Privacy Policy

1. Introduction

Welcome to Serpec ("Serpec," "we," "us," or "our"), an SEO AI SaaS platform operated by Hostex, a company based in Chile. Serpec provides website auditing, keyword tracking, organic traffic monitoring, AI search visibility analysis, and reporting tools through our platform accessible at serpec.com, panel.serpec.com, and related services (collectively, the "Service").

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our websites, use our platform, install our WordPress plugin, or otherwise interact with our Service. By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

We are committed to compliance with applicable data protection laws, including the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and Chile's Law No. 19.628 on the Protection of Private Life.

2. Information We Collect

2.1 Account Information

When you register for an account, we collect information that you provide directly, including:

• Full name
• Email address
• Password (stored in hashed form)
• Company or organization name (if provided)
• Website URL(s) you register for scanning
• Billing address and contact details

2.2 Payment Data

We process payments through third-party payment processors. When you subscribe to a paid plan:

• Stripe: Credit card payments are processed by Stripe, Inc. We do not store your full credit card number on our servers. Stripe processes and stores payment card information in accordance with its own privacy policy and PCI DSS standards.
• BTCPay Server: Bitcoin payments are processed via BTCPay Server. Transaction details such as wallet addresses and payment amounts are recorded for billing purposes.

We retain transaction records, subscription plan details, invoice history, and payment status for accounting and legal compliance purposes.

2.3 Usage Data

We automatically collect certain information when you access or use the Service, including:

• IP address and approximate geolocation
• Browser type, version, and language preferences
• Operating system and device type
• Pages visited, features used, and actions taken within the platform
• Date and time of access, session duration, and referring URLs
• Error logs and performance data

2.4 Website Scanning Data

When you use our SEO audit and crawling features, our systems access and analyze publicly available information from the website URLs you provide. This includes:

• HTML source code and page structure
• Meta tags, headings, and on-page content
• Internal and external link structures
• Image attributes and media references
• Page load performance metrics
• Robots.txt and sitemap configurations
• Structured data and schema markup

2.5 Keyword and Ranking Data

We collect and store keyword ranking data, search volume estimates, and related metrics obtained from search engines and third-party data providers to deliver our keyword tracking and visibility monitoring features.

2.6 AI Search Visibility Data

Our AI Search Visibility feature monitors mentions and references to your brand, domain, or specified keywords across AI-powered platforms such as ChatGPT, Google Gemini, and similar services. The data collected consists of publicly accessible AI-generated responses and the context in which your brand appears.

2.7 Cookies and Similar Technologies

We use cookies, pixels, and similar tracking technologies to collect information about your browsing activity. Please see Section 5 for detailed information about our use of cookies and tracking technologies.

2.8 Communications

When you contact us via email, support channels, or other means, we collect the content of your communications, your email address, and any information you voluntarily provide.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, maintain, and improve the Service, including running SEO audits, tracking keyword rankings, monitoring traffic, generating reports, and delivering AI search visibility insights.
• Account Management: To create and manage your account, process subscriptions, manage license keys through our hub system, and authenticate your access.
• Payment Processing: To process transactions, send invoices, manage billing, and handle refund requests.
• Communications: To send transactional emails (account verification, password resets, billing notifications), service updates, and, where permitted, marketing communications.
• Analytics and Improvement: To understand how users interact with our Service, identify trends, diagnose technical issues, and improve functionality and user experience.
• Security: To detect, prevent, and respond to fraud, abuse, security incidents, and other harmful activities.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
• Report Generation: To generate PDF and CSV reports containing SEO audit results, keyword rankings, traffic data, and other analytics for your use.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Performance of a Contract (Article 6(1)(b) GDPR): Processing necessary to provide the Service you have subscribed to, including account creation, SEO auditing, keyword tracking, and report generation.
• Legitimate Interests (Article 6(1)(f) GDPR): Processing necessary for our legitimate business interests, such as improving our Service, ensuring security, preventing fraud, and conducting analytics. We balance these interests against your rights and freedoms.
• Consent (Article 6(1)(a) GDPR): Where we rely on your consent, such as for marketing communications and certain cookie usage. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal Obligation (Article 6(1)(c) GDPR): Processing necessary to comply with applicable legal obligations, such as tax and accounting requirements.

