Privacy Policy

Effective Date: 17th April 2026

Company: Serpier ApS, registered in Denmark

Contact Email: hello@serpier.com

1. Introduction

Serpier ApS ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share personal data when you use the Serpier platform ("Platform"). We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Danish law.

2. What Data We Collect

We collect the following categories of data:

a) Account Information

• Name
• Email address
• Organization name and associated users
• User role (Owner, Admin, Member)

b) Transaction Data

• Purchase history
• Billing details (processed via Stripe)

c) Technical Data

• IP address
• Browser type and version
• Device information
• Platform usage data (e.g. clicks, logins, page visits)

d) Communication Data

• Emails and messages exchanged with us

3. How We Use Your Data

We use your personal data to:

• Provide access to and manage your account
• Process payments and orders
• Maintain Platform security and integrity
• Improve the user experience
• Send service-related notifications and updates
• Enforce our Terms of Service
• Comply with legal obligations
• Operate runtime configuration, experimentation, and feature flagging required to deliver and tailor Platform functionality for authenticated users

4. Legal Basis for Processing

We process your data under one or more of the following legal grounds:

• Contractual necessity – to provide the services you signed up for, including functional runtime configuration and feature flagging required to operate the Platform for logged‑in users.
• Legitimate interest – to improve the Platform, prevent abuse, secure operations, and ensure stable delivery of features.
• Legal obligation – to comply with Danish accounting and legal requirements.
• Consent – for non‑essential analytics and marketing communications (if you opt in).

5. Sharing Your Data

We only share your personal data with:

• Service providers (e.g., Stripe for payment processing, cloud hosting providers)
• Publishers when necessary to complete an order (e.g., article publishing)
• Authorities or legal bodies if required by law

We do not sell your personal data to third parties.

5A. Google API Data

If you choose to connect your Google account to Serpier, we may access certain Google user data in order to provide Google Analytics functionality within the Platform.

This may include:

• Google Analytics reporting data, such as properties, sessions, users, traffic sources, page performance, ecommerce performance, and other read-only analytics insights;
• Google Analytics account and property metadata needed to identify which Google Analytics properties you can access and help you select the correct property in Serpier;
• Google Search Console account and property metadata needed to identify which Google Search Console properties you can access and help you select the correct property in Serpier;
• Basic Google account information, such as your email address and profile information, to associate the Google connection with your Serpier account.

We use this data solely to provide user-facing functionality you request within Serpier, including:

• connecting your Google account to the Platform;
• identifying and selecting the correct Google Analytics property;
• identifying and selecting the correct Google Search Console property;
• displaying analytics reports, summaries, and insights;
• supporting analytics-related workflows you initiate inside Serpier.

We only request the minimum Google permissions needed for these features. Where Serpier uses Google Analytics/Search Console read-only access, Serpier does not use that access to create, modify, or delete your Google Analytics/Search Console settings or data.

We do not use Google user data for advertising, marketing profiling, or sale to third parties.

We do not transfer or disclose Google user data except:

• to service providers acting on our behalf and subject to appropriate confidentiality and data protection obligations;
• where necessary to provide or support the specific user-facing functionality requested by you;
• for security purposes, including preventing fraud, abuse, or technical issues;
• where required by applicable law, regulation, legal process, or enforceable governmental request;
• in connection with a merger, acquisition, or sale of assets, where permitted by law and subject to appropriate safeguards.

If we store Google access tokens or refresh tokens, they are stored securely and used only to maintain the connection you authorized and provide the requested functionality.

We retain Google-connected data only for as long as necessary to provide the integration, comply with legal obligations, resolve disputes, enforce our agreements, and protect the security and integrity of the Platform.

You can revoke Serpier's access to your Google data at any time by disconnecting the integration within Serpier, where available, and/or by removing Serpier's access in your Google account permissions settings at https://myaccount.google.com/permissions.

Serpier's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, where applicable.

6. International Transfers

Where data is transferred outside the EU/EEA, we ensure adequate protection through Standard Contractual Clauses or other approved safeguards.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting obligations.

8. Your Rights

Under GDPR, you have the right to:

• Access your data
• Correct inaccuracies
• Request deletion ("right to be forgotten")
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent (where processing is based on consent)
• Lodge a complaint with the Danish Data Protection Agency (Datatilsynet)

9. Cookies and Tracking Technologies

We use cookies and similar technologies on our website and Platform. Some cookies are strictly necessary for the site to function and ensure security; these do not require consent. Non-essential cookies (e.g., analytics) require your consent before they are set.

9.1 Cookie Consent

• On your first visit, we present a banner allowing you to choose: “Accept only required” (reject non‑essential cookies) or “Accept all” (consent to non‑essential cookies).
• When you log in, strictly necessary functional cookies required to provide the Platform (including feature flagging) will be active. Analytics remains opt‑in.
• You can change your choices at any time via the “Privacy” link available on every page. Withdrawal of consent is as easy as giving it and takes effect immediately.

9.2 Categories of Cookies

• Strictly necessary: enable core functionality (e.g., security, load balancing, login, runtime configuration and feature flagging for authenticated users). These are always active and do not require consent.
• Analytics (PostHog): help us understand usage to improve our services. These only run after you consent.

9.3 Cookies We Use

• Cloudflare: cfuvid (security and bot management; strictly necessary; session/persistent depending on challenge).
• PostHog (first‑party):
  
  • Functional/Feature flagging: ph_phc_* and related storage limited to runtime configuration for authenticated users (strictly necessary; active when logged in).
  • Analytics: ph_phc_* and local/session storage used for product analytics features (only after consent; typical lifespan up to 12 months).

9.4 Managing Your Choices

• “Privacy Policy”, at the bottom, lets you opt in/out of analytics and embedded media at any time.
• You can also clear cookies via your browser settings; doing so may reset your banner choices.

1. Processors and Subprocessors
   We engage third parties to process data on our behalf, including:
   • Payment processing: Stripe.
   • Hosting and infrastructure: cloud providers.
   • Analytics: PostHog (EU).
   Each processor is bound by a data processing agreement and appropriate safeguards.
2. Children’s Data
   Our services are not directed to children under 13. If you believe a child has provided us personal data, contact privacy@serpier.com.
3. Security
   We implement appropriate technical and organizational measures to protect personal data, including access controls, encryption in transit, and regular reviews of our security posture.
4. Changes to This Policy
   We may update this policy from time to time. Significant changes will be communicated via the website or by email where appropriate. The latest version is always available on this page.

To exercise any of these rights, contact us at privacy@serpier.com.

To update your cookie preferences please click here.