Privacy Policy

Version 2026-07-02

This Privacy Policy describes how NorfBay LLC, doing business as SerpCalls ("SerpCalls," "we," "us") collects, uses, shares, and protects information when you use serpcalls.com and related services (the "Service"). By using the Service, you agree to this Policy.

1. Who we are

SerpCalls is a software-as-a-service for tracking local-search rankings for service businesses. For EU/UK GDPR purposes we are the data controller of account data and a data processor of data you submit about your own customers or businesses.

2. What we collect

From you

• Account: name, email, hashed password, optional profile image, optional 2FA secret, optional WebAuthn passkey credentials.
• Organization & billing: organization name, Stripe customer and subscription IDs, plan, billing email. Payment card details are submitted directly to Stripe and are never stored on our servers.
• Workspace configuration: the businesses you track — names, domains, Google Place IDs, target cities, keywords, grid points, check cadences.

Automatically

• Session & device: session tokens (httpOnly cookies), IP address, user agent, login timestamps. IP addresses are not retained for more than 14 days.
• Operational logs: request paths, status codes, timing, request IDs. Retained for 3 days.
• Error monitoring: when the Service hits an unexpected error, we send diagnostic details — the error type and message, a stack trace, and the request path and method — to our error-monitoring provider (Sentry) to detect and fix problems. We do not intentionally include your account, password, or billing details.
• Cookies: only strictly-necessary cookies for authentication and CSRF protection. We do not use Google Analytics, Meta Pixel, or any third-party advertising or marketing cookies.

From prospects (our free tools)

Our public free rank-check tool and our access-request form collect the business domain, city, and keyword you enter, and — if you request full results — your name, email, and business name. We use this to run the check you asked for and to follow up with you about SerpCalls. It is stored as a lead/signup record; you can ask us to delete it at privacy@serpcalls.com.

From public sources, on your behalf

When you configure a workspace, the Service queries public search and business-data sources and stores the results for trend analysis:

• Google Search organic, Local Service Ads, and Map Pack results for the keywords and locations you specify;
• Google Business Profile metadata (ratings, review counts, review text, author names, business responses) for locations you track;
• Competitor business names and domains observed in SERPs;
• AI-visibility check results (whether a business appears in AI search-engine answers).

From Google, with your authorization

If you connect a Google account, SerpCalls accesses the following through Google OAuth, using refresh tokens you grant and can revoke at any time (in-app or from your Google account):

• Google Search Console (read-only): your verified sites and their search impressions, clicks, and average positions.
• Google Analytics (read-only, optional): aggregate session and traffic metrics for properties you select.
• Google Ads (read-only): the ad accounts you can access and their spend metrics, used to compute return on ad spend.
• Google Business Profile (only if you separately enable publishing): your business locations and reviews, and the ability to publish review replies and posts you have approved.

Google API Services — Limited Use.SerpCalls's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features described above. We do not sell it, do not use it for advertising, and do not use it to train generalized artificial-intelligence or machine-learning models. Humans do not read your Google user data except with your explicit consent, for security or abuse investigation, or where required by law.

What we don't collect

We do not collect Social Security numbers, government IDs, biometric, financial-account, or health data. We do not knowingly collect data from children under 13.

3. How we use it

• Provide and operate the Service you pay for.
• Authenticate you and enforce multi-tenant isolation.
• Process payments, renewals, and send billing notices.
• Send transactional email (account verification, password reset, billing receipts, service alerts).
• Respond to support requests.
• Monitor, secure, and improve the Service, including detecting abuse and fraud, and meeting rate-limit obligations to our upstream providers.
• Comply with legal obligations and enforce our Terms.

We do not sell your data. We do not share it for cross-context behavioral advertising. We do not use it to train third-party AI models.

Legal bases under GDPR: contract performance, legitimate interests (security and product improvement), consent where required, and legal obligation.

4. Who we share with (sub-processors)

We use the following processors to operate the Service. Each is bound by contract to protect your data and use it only for the purpose we specify.

We also disclose information to comply with law, valid legal process, or government requests; to enforce our Terms; and to protect rights, property, and safety. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

5. AI-generated outputs

Insights, recommendations, and draft review replies and posts are generated by Cloudflare Workers AImodels running on Cloudflare's infrastructure. Prompts are built from your workspace configuration, public SERP data, and — when drafting a reply to a review — the public review text and reviewer display name shown on the Google Business Profile you track. We do not include your account, password, or billing details in prompts, and prompt data is not used to train generalized AI models.

6. Retention

• Account profile: life of the account; deleted within 30 days after closure.
• Session records: until expiry or logout; purged within 90 days.
• Workspace configuration: life of the account plus 30 days.
• Rankings: up to 2 years of history. Raw SERP payloads are dropped after 14 days to keep storage bounded; derived structured records remain.
• Operational logs: 3 days.
• IP addresses: 14 days.
• Billing records: 7 years (tax / accounting compliance).
• Backups: up to 35 days rolling.

7. Security

We use administrative, technical, and physical safeguards, including TLS in transit, encryption at rest, password hashing with HIBP screening, support for TOTP 2FA and WebAuthn passkeys, PostgreSQL row-level security scoped by workspace, least-privilege staff access, and audit logging for administrative actions. No system is perfectly secure. If you suspect your account is compromised, contact security@serpcalls.com immediately.

8. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• delete your data (right to be forgotten);
• export your data in a portable format;
• restrict or object to certain processing;
• withdraw consent where processing is consent-based;
• lodge a complaint with your supervisory authority (EU/UK) or state Attorney General (US).

You can view and update most account and workspace data directly in the app. To delete your account and its associated data, to disconnect and revoke a connected Google account, or to exercise any other right, email privacy@serpcalls.com and we will action the request — account and workspace data are deleted within 30 days of a verified request. We respond within 30 days (CCPA: 45 days, with one 45-day extension if necessary).

California residents (CCPA/CPRA): we do not sell or share personal information for cross-context behavioral advertising. EU/UK residents (GDPR): we do not make automated decisions with legal or similarly significant effects.

9. International transfers

Personal data may be processed in the United States and other countries where our sub-processors operate. Where required, we rely on Standard Contractual Clauses or other approved transfer mechanisms.

10. Changes to this Policy

We may update this Policy. Material changes will be announced by email or in-app notice at least 15 days before they take effect. The version date at the top indicates the current version.

11. Contact

Privacy questions: privacy@serpcalls.com
Security: security@serpcalls.com
Data subject requests: privacy@serpcalls.com
Mailing address: NorfBay LLC, 4402 Montgomery Dr, Santa Rosa, CA 95405