals and Affiliate Payouts, when it was last changed, and the address copied onto each PayPal withdrawal request
  • The payout country you select for bank payouts through Stripe
  • If you are an Affiliate, your payout method, your Payoneer email address if you choose Payoneer, and — if you choose bank transfer — the bank details you send us by email

Affiliate Information

  • If you are invited to the Affiliate Program, a short note our staff write to identify who the invitation is for, such as your name and where you publish
  • If you join, your code, your commission rate, and the records of your commission and Payouts
  • Before your first Payout, a record that we searched the UK Sanctions List (and any other sanctions list that applies to us) and of its result, and whether you are a United States person for tax purposes; if you are, the IRS Form W-9 you give us, which includes your taxpayer identification number and which we keep outside the Service
  • Any other information we ask you for to meet our legal obligations, such as information about your identity

Communications

  • Messages exchanged with other users through the Platform's in-app messaging system
  • Support tickets and their messages
  • Contact form submissions (name, email address, subject, and message), which are forwarded to our support mailbox, or to our partnerships mailbox for partnership enquiries; and requests to join the Affiliate Program made on its page (name, email address, the website or channel where you would promote Serpverse, and message), which are forwarded to our partnerships mailbox. For each, the Platform itself keeps a record of the name, email address, and subject, with the IP address and browser user-agent it was sent from, as part of our activity records
  • Feedback you send from your dashboard, including its category, priority, subject, and description, the page you sent it from, and your browser
  • Reports you file about order content or disputes you open, including the reason and description you provide

Free Tools

  • If you use our backlink checker, the page address and domain you enter are sent to our servers, which fetch that page to check its links. We don't store what you enter, beyond the short-lived rate-limiting counter keyed to your IP address. The disavow file generator runs entirely in your browser and sends us nothing.

Information Collected Automatically

When you access or use the Service, we automatically collect certain technical information that the Service needs to operate securely:

  • IP address and browser user-agent string — recorded with sign-ins, security-relevant account actions (such as accepting the Terms or switching roles), and our internal activity records described below
  • Timestamps of access and actions — when you sign in, place orders, send messages, and take other actions
  • Activity records (audit logs) — the Platform keeps internal, access-restricted records of significant account, order, financial, moderation, and Affiliate Program actions, including who performed the action, what changed, and the IP address and user-agent of the request. These records exist for security, fraud prevention, dispute resolution, and financial compliance.
  • Moderation records — if your account is suspended, banned, or reinstated, a record of the change, the reason we gave you, and any internal note our staff added
  • Rate-limiting counters — short-lived counters keyed to your user ID, your IP address, or (for sign-in emails) your email address, used to throttle abusive request patterns
  • Referral link visits — when someone opens a Publisher's share link or an Affiliate's link, we count the visit. We store daily totals for each link, split by the host name of the referring website, with a separate count of signed-in visits; we don't store the visitor's IP address, user-agent, or the page they came from beyond that host name, apart from the short-lived rate-limiting counter described above, which is keyed to the IP address and kept for up to an hour. To count visits, we read the visit's user-agent, referring page, and IP address and, if the visitor is signed in, their session, so that the link's owner and our staff aren't counted. We may also keep a one-way hash of the link, the IP address, and the user-agent, combined with a random value that changes daily, so that each visitor is counted only once a day; these hashes are deleted about an hour after the day ends. Nothing is written to the visitor's device for this counting.
  • Referral records — if you were referred to Serpverse, who referred you (a Publisher or an Affiliate), how and when, and the discount or saving you received
  • Listing records — for Publishers, each Listing's site metrics and their history, its performance (completed orders, ratings, and completion times), its ranking score, the original text of any guidelines we have edited, and records of our reviews of the Listing, including the reasons we gave you and any internal notes our staff added

Apart from the page addresses, timings, and browser details that our error and performance monitoring records (Section 5), and the referral link visit totals described above, additional usage analytics — such as pages visited, session duration, device type, and approximate region — are collected only by the optional analytics services described in Section 7 (Cookies and Similar Technologies), and only if you consent to analytics.

