Privacy Policy

Serpier ApS ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share personal data when you use the Serpier platform ("Platform"). We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Danish law.

We collect the following categories of data:

a) Account Information

• Name
• Email address
• Organization name and associated users
• User role (Owner, Admin, Member)

b) Transaction Data

• Purchase history
• Billing details (processed via Stripe)

c) Technical Data

• IP address
• Browser type and version
• Device information
• Platform usage data (e.g. clicks, logins, page visits)

d) Communication Data

• Emails and messages exchanged with us

We use your personal data to:

• Provide access to and manage your account
• Process payments and orders
• Maintain Platform security and integrity
• Improve the user experience
• Send service-related notifications and updates
• Enforce our Terms of Service
• Comply with legal obligations
• Operate runtime configuration, experimentation, and feature flagging required to deliver and tailor Platform functionality for authenticated users

We process your data under one or more of the following legal grounds:

• Contractual necessity – to provide the services you signed up for, including functional runtime configuration and feature flagging required to operate the Platform for logged‑in users.
• Legitimate interest – to improve the Platform, prevent abuse, secure operations, ensure stable delivery of features, and keep our ads away from people who are already customers or in contact with us.
• Legal obligation – to comply with Danish accounting and legal requirements.
• Consent – for non‑essential analytics, marketing communications, and ads on LinkedIn and Google based on your email address (if you opt in).

We only share your personal data with:

• Service providers (e.g., Stripe for payment processing, cloud hosting providers)
• Publishers when necessary to complete an order (e.g., article publishing)
• LinkedIn and Google, in hashed form, to show our ads to people who agreed to it and to keep them away from customers (see section 5E)
• Authorities or legal bodies if required by law

We do not sell your personal data to third parties.

If you choose to connect your Google account to Serpier, we may access certain Google user data in order to provide Google Analytics functionality within the Platform.

This may include:

• Google Analytics reporting data, such as properties, sessions, users, traffic sources, page performance, ecommerce performance, and other read-only analytics insights;
• Google Analytics account and property metadata needed to identify which Google Analytics properties you can access and help you select the correct property in Serpier;
• Google Search Console account and property metadata needed to identify which Google Search Console properties you can access and help you select the correct property in Serpier;
• Basic Google account information, such as your email address and profile information, to associate the Google connection with your Serpier account.

We use this data solely to provide user-facing functionality you request within Serpier, including:

• connecting your Google account to the Platform;
• identifying and selecting the correct Google Analytics property;
• identifying and selecting the correct Google Search Console property;
• displaying analytics reports, summaries, and insights;
• supporting analytics-related workflows you initiate inside Serpier.

We only request the minimum Google permissions needed for these features. Where Serpier uses Google Analytics/Search Console read-only access, Serpier does not use that access to create, modify, or delete your Google Analytics/Search Console settings or data.

We do not use Google user data for advertising, marketing profiling, or sale to third parties.

We do not transfer or disclose Google user data except:

• to service providers acting on our behalf and subject to appropriate confidentiality and data protection obligations;
• where necessary to provide or support the specific user-facing functionality requested by you;
• for security purposes, including preventing fraud, abuse, or technical issues;
• where required by applicable law, regulation, legal process, or enforceable governmental request;
• in connection with a merger, acquisition, or sale of assets, where permitted by law and subject to appropriate safeguards.

If we store Google access tokens or refresh tokens, they are stored securely and used only to maintain the connection you authorized and provide the requested functionality.

We retain Google-connected data only for as long as necessary to provide the integration, comply with legal obligations, resolve disputes, enforce our agreements, and protect the security and integrity of the Platform.

You can revoke Serpier's access to your Google data at any time by disconnecting the integration within Serpier, where available, and/or by removing Serpier's access in your Google account permissions settings at https://myaccount.google.com/permissions.

Serpier's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, where applicable.

When a merchant installs the Serpier Shopify app, the merchant is the controller of their store data and Serpier processes it on the merchant's behalf. We access only the data needed for the features the merchant uses.

a) Data we access

• Store details: shop name, domains, currency, markets, languages and locations.
• Catalog and content: products, variants, prices, inventory, collections, pages, blogs, articles, navigation menus, themes and translations.
• Orders, in aggregated form: order count, order totals, payment status, whether an order is a customer's first or a repeat purchase, and the marketing source of the visit that led to it. We do not request customer names, email addresses, phone numbers or addresses, and we do not store individual orders.
• Shopify Payments: account balance, payout amounts and dates, and bank account identifiers. We do not receive bank account numbers.
• Changes the merchant approves: copies of products, pages, articles, collections, menus and structured data before and after a change, so the change can be reviewed and undone.
• Credentials: OAuth access tokens and, if the merchant adds one, a Theme Access password. Both are encrypted before storage.
• App installation, connection and webhook data needed to operate the app and meet Shopify's privacy requirements.

b) How we use it

• To report on the store and make the changes the merchant approves in Navi.
• To authenticate and maintain the Shopify connection, troubleshoot issues and provide support.
• To protect the Platform against fraud and abuse, and to comply with Shopify's requirements and applicable law.