5. Cookies and Tracking Technologies

We use the following cookies and tracking technologies on our websites:

5.1 Google Analytics (G-VN1RDR0YHC)

We use Google Analytics, a web analytics service provided by Google LLC, to analyze website usage. Google Analytics uses cookies to collect information about how visitors use our site, including pages visited, time spent, and traffic sources. This data is aggregated and anonymized where possible. Google may transfer data to servers in the United States. For more information, see Google's Privacy Policy.

5.2 Microsoft Clarity

We use Microsoft Clarity to capture heatmaps, session recordings, and user behavior analytics. Clarity helps us understand how users interact with our website so we can improve the user experience. Microsoft Clarity does not collect personally identifiable information. For more information, see Microsoft's Privacy Statement.

5.3 Meta Pixel (Facebook Pixel)

We use the Meta Pixel to measure the effectiveness of our advertising campaigns on Meta platforms (Facebook, Instagram). The Pixel collects data about your interactions with our website and may be used to serve targeted ads. For more information, see Meta's Privacy Policy.

5.4 Google Tag Manager

We use Google Tag Manager to manage and deploy tracking scripts on our website. Google Tag Manager itself does not collect personal data, but the tags it manages (such as Google Analytics and Meta Pixel) may do so as described in their respective sections.

5.5 Essential Cookies

We use strictly necessary cookies for authentication, session management, security, and basic platform functionality. These cookies are required for the Service to operate and cannot be disabled.

5.6 Managing Your Cookie Preferences

You can control and delete cookies through your browser settings. Most browsers allow you to refuse or accept cookies, delete existing cookies, and set preferences for certain websites. Please note that disabling certain cookies may affect the functionality of the Service.

6. Website Crawling and Scanning Data

Our Service operates by crawling and scanning websites that you submit for SEO analysis. It is important to understand the following:

• Publicly Available Information: The data our crawlers collect from your websites consists of publicly available information that is accessible to any web browser or search engine crawler. We treat website crawling data as publicly available information and process it accordingly.
• Your Authorization: By submitting a website URL for scanning, you represent and warrant that you have the necessary rights and authorization to have that website crawled and analyzed by our Service.
• Page-by-Page Scanning: Our crawler performs a comprehensive page-by-page scan of the submitted website, analyzing each page for SEO factors including content, structure, links, metadata, and technical elements.
• No Collection of Private Data: Our crawlers are designed to access only publicly available pages and do not attempt to bypass authentication, access restricted areas, or collect personal data of website visitors. However, if personal data is present in publicly available page content, it may be incidentally captured during the scanning process.
• Respect for Robots.txt: Our crawlers endeavor to respect robots.txt directives, although we cannot guarantee full compliance with all custom configurations in all circumstances.

7. AI Features and Data Processing

Serpec incorporates artificial intelligence and machine learning technologies to deliver certain features of the Service. You acknowledge and agree to the following:

• AI-Generated Content: Certain outputs, analyses, recommendations, and scores generated by our AI features are produced through automated processes. While we strive to provide useful and accurate information, we do not guarantee the accuracy, completeness, reliability, or suitability of any AI-generated output. AI outputs are provided for informational purposes only and should not be relied upon as the sole basis for business decisions.
• AI Search Visibility: Our monitoring of AI platforms (including ChatGPT, Google Gemini, and others) captures publicly available AI-generated responses. The content, format, and availability of these AI responses are controlled by their respective platform operators and may change without notice.
• Data Used for AI Processing: The data we use for AI-driven features includes publicly available website data, search engine data, and aggregated usage patterns. We do not use your personal account information to train general-purpose AI models.
• Third-Party AI Services: We may utilize third-party AI services and APIs to deliver certain features. Data shared with these services is governed by their respective privacy policies and data processing agreements.