Information from Third Parties

  • Sign-in providers (Google, Microsoft): When you sign in using Google or Microsoft, these providers share your name, email address, profile picture, and email verification status with us. They also issue sign-in tokens, which we use only to complete your sign-in and do not keep. For Microsoft accounts, we store a small copy of your profile photo. We do not receive your passwords.
  • Google Search Console: If you verify a Listing by connecting Google Search Console, Google shares the email address of the Google account you connect and the list of sites that account can access. We use that list only to check which of your Listings the account owns, and we don't keep it. We keep the email address as verification evidence and, for each of your Listings the account owns, a record that its domain was verified, so that if you list that domain again within ninety (90) days, the new Listing is verified straight away. We don't keep access to your Search Console account.
  • Stripe (payment processor): Stripe shares limited transaction information with us, including transaction amounts, payment and payout statuses, your payout account's country and whether payouts are enabled on it, and related identifiers necessary for order tracking and balance management. For most card deposits, Stripe also provides a card fingerprint — a non-reversible identifier that stays consistent for the same payment card without revealing the card number — which we store and use for the fraud checks described in Section 12 (Automated Decision-Making).
  • PayPal, Payoneer, and Wise: When we pay you through them, we record their transaction reference.
  • Site-metrics providers: For Listings, we receive metrics about the domain, such as Domain Rating from Ahrefs, traffic estimates and backlink data from DataForSEO, and registration dates from domain registries.
  • Your website: For Listings, we read the description and icon your website publishes, and the verification file or DNS record you add to prove ownership.
  • Public sources and our outreach: If we invite you to the Affiliate Program, information you have published about yourself and your channels, and notes of our contact with you. If you are an Affiliate, public posts in which you promote Serpverse.

Information We Do Not Collect

We do not directly collect, store, or process:

  • Credit card numbers or CVVs — payment details are entered on Stripe's hosted pages and held exclusively by Stripe, which is PCI DSS Level 1 compliant
  • Bank account details for Publisher payouts — these are collected and held by Stripe as part of Stripe Connect onboarding. The only bank details we receive are those an Affiliate sends us by email to be paid by bank transfer, which we use to make that payment and keep only in our email records, not in the Service
  • Government-issued identification — where required for Publisher payouts, it is collected and held by Stripe. The only taxpayer identification number we collect is the one on the IRS Form W-9 that an Affiliate who is a United States person gives us, and we ask an Affiliate for identity information only where we need it to meet our legal obligations
  • Biometric data, health information, or genetic data
  • Racial or ethnic origin, political opinions, religious beliefs, or trade union membership

If you are located in the European Economic Area (EEA), the United Kingdom (UK), or another jurisdiction that requires a legal basis for processing personal data, we process your information on the following grounds:

Legal BasisProcessing Activities
Contract PerformanceAccount creation and management, order processing and fulfillment, escrow and payment processing, in-platform messaging, content workflow management, verifying ownership of Listings, Publisher withdrawals (including by PayPal), Publisher share links and the Affiliate Program (recording referrals, applying discounts and savings, and calculating and paying commission), support
Legitimate InterestsFraud detection and prevention (including the payment-card checks in Section 12), security monitoring, rate limiting, activity and moderation records, error monitoring, counting visits to referral links, maintaining Listing information (site metrics, filling blank descriptions, and checking and editing guidelines), ranking Listings and publishing the public catalogue, meeting US tax reporting requirements for payments to Affiliates who are United States persons (collecting IRS Form W-9), enforcing our Terms of Service and the Affiliate Agreement, platform improvement using aggregated data
Legal ObligationFinancial record-keeping and tax compliance, sanctions screening before Affiliate Payouts, responding to lawful requests from law enforcement and regulatory authorities
ConsentOptional analytics cookies and services (Section 7). You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal. We do not send marketing emails.

Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms. You may contact us to request details of this assessment.