We do not sell Shopify data. We do not use it for advertising or profiling, and we never share data about a merchant's customers with LinkedIn, Google or any other advertising platform. We make no automated decisions about a merchant's customers that have legal or similarly significant effects.

c) AI processing

When a merchant asks Navi about their store, the relevant store data is sent to the AI model that answers the request. We route these requests through OpenRouter to models from Google, OpenAI or Anthropic. The data is used only to produce the answer.

d) Sharing

• With the processors listed under Processors and Subprocessors, acting on our behalf under confidentiality and data protection obligations.
• Where the law, a regulator or an enforceable government request requires it.
• In a merger, acquisition or sale of assets, where the law allows it and with appropriate safeguards.

e) Retention and deletion

• Access tokens and credentials are deleted when the app is uninstalled or the store is disconnected.
• Change history is deleted when Shopify sends its shop data deletion request, 48 hours after uninstall.
• Requests from a merchant's customers to see or delete their data are handled through Shopify's privacy webhooks, and we respond within 30 days. We hold no records about individual customers.
• Navi conversations, which can contain aggregated store figures, are kept while the account is active and deleted on request to privacy@serpier.com.

If you choose to connect Serpier to a Slack workspace, we process certain Slack data to provide the Slack integration features (for example, connecting the app, receiving webhook events, posting assistant responses, and supporting organization/workspace selection flows). We may process the following categories of Slack data:

• Workspace and installation data (such as Slack workspace/team ID, workspace name, app installation metadata, and bot token/installation credentials).
• User and channel identifiers (such as Slack user IDs, channel IDs, thread/message timestamps, and related technical identifiers).
• Message and interaction data needed to operate the integration (such as messages, commands, button actions, and other event payloads sent by Slack to Serpier).
• Basic profile/contact fields made available via granted Slack scopes (such as email, where available and necessary for identity resolution and access control).

We use Slack data only for legitimate business purposes related to providing and securing the Slack integration, including:

• authenticating and maintaining your Slack connection,
• routing and processing Slack requests,
• enforcing permissions and organizational access rules,
• detecting, preventing, and investigating abuse, fraud, or security incidents,
• debugging, support, and service reliability.

We do not sell Slack data. We do not use Slack data for unrelated advertising purposes. We share Slack data only as necessary to operate our services, including with service providers/processors acting on our behalf under contractual confidentiality and data protection obligations, or when required by law.

We retain Slack data only for as long as needed for the purposes above, unless a longer period is required by law. You can disconnect the Slack integration at any time in Serpier and/or remove the app from your Slack workspace. When a Slack connection is removed, we delete or de-identify Slack installation data and associated Slack-derived metadata in accordance with our retention practices, subject to legal obligations.

If you have questions or requests regarding Slack data (including deletion requests), contact us using the details in the Contact section of this Privacy Policy.

If you connect Serpier to an AI app such as Claude or ChatGPT, that app can call Serpier on your behalf through OAuth. You sign in to Serpier, choose one organization and one team, and allow access. Serpier then issues an access token to that app. Later calls from that connection stay on that organization and team until you connect again and choose differently.

We store the OAuth client registration, your consent, the organization and team on the grant, and the access token and refresh token for that connection. We do not receive or store the rest of your chat with the AI app. We do receive the tool name and the arguments the app sends when it calls Serpier, and we return the tool result to that app so it can show it in the chat.

Depending on the tool, a result can include:

• Account and access data: your user id, name, email address, role, organization name, and team.
• Projects: project name, domain, and settings for the authorized organization.
• Marketplace: publisher names, domains, prices, and offer details in your organization's currency.
• Cart and orders: line items, prices, content briefs, anchor text, live URLs, order status, and the name or email of a user who created or is assigned to an order when the tool returns that field.
• Publication monitoring: article URLs, anchor text, and change statistics for the organization.
• AI visibility monitoring: saved prompts, topics, models, cadence, run status, visibility metrics, and credit usage.
• Billing: whether billing details are on file, which payment methods can be used, and a link to the Stripe billing portal. Serpier does not put card numbers in the tool result. Stripe processes payment details as described above.

We use this data only to perform the action you asked the AI app to take, to keep the connection authorized, and to secure the Platform. The AI app receives the tool result because you connected it. We do not sell this data. We do not use it for advertising. We share it only with that AI app, with service providers acting on our behalf under the same terms as the rest of this policy, and where the law requires it.

We keep the OAuth grant and tokens until you disconnect the app, connect again and replace the grant, or ask us to revoke it, and for longer only where the law requires it. Platform data returned by a tool is kept under section 7.

You can disconnect the connector in Claude or ChatGPT at any time. To revoke the grant on Serpier's side, email privacy@serpier.com.