8. Data Sharing and Third Parties

We may share your information with the following categories of third parties:

8.1 Service Providers

• Payment Processors: Stripe and BTCPay Server for payment processing.
• Email Services: SMTP-based email delivery providers for transactional and account-related communications.
• Hosting and Infrastructure: Cloud hosting and content delivery providers that store and serve our platform and data.
• Analytics Providers: Google Analytics, Microsoft Clarity, and Meta as described in Section 5.
• License Management: Our hub system at hub.zerpia.com (operated by Hostex, our parent company) manages license keys and subscription verification.

8.2 Affiliated Entities

We may share information with Hostex and its affiliated entities for purposes consistent with this Privacy Policy, including infrastructure management, support, and service improvement.

8.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of others, investigate fraud, or respond to a government request.

8.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change and the choices you may have regarding your information.

8.5 Third-Party Policies

Important: Third-party service providers process your data under their own privacy policies and terms of service. We are not responsible for the privacy practices or data handling of third-party services. We encourage you to review the privacy policies of any third-party services that process your data in connection with our Service.

8.6 No Sale of Personal Information

We do not sell your personal information as defined under the California Consumer Privacy Act (CCPA) or any other applicable law. We do not share your personal information with third parties for their own direct marketing purposes without your explicit consent.

9. International Data Transfers

Serpec is operated by Hostex, based in Chile, and serves clients internationally. Your information may be transferred to and processed in countries other than your country of residence, including Chile, the United States, and countries within the European Economic Area.

When we transfer personal data from the EEA, United Kingdom, or Switzerland to countries that have not been deemed to provide an adequate level of data protection, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs): We use European Commission-approved Standard Contractual Clauses to ensure that personal data transferred outside the EEA receives adequate protection.
• Adequacy Decisions: Where available, we rely on adequacy decisions issued by the European Commission or equivalent authorities.
• Additional Safeguards: We implement supplementary technical and organizational measures as necessary to ensure a level of protection consistent with applicable data protection laws.

By using the Service, you acknowledge that your information may be transferred to and processed in jurisdictions that may not offer the same level of data protection as your home country.

10. Data Retention

We retain your personal data for as long as reasonably necessary to fulfill the purposes for which it was collected, including:

• Account Data: Retained for as long as your account remains active and for a reasonable period thereafter to allow for reactivation, comply with legal obligations, resolve disputes, and enforce our agreements.
• Billing and Transaction Data: Retained as required by applicable tax, accounting, and financial regulations, typically for a minimum of five (5) years from the date of the transaction.
• SEO Audit and Scanning Data: Retained for as long as reasonably necessary to provide historical analytics and trend data, and for a reasonable period after account termination.
• Usage and Analytics Data: Retained in aggregated or anonymized form for analytical purposes for as long as reasonably necessary.
• Communications: Support and correspondence records are retained for as long as reasonably necessary for customer service, training, and legal purposes.

When personal data is no longer necessary for the purposes for which it was collected, we will endeavor to securely delete or anonymize it. Please note that we may retain certain information as required by law or for legitimate business purposes, including to resolve disputes, enforce agreements, and comply with legal obligations. Backup copies may also persist in our systems for a reasonable period before complete deletion.

11. Data Security

We implement commercially reasonable technical and organizational security measures designed to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL protocols
• Hashed and salted password storage
• Access controls and role-based permissions
• Regular security assessments and monitoring
• Secure server infrastructure with firewall protection

However, no method of electronic transmission or storage is 100% secure. While we strive to use commercially reasonable means to protect your personal data, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your account credentials, including your password and any API keys or license keys issued to you. You must notify us immediately at privacy@serpec.com if you become aware of any unauthorized access to or use of your account.