4. How We Use Your Information

Service Delivery and Operations

  • Create and manage your account, authenticate your identity, and maintain your session
  • Facilitate marketplace transactions between Buyers and Publishers, including order processing, escrow management, and payout disbursement
  • Display Publisher listings with relevant website details and metrics to enable marketplace browsing and order placement
  • Verify that Publishers control the domains they list, keep site metrics up to date, fill blank Listing descriptions from the website's own description, and check and edit Listing guidelines as described in the Terms of Service
  • Rank Listings, and publish banded Listing information in the public catalogue
  • Track order status and manage content workflows, revision requests, deadlines, disputes, and moderation reviews
  • Enable in-platform messaging between transaction parties
  • Attribute referrals, apply referral discounts and Affiliate savings, count visits to referral links, and show Publishers and Affiliates their referral statistics (see Section 12 for the associated automated checks)
  • Calculate, hold, release, and pay Affiliate commission, and make Publisher withdrawals by PayPal

Communication

  • Send in-app notifications and transactional emails related to your orders, payments, payouts, account, support tickets, and messages — you can control which notification types also send email through your notification preferences, although some, such as alerts about changes to your payout details, can't be switched off
  • Send Affiliates payout notices and monthly summaries
  • Respond to your support requests, contact form submissions, requests to join the Affiliate Program, feedback, and inquiries
  • Send service-related announcements, including updates to our Terms of Service, the Affiliate Agreement, and this Privacy Policy

Security, Fraud Prevention, and Compliance

  • Detect, investigate, and prevent fraudulent transactions, promotional abuse, and unauthorized access
  • Compare payment-card fingerprints across accounts to decide whether a referral discount, Affiliate saving, or Affiliate commission applies, and hold commission for review where we can't check how an account was funded
  • Screen Affiliates against the UK Sanctions List, and any other sanctions list that applies to us, before their first Payout
  • Enforce our Terms of Service and the Affiliate Agreement, and protect the rights, property, and safety of our users and the Platform
  • Apply rate limiting and monitor for suspicious activity
  • Maintain the activity and moderation records described in Section 2 for security, financial compliance, and dispute resolution
  • Diagnose errors and performance: when something goes wrong in the application, technical details of the error may be reported to our error-monitoring service so we can fix it; each page view also sends a small stability record (whether the page loaded without errors, and your browser's user-agent), and a sample of visits reports page-timing data (see Section 5)

Platform Improvement

We use aggregated data — and, where you consent, the analytics services in Section 7 — to understand how the Service is used, identify areas for improvement, and develop new features.

We may process your information as necessary to comply with applicable legal obligations, including financial reporting, tax compliance, and responding to valid legal process such as subpoenas, court orders, or regulatory investigations.

5. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We share your information only in the following circumstances:

Between Platform Users

Limited information is shared between Buyers and Publishers as part of a transaction, and between Affiliates and the Users they refer, always through display names rather than real identities — see Section 6 (What Other Users See) for exactly what other users can and cannot see.

Service Providers and Data Processors

We share information with third-party service providers. Service providers that process data on our behalf may use it only to provide their services to us. Payment and payout providers, sign-in providers, and domain registries also handle your information as independent organizations under their own privacy policies.

