Privacy Policy — serp.cheap

Effective date: 15 June 2026

Compatible with the Brazilian LGPD (Law No. 13.709/2018), with reference to the GDPR for EU customers. It applies to all customers; EU customers have additional rights under the GDPR. The English text is the official version; translations are provided for convenience.

This Policy explains how WILLIAM BITTENCOURT MORAES SOLUÇÕES EM DESENVOLVIMENTO, registered under CNPJ 29.785.688/0001-44, with registered address at Rua Barão de Santo Ângelo, 185, São Judas Tadeu, Gravataí - RS, CEP 94075-090 (“serp.cheap”, “we”, “us”), processes personal data. For questions: [email protected].

1. Who is the Controller

For registration, account, billing, and Service-usage data, serp.cheap acts as the Controller. When you use the API to submit queries that return third-party data, the processing of that returned data is your responsibility (see Section 8 and the DPA).

2. Data we collect

You provide to us: name, email, registration data, and, for payment, billing data (the card number is handled directly by Stripe — we never see it).

Collected automatically: IP address, device/browser identifiers, API request metadata (key used, time, search parameters, volume), technical logs, and usage data, including via cookies on the website.

Search content: we record query metadata to operate the Service, bill, prevent abuse, and improve the product.

3. Why we use it (purposes and legal bases — LGPD art. 7)

Perform the contract (deliver the Service, authenticate, bill): performance of contract.
Operate, protect, and improve the Service (logs, security, anti-fraud, analytics): legitimate interest.
Transactional communications (account notices, changes to these documents): performance of contract / legitimate interest.
Marketing (newsletter, news): consent, with opt-out at any time.
Comply with legal/tax obligations: compliance with a legal obligation.

4. Cookies

We use essential cookies (operation and security) and, subject to consent, analytics cookies. You can manage them in your browser settings.

We do not sell personal data. We share with processors strictly necessary to operate the Service, each handling data only under our instructions and the law:

Payment processing: Stripe, Inc. (USA) and cryptocurrency processors, where applicable.
Hosting and infrastructure: Contabo GmbH (Germany) and Amazon Web Services — AWS Lambda (United States).
Analytics and product metrics: Matomo and other analytics tools we adopt to understand usage and performance.
Marketing and communication: transactional/marketing email tools and marketing platforms we adopt (sending notices and, subject to consent, news).
Relationship management and support (CRM): ClickUp and other CRM/management tools we use for support and managing the customer relationship.
Monitoring and logs: observability and technical logging tools.

We may disclose data if required by a competent authority or to protect rights, in accordance with the law.

6. International transfer

Part of our infrastructure and processors are outside Brazil — in particular hosting in Germany (Contabo) and the United States (AWS Lambda), plus payment, analytics, marketing, and CRM processors based abroad. By using the Service, your account, billing, and usage data are transferred to and processed in those countries. We adopt appropriate safeguards under the LGPD for these international transfers and, for EU data subjects, mechanisms under the GDPR (such as Standard Contractual Clauses — SCCs).

7. Retention

We retain personal data for as long as necessary for the purposes above or as required by law (e.g., tax obligations). Technical logs have limited retention. Once the purpose ends, we delete or anonymize the data, except where mandatory legal retention applies.

8. Data returned by the API (important)

Search results may contain publicly available personal data of third parties. With respect to that data, you (the Customer) are the Controller and are responsible for having a legal basis and for processing it in accordance with applicable data-protection law. We act as Processor with respect to that flow, under the terms of the DPA.

9. Your rights (LGPD art. 18)

You may request: confirmation of processing, access, correction, anonymization/deletion, portability, information about sharing, and withdrawal of consent. To exercise them, write to [email protected]. We will respond within the periods set by law. You may also lodge a complaint with the relevant data-protection authority (in Brazil, the ANPD).

10. Security

We adopt appropriate technical and organizational measures (encryption in transit, access control, access logging). No system is 100% secure; in the event of a relevant incident, we will act in accordance with applicable data-protection law, including notification where applicable.

11. Minors

The Service is intended for persons aged 18 or older. We do not knowingly collect data from minors.

12. Data Protection Officer

For privacy enquiries and to exercise your rights, contact [email protected].

13. Changes

We may update this Policy by posting a new version with an effective date and notifying you of material changes.

Privacy contact: [email protected]

Privacy Policy