12. Your Rights

12.1 Rights Under the GDPR (EEA, UK, and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under applicable data protection laws:

• Right of Access (Article 15): You have the right to request a copy of the personal data we hold about you.
• Right to Rectification (Article 16): You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure (Article 17): You have the right to request deletion of your personal data, subject to certain exceptions. We will endeavor to comply with deletion requests, though some data may need to be retained for legal, security, or legitimate business purposes.
• Right to Restriction of Processing (Article 18): You have the right to request that we restrict processing of your personal data in certain circumstances.
• Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Article 21): You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your jurisdiction.

Please note that the exercise of these rights may be limited where it conflicts with our legal obligations, legitimate business interests, or the rights and freedoms of others. We will assess each request on a case-by-case basis and respond within the timeframes required by applicable law.

12.2 Rights Under the CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected, the purposes for collection, the categories of sources, and the categories of third parties with whom we share your information.
• Right to Delete: You have the right to request deletion of personal information we have collected, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell your personal information. However, you have the right to direct us not to sell your personal information at any time.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

In the twelve (12) months preceding the date of this Privacy Policy, we have not sold personal information of consumers as defined by the CCPA.

12.3 Exercising Your Rights

To exercise any of these rights, please contact us at privacy@serpec.com. We may need to verify your identity before processing your request. We will respond to your request within the timeframes required by applicable law (typically within 30 days for GDPR requests and 45 days for CCPA requests).

13. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16 years of age. If we become aware that we have inadvertently collected personal information from a child under 16, we will endeavor to delete such information from our records as promptly as practicable. If you are a parent or guardian and believe that your child has provided personal information to us, please contact us at privacy@serpec.com so that we can take appropriate action.

14. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL SERPEC, ZERPIA, OR THEIR OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, AFFILIATES, OR LICENSORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, DATA, USE, GOODWILL, OR OTHER INTANGIBLE LOSSES, ARISING OUT OF OR IN CONNECTION WITH:

• Your access to, use of, or inability to access or use the Service;
• Any unauthorized access to or alteration of your data or transmissions;
• Any errors, inaccuracies, or omissions in the content, data, reports, or analyses provided by the Service, including AI-generated outputs;
• Any third-party conduct, content, or services accessed through the Service;
• Any interruption, suspension, modification, or discontinuation of the Service or any features thereof.

OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE SERVICE OR THIS PRIVACY POLICY SHALL NOT EXCEED THE TOTAL AMOUNT OF FEES PAID BY YOU TO SERPEC DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

THE SERVICE, INCLUDING ALL CONTENT, DATA, REPORTS, ANALYSES, AND AI-GENERATED OUTPUTS, IS PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY. WE EXPRESSLY DISCLAIM ALL WARRANTIES, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, COMPLETENESS, RELIABILITY, NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

We reserve the right to modify, suspend, or discontinue any features or functionality of the Service at any time, with or without notice, and without liability to you or any third party.

15. Indemnification

You agree to defend, indemnify, and hold harmless Serpec, Hostex, and their respective officers, directors, employees, agents, affiliates, successors, and assigns from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or in connection with:

• Your use or misuse of the Service;
• Your violation of this Privacy Policy or any applicable law or regulation;
• Your violation of any third-party right, including any intellectual property, privacy, or proprietary right;
• Any content or data you submit, post, or transmit through the Service;
• Your submission of website URLs for scanning that you did not have authorization to submit;
• Any claim that your use of the Service caused damage to a third party.

This indemnification obligation will survive termination of your account and your use of the Service.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page and, where required by applicable law, notify you by email or through a prominent notice on our website.

Your continued use of the Service after the posting of changes constitutes your acceptance of such changes. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Serpec (operated by Hostex)
Email: privacy@serpec.com
General Inquiries: info@serpec.com
Website: serpec.com

For GDPR-related inquiries, you may also contact your local data protection authority. A list of EU data protection authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.