ProviderPurposeData Involved
Stripe(opens in new tab)Payment processing, escrow-related deposits and refunds, Publisher payouts via Stripe Connect (including identity verification and tax documentation Stripe collects directly)Payment and payout details (held by Stripe); your email address and name, to create your payment customer record; your email address and payout country, for payout onboarding; transaction amounts and identifiers; payout account status
PayPal(opens in new tab)Publisher withdrawals and Affiliate Payouts by PayPalYour PayPal address and the amount paid
Payoneer(opens in new tab)Affiliate Payouts by PayoneerYour Payoneer email address and the amount paid
Wise(opens in new tab)Affiliate Payouts by bank transferYour bank details and the amount paid
Google(opens in new tab)Sign-in authentication, and Google Search Console connections for Listing ownership verificationAuthentication requests; provides us your name, email, and profile picture and, for Search Console, the email address of the connected Google account and the list of sites it can access
Microsoft(opens in new tab)Sign-in authenticationAuthentication requests; provides us your name, email, and profile picture
Google Analytics(opens in new tab)Optional analytics, only if you consent (Section 7)Usage data such as pages visited, device type, and approximate region
Microsoft Clarity(opens in new tab)Optional analytics, only if you consent (Section 7)How you interact with pages, including session recordings
DeepSeek(opens in new tab)Automated editing of Listing guidelines that conflict with the Listing's settings or direct Buyers off the PlatformA Listing's guideline text and its word-count, link, and turnaround settings — not the domain, the site name, or your identity. Before sending the text, we remove the email addresses, phone numbers, and messaging handles we find in it
Site-metrics providers (currently Ahrefs, DataForSEO, and domain registries, reached through a public lookup service)Site metrics for ListingsThe Listing's domain
Resend(opens in new tab)Transactional email delivery, including sign-in link emails and forwarding contact form messages and Affiliate Program invitation requests to our support and partnerships mailboxesRecipient email address and the rendered content of each email
Namecheap Private Email(opens in new tab)Email hosting: receiving and storing email sent to our support and partnerships mailboxes, including contact form messages, Affiliate Program invitation requests, and the bank details and IRS Forms W-9 that Affiliates send usYour name, email address, and message, and any bank details or tax forms you send
Sentry(opens in new tab)Error and performance monitoring (application errors on our website and servers)The error, stack trace, page address, referring page, and your browser's user-agent; a stability record for each page view; and page-timing data for a sample of visits. Your browser sends these to Sentry directly, so Sentry also receives your IP address
Cloudflare(opens in new tab)Network edge and security in front of the Service, and storage and delivery of article images and site iconsRequest traffic, including your IP address
Hosting and infrastructure providersRunning the application, database, and background jobs (currently Railway), and short-lived storage for rate limiting and referral link visit counting (a managed Redis service)The data described in this policy is stored and processed on this infrastructure

We may disclose your information if required or permitted by law, regulation, legal process, or governmental request, including in response to subpoenas, court orders, or regulatory investigations. We may also disclose information when we believe in good faith that disclosure is necessary to: (a) protect our rights, property, or safety; (b) protect the safety of our users or the public; (c) detect, prevent, or address fraud, security issues, or technical problems; or (d) comply with applicable law.

Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service before your personal information becomes subject to a different privacy policy.

6. What Other Users See

Serpverse is designed so that you transact under a chosen display name rather than your real identity:

  • Other users see your display name and a generated initial avatar. Your real name, email address, and profile photo are never shown to other users — not in the marketplace, in orders, in messages, or in support conversations. Display names are not unique, and you can change yours.
  • Buyers and Publishers see each other's transaction details. A Publisher sees the Buyer's order requirements and submitted content; a Buyer sees the Publisher's listing details and content submissions. Draft content that has not yet been submitted for review is visible only to its author and to administrators. If you signed up through a Publisher's share link, that Publisher sees "Came from your share link" on your orders with them.
  • Listings. Signed-in Buyers who can see a Listing see its details together with the Publisher's display name. Public catalogue pages, which anyone can see, show banded Listing information without the domain, site name, or Publisher. Anyone with a Listing's share link can see its domain, name, description, metrics, rating, and prices, but not the Publisher's name.
  • Affiliates are shown by name. Anyone who opens an Affiliate's link, or enters their code, sees the Affiliate's display name and code.
  • Referral statistics. A Publisher sees, for each of their share links, visits, sign-ups, first orders, and top referring websites over the last thirty (30) days. An Affiliate sees totals of clicks, sign-ups, and buyers and, for their most recent referred users, a referral number, when each was credited to them, the date of their first completed order, when commission on them ends, and the commission on each of their completed orders with whether it was paid or cancelled (for example because the order was refunded) — never the user's name or what they bought. Where numbers are small, a Publisher or Affiliate may be able to work out who a referred User is.
  • Serpverse personnel can see more. Platform administrators can view your real name, email address, profile photo, role, account status, and account records as needed for moderation, support, trust-and-safety, and dispute resolution, including the IP addresses and user-agents in our activity records, internal notes on moderation and support, payout details, and Affiliate screening records. Administrators can also view order conversations and order activity — for example, when resolving a dispute or reviewing reported content — and can export financial records that include names and email addresses.
  • Reports are confidential. If you report an order's content or open a dispute, your report and its details are visible to administrators, and the other party is not told who reported.