If you agree to it, for example by ticking the box when you run our free AI visibility check, we use your email address to show you relevant Serpier ads on LinkedIn and Google.

• Your email address is hashed before it is shared. LinkedIn and Google only use it to find you among their own users and show you our ads there. We do not get any information about you back from them.
• The legal basis is your consent. You can withdraw it at any time by writing to privacy@serpier.com, and we take you off the list.
• We also share hashed email addresses of customers and of people we are already in contact with, so that LinkedIn and Google do not show them our ads. The legal basis is our legitimate interest in not showing ads to people who already know us.
• If you choose “Accept all” in the cookie banner, LinkedIn, Google and Reddit can also show our ads to you as a visitor of our website (see section 9).

If you connect a Meta ad account to Serpier, we read advertising data through Meta's Marketing API with the ads_read permission. You sign in with Meta, choose which ad accounts to share, and can disconnect at any time. We read:

• Ad account details, such as the account ID, name, currency, and time zone.
• Campaigns, ad sets, and ads, such as their names, status, objective, and text.
• Performance metrics for the date range you ask about, such as impressions, reach, clicks, click-through rate, spend, conversions, and cost per result.
• The name and ID of the Meta user who connected the account, so you can tell several connected accounts apart.

We use this data only to show and explain your advertising performance in Serpier. Navi, our AI assistant, uses it to answer your questions, compare paid and organic results, and point out ads that may need attention. We do not change your ads, budgets, or audiences with this access.

We do not sell Meta data. We do not use it for our own advertising or to build profiles of people. We share it only with service providers acting on our behalf to run the connection, such as Composio, which holds the Meta access token, under contractual confidentiality and data protection obligations, or where the law requires it. Members of your Serpier organization can see the data only if you share the connection with them.

The access token is kept until you disconnect the account. Answers and reports that include Meta data are kept with your chat history and reports under section 7. When you disconnect the account, we stop reading it and delete the access token. To have the Meta data in your chat history and reports deleted, delete those threads or reports, or email privacy@serpier.com and we will delete it within 30 days.

Where data is transferred outside the EU/EEA, we ensure adequate protection through Standard Contractual Clauses or other approved safeguards.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting obligations.

Under GDPR, you have the right to:

• Access your data
• Correct inaccuracies
• Request deletion ("right to be forgotten")
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent (where processing is based on consent)
• Lodge a complaint with the Danish Data Protection Agency (Datatilsynet)

We use cookies and similar technologies on our website and Platform. Some cookies are strictly necessary for the site to function and ensure security; these do not require consent. Non-essential cookies (e.g., analytics) require your consent before they are set.

9.1 Cookie Consent

• On your first visit, we present a banner allowing you to choose: “Accept only required” (reject non‑essential cookies) or “Accept all” (consent to non‑essential cookies).
• When you log in, strictly necessary functional cookies required to provide the Platform (including feature flagging) will be active. Analytics remains opt‑in.
• You can change your choices at any time via the “Privacy” link available on every page. Withdrawal of consent is as easy as giving it and takes effect immediately.

9.2 Categories of Cookies

• Strictly necessary: enable core functionality (e.g., security, load balancing, login, runtime configuration and feature flagging for authenticated users). These are always active and do not require consent.
• Analytics (PostHog): help us understand usage to improve our services. These only run after you consent.
• Marketing (LinkedIn Insight Tag, Google tag, Reddit Pixel): measure our ads and show our ads to people who visited our website. These only run after you choose “Accept all”.

9.3 Cookies We Use

• Cloudflare: cfuvid (security and bot management; strictly necessary; session/persistent depending on challenge).
• PostHog (first‑party):
• Functional/Feature flagging: ph_phc_* and related storage limited to runtime configuration for authenticated users (strictly necessary; active when logged in).
• Analytics: ph_phc_* and local/session storage used for product analytics features (only after consent; typical lifespan up to 12 months).

9.4 Managing Your Choices

• “Privacy Policy”, at the bottom, lets you opt in/out of analytics and embedded media at any time.
• You can also clear cookies via your browser settings; doing so may reset your banner choices.

We engage third parties to process data on our behalf, including:

• Payment processing: Stripe.
• Hosting and infrastructure: cloud providers.
• Analytics: PostHog (EU).
• Third-party app connections: Composio.

Each processor is bound by a data processing agreement and appropriate safeguards.

Our services are not directed to children under 13. If you believe a child has provided us personal data, contact privacy@serpier.com.

We implement appropriate technical and organizational measures to protect personal data, including access controls, encryption in transit and at rest, encryption of connected-account credentials before storage, and regular reviews of our security posture.

We may update this policy from time to time. Significant changes will be communicated via the website or by email where appropriate. The latest version is always available on this page.

To exercise any of these rights, contact us at privacy@serpier.com.

To update your cookie preferences please click here.