7. Cookies and Similar Technologies

We use cookies and similar browser-storage technologies to operate the Service, keep you signed in, remember your preferences, remember a referral you followed, and — only with your consent — measure how the Service is used.

Cookies We Set

NameTypePurposeDuration
authjs.session-tokenEssentialYour encrypted sign-in session (a large session may be split into numbered parts)30 days from your last visit
authjs.csrf-tokenEssentialProtection against cross-site request forgeryBrowser session
authjs.callback-urlEssentialRemembers where to return you during sign-inBrowser session
authjs.pkce.code_verifier, authjs.state, authjs.nonceEssentialShort-lived security values used during Google/Microsoft sign-in (not every sign-in uses all of them)Up to 15 minutes
gsc_oauth_stateEssentialProtects the connection to Google Search Console when a Publisher verifies a Listing10 minutes
sv_inviteEssentialHolds an Affiliate Program invitation between opening the invitation link and joining1 day, or until you join
sv_ref (share link)FunctionalRemembers the Publisher share link you most recently opened, so that if you sign up in this browser you are recorded as referred by that Publisher and receive their first-order discount30 days from your last visit to the link
sv_ref (Affiliate code)FunctionalRemembers the Affiliate whose link you opened, so that if you sign up in this browser the Affiliate is credited and, where we offer it, you receive their saving. Set when you open an Affiliate's link30 days from your last visit to the link

Over secure connections, the sign-in cookies carry browser security prefixes (for example __Secure-authjs.session-token and __Host-authjs.csrf-token), and all of these cookies are set with protective attributes. Both versions of sv_ref are the same cookie, so your browser remembers one referral at a time: the most recent Publisher share link or Affiliate link you open replaces the one remembered before.

Browser Storage We Use

KeyStoragePurposeDuration
themeLocal storageYour light/dark mode preferenceUntil cleared
cookie-consentLocal storageYour cookie choices: whether you allowed analytics cookies, when, and which version of the choices you answeredUntil cleared or changed

The Service also stores minor interface state in your browser's local or session storage — for example, dismissed interface tips, the price range you last used to filter the marketplace, and unsaved order-form drafts, which are kept only until you close the tab. These entries stay in your browser, except that your saved price range is sent to our servers when you browse the marketplace.

If — and only if — you consent to analytics via the cookie banner, the following third-party services are loaded. No analytics scripts load before you consent, and none load if you decline:

Google Analytics (GA4) — operated by Google LLC. Collects usage data such as pages visited, session duration, device type, and approximate region, and sets cookies (for example _ga and _ga_ followed by an identifier). See Google's Privacy Policy(opens in new tab).

Microsoft Clarity — operated by Microsoft Corporation. Records how visitors interact with pages — such as clicks, scrolling, and page views, including pages you use while signed in — and produces heatmaps and session recordings to help us improve usability. Session recordings capture what is shown on the pages you visit; on signed-in pages, that can include your messages, order details, balances, and other users' display names. It sets cookies (for example _clck and _clsk), and Microsoft also sets its own cookies on Microsoft's domains, which we can't read or delete. See Microsoft's Privacy Statement(opens in new tab).

Marketing Cookies

We do not use advertising cookies, advertising pixels, or ad networks, and we do not serve targeted advertising. The consent banner lists a marketing category so that this is stated rather than left to be inferred. The category covers no cookie, and no choice you make in the banner switches one on.

What the Banner Doesn't Cover

The consent banner doesn't cover the essential and functional cookies above, including both versions of sv_ref, the counting of referral link visits described in Section 2 (Information We Collect), which writes nothing to your device, or our error and performance monitoring (Section 5), which runs on every page to detect errors and track stability, and measures page timing on a sample of visits. That monitoring is used for diagnostics, not marketing or cross-site tracking.

Both versions of sv_ref record one thing you set in motion by following a link: a discount you are redeeming, or who referred you. We set them, we are the only ones who read them, we read them only when an account completes sign-up in that browser, they expire within thirty (30) days, and we never share them or use them to track you across other websites.

Managing Your Choice

The consent banner appears on your first visit. You can change or withdraw your choices at any time with the Cookie settings button in the site footer or, when you are signed in, in your profile settings. Your choice is stored in your browser, not your account, so each browser you use keeps its own. If you withdraw consent to analytics, we delete the analytics cookies we can reach and reload the page so that the analytics services stop; cookies Microsoft sets on its own domains can't be deleted by us. The referral cookies above are not part of the banner's choices; you can delete them, as you can any cookie we set, through your browser's settings, and a referral already recorded when you signed up is not affected. Most browsers also let you control or delete cookies through their settings — but blocking the essential cookies above will prevent sign-in and other core features from working.

Do Not Track

Serpverse does not currently respond to "Do Not Track" (DNT) browser signals, as there is no universally accepted standard for interpreting them. We will update this policy if a standard is established and we adopt a responsive approach.

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Our retention approach:

Data CategoryRetentionBasis
Account dataLifetime of the account; deleted or anonymized within 30 days of a verified deletion request, except where retention is legally required or the records below must be keptContract performance
Transaction and financial records, including Affiliate commission and Payout recordsMinimum 7 years after the transactionFinancial record-keeping, tax compliance, and audit requirements
Activity records (audit logs), moderation records, and acceptance records (Terms of Service, this Privacy Policy, and the Affiliate Agreement)Retained as immutable records for at least 7 yearsFinancial audit trail, security, compliance, and evidencing contract acceptance
Messages, order conversations, and support correspondenceFor as long as your account exists, and afterwards for as long as needed to resolve disputes and meet our legal and record-keeping obligationsDispute resolution and compliance
Requests to join the Affiliate Program made on its pageUntil we have answered them and, where we keep a request for when places open up, until then or until you ask us to remove it. Our activity record of each request (Section 2) is kept with our other activity recordsLegitimate interests
Referral records and your answer to the sign-up questionFor as long as your account exists and, where they support commission or financial records, for as long as those records are keptContract performance and fraud prevention
IRS Forms W-9 and bank details that Affiliates send us by emailFor as long as needed for tax and financial record-keepingLegal obligation
Payment-card fingerprintsKept with the deposit records they belong to, and for as long as needed to enforce the one-discount-per-card rule and the commission checks (Section 12)Fraud prevention
Search Console verification recordsA record for each of your Listings' domains that your connected Google account owns: until your account is deleted or we ask you to verify that domain again (it verifies a new Listing for that domain only within 90 days). The connected account's email address also stays on each Listing it verified and in our activity recordsContract performance
Affiliate invitation notesFor as long as we keep our Affiliate Program recordsLegitimate interests
Feedback you send usFor as long as your account existsPlatform improvement
Referral link visit hashesUntil about one hour after the end of the day they were madeLegitimate interests
Rate-limiting countersUp to one hourLegitimate interests
Referral link visit totalsIndefinitely, as part of each link's statisticsLegitimate interests
Aggregated or anonymized dataIndefinitelyStatistics and analytics (cannot identify individuals)

When personal data is no longer needed for any legitimate purpose, we delete or irreversibly anonymize it. Where a deletion request conflicts with a legal retention obligation (for example, financial transaction records) or with records needed to evidence contract acceptance or prevent fraud, we retain only the minimum data necessary for that purpose and restrict all other processing of it.

9. Your Privacy Rights

Rights for All Users

Regardless of your location, we provide the following rights with respect to your personal data:

  • Right of Access: You may request a copy of the personal data we hold about you. We will provide it in a commonly used, machine-readable format.
  • Right to Correction: You may request correction of inaccurate or incomplete personal data. You can update much of your account information directly through your profile settings.
  • Right to Deletion: You may request the deletion of your personal data, subject to the retention exceptions described in Section 8.
  • Right to Data Portability: You may request your personal data in a structured, commonly used, machine-readable format, or that we transmit it to another controller where technically feasible.
  • Right to Withdraw Consent: Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal; for example, withdrawing consent to analytics doesn't undo the usage measurement already carried out.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

Additional Rights for EEA and UK Residents (GDPR)

If you are located in the European Economic Area or the United Kingdom, you additionally have:

  • Right to Restrict Processing: You may request that we restrict processing in certain circumstances, such as while we verify contested data or assess a legitimate-interest objection.
  • Right to Object: You may object to processing based on our legitimate interests. We will cease that processing unless we demonstrate compelling legitimate grounds that override your rights.
  • Right to Lodge a Complaint: You may lodge a complaint with your local data protection supervisory authority.

California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know the categories and specific pieces of personal information we collect, the sources, purposes, and the categories of third parties we share it with; the right to delete and to correct, subject to legal exceptions; and the right to opt out of sale or sharing — we do not sell your personal information and do not share it for cross-context behavioral advertising.

Categories we collect (CCPA):

  • Identifiers: name, email address, account identifiers, IP address
  • Government identifiers: the taxpayer identification number on an IRS Form W-9 (Affiliates who are United States persons only)
  • Financial information: PayPal and Payoneer addresses and, for Affiliates paid by bank transfer, bank details
  • Commercial information: transaction records, order history, account balance, referral records, and Affiliate commission and Payout records
  • Internet activity: the technical and activity records described in Section 2; analytics data only if you consented under Section 7
  • Geolocation data: approximate location derived from IP address
  • Professional information: website ownership details and categories (Publishers); your code and, where your invitation records it, where you publish (Affiliates)

The taxpayer identification number is sensitive personal information; we use it only to meet tax requirements.

We have not sold personal information in the preceding twelve (12) months.

How to Exercise Your Rights

To exercise any of these rights, please contact us or email our support address. We will respond within the timeframes required by applicable law (generally within thirty (30) days). We may need to verify your identity before processing your request. You may designate an authorized agent to submit requests on your behalf, subject to verification.

10. Data Security

We implement technical and organizational measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including:

  • Encryption in transit: all connections to the Service use TLS/SSL, with HTTP Strict Transport Security (HSTS)
  • Access controls: role-based access restricts internal access to personal data; cross-user requests return only the public identity fields described in Section 6
  • Session security: encrypted, httpOnly session cookies that expire thirty (30) days after your last visit, with periodic revalidation of account status
  • Security headers: a Content Security Policy is enforced on our pages and API responses, together with related browser protections
  • Rate limiting: tiered limits on requests, strictest on sign-in emails and features that send email
  • Payment isolation: card details are entered on and held by Stripe; payment notifications Stripe sends us are cryptographically verified
  • Payout safeguards: changes to payout addresses are limited in number, can't be made while a payment to that address is being processed, and always trigger an alert to your account's email address
  • Auditability: security-relevant actions are recorded in access-restricted activity records

No method of transmission or storage is completely secure; we cannot guarantee absolute security, but we are committed to maintaining appropriate safeguards and addressing security incidents promptly.

Data Breach Notification: In the event of a confirmed data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and relevant supervisory authorities within seventy-two (72) hours of becoming aware of the breach, as required by GDPR Article 33 and applicable data protection laws.

11. International Data Transfers

Your personal information may be transferred to, stored in, and processed in the United Kingdom and other countries where we or our service providers operate, including our payment and payout providers, our site-metrics providers, and the automated language-model service we use to maintain Listing guidelines. These countries may have data protection laws that differ from those of your jurisdiction, and some may not have been found to provide an adequate level of protection.

When we transfer personal data from the EEA, UK, or Switzerland to countries that have not been deemed to provide an adequate level of protection, we rely on safeguards recognized by law where they are required, such as:

  • Relying on adequacy decisions issued by the European Commission or the UK Secretary of State where applicable
  • Implementing Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to countries without an adequacy decision
  • Ensuring third-party providers processing your data are bound by data processing agreements with equivalent protections

You may contact us to request information about the specific transfer mechanisms in place for your data.

12. Automated Decision-Making

The Service uses certain automated processes that may affect your use of the Platform:

  • Rate limiting: automated throttling of requests based on your user ID, IP address, or email address, to prevent abuse and ensure fair access.
  • Account status enforcement: your account status (active, suspended, or banned) is checked automatically during each session to enforce access restrictions.
  • Order deadlines: if a Buyer does not act within the applicable review window, the order item is automatically approved and payment released, and order items are automatically declined or cancelled when a deadline is missed, as described in the Terms of Service.
  • Earnings hold and release: Publisher earnings are automatically held after order completion and automatically released when the hold period expires. The amount you can withdraw is calculated automatically, leaving out funds on order items under dispute or review.
  • Chargebacks: when a deposit is charged back, orders may be cancelled and Publisher earnings recovered automatically, as described in the Terms of Service.
  • Referral attribution: when you complete onboarding, or when you enter a code before your first order, any referral is recorded automatically. An answer to the sign-up question that is an Affiliate's code, ignoring capitals, spaces, and punctuation, credits that Affiliate automatically; other answers may be matched by our staff.
  • Payment-card checks: we compare the fingerprints of every card that has funded your balance with other accounts. If one of your cards has already backed a first-order discount or saving on another account, no discount or saving is available to you, and you are told so before you order. An Affiliate earns no commission on a referred User whose card has also funded another account, and where a referred User's account was funded without a card fingerprint, the Affiliate's commission is held for review by our staff.
  • Affiliate commission: commission is recorded, held, released, cancelled, and taken back automatically, as described in the Affiliate Agreement.
  • Listing checks: guidelines that name an off-platform payment method or contain contact details are refused automatically; guidelines that conflict with a Listing's settings may be edited automatically, including by an automated language-model service; blank descriptions are filled automatically; Listings that haven't proved ownership of their domain are hidden automatically; site metrics may be held back or hidden automatically; and Listings are ranked automatically.
  • Contact form filtering: contact form submissions and Affiliate Program invitation requests that appear to be automated are discarded.

These automated processes are essential to the operation of the Service. Some of them make decisions without a person involved that can affect what you pay, receive, or earn — for example, approving or cancelling order items when a deadline passes, recovering earnings after a chargeback, the payment-card checks, the Affiliate commission rules, and hiding or ranking Listings. We use them because they are needed to provide the Service under our Terms of Service and to prevent fraud. If one of these decisions affects you, you can contact us to have a person review it, give us your point of view, and contest it.

The Service contains links to third-party websites, including Publisher websites listed in the marketplace, payment processor interfaces, and sign-in provider pages. These are independent entities with their own privacy policies and practices. Serpverse is not responsible for the privacy practices, content, or security of any third-party website or service.

Publisher websites listed on the marketplace are operated independently by their owners. Content published on Publisher websites is subject to the Publisher's own terms and privacy practices, not this Privacy Policy. Likewise, content that Affiliates publish about Serpverse, and the personal data they collect from their own audiences, are their responsibility, not ours.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. This Privacy Policy is versioned, and the current effective date is shown at the top of this page. You accept this Privacy Policy together with the Terms of Service in a single confirmation, both at onboarding and whenever re-acceptance of updated terms is required.

For material changes that significantly affect how we collect, use, or share your personal data, we will provide at least thirty (30) days' advance notice through one or more of: email to your registered address, a prominent notice within the Service, or an in-app notification. If you do not agree with the updated Privacy Policy, you should discontinue use of the Service and may contact us to request deletion of your data.

15. Children's Privacy

The Service is a business marketplace and requires all users to be at least eighteen (18) years of age (or the age of majority in their jurisdiction, if greater), as set out in our Terms of Service. The Service is not directed at children, and we do not knowingly collect personal information from anyone under eighteen (18).

If we become aware that we have collected personal data from a minor, we will take prompt steps to delete it. If you are a parent or guardian and believe your child has provided personal information to us, please contact us.

16. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Serpverse

Contact form: serpverse.io/contact

Email: our support address

Website: serpverse.io(opens in new tab)

We will make every effort to respond within a reasonable timeframe, generally within thirty (30) days. If you are located in the European Economic Area or the United Kingdom and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection supervisory authority.