Legal
Privacy Policy
Last updated: July 25, 2026 · Kadiaak OÜ · GDPR
In short: we store your account details, the keywords and domains you track, and the positions we record for them. If you connect Search Console we read your query list — read-only, revocable, never written to. We don't sell anything to anyone, and we don't track you across the web.
1. Data controller
The data controller is Kadiaak OÜ, Sepapaja tn 6, 15551 Tallinn, Harju Maakond, Estonia (reg. no. 16357744, VAT EE102437021), operating the SerpFollow service.
2. What we collect
For account holders, we process:
Account data — email address, name, hashed password, plan and billing status. Payments are handled by our payment provider; we never store card numbers.
Tracking data — the domains and keywords you add, the countries you track them in, and the daily positions we record for them.
Alert channels — the email addresses and Slack webhook URLs you configure to receive alerts.
Technical logs — IP address, browser and usage events, kept for security and debugging.
We use privacy-friendly, cookieless analytics for aggregate traffic counts. There are no advertising cookies, no third-party trackers and no cross-site profiling on this website.
3. Search Console access
Connecting Google Search Console is optional and exists for one purpose: importing your existing queries so you don't have to type them.
Read-only — we request the read-only Search Console scope. We cannot change your property, submit sitemaps or remove URLs.
What we keep — the property you selected and the queries you chose to track, with their impressions, clicks and average position at import time. Queries you didn't select are discarded.
Revoke anytime — from your settings, or from your Google account's third-party access page. Revoking stops the import; the keywords you already track keep working.
Never used for anything else — Google user data is used solely to provide this import. It is not sold, not shared, not used for advertising and not used to train models.
4. Ranking data
To record a position we request public, unpersonalised Google results for your keyword and location and store where your domain appeared, plus the surrounding top-50 listing. Those results are public information, not personal data about you, and we keep them so your charts have history.
5. Retention
Position history is kept for the retention window of your plan (90 days to 24 months). Account data is kept while your account is active and deleted within 30 days of closure, except where law requires longer retention — invoices, for example, are kept seven years. Technical logs are rotated after 90 days.
6. Subprocessors
We use a small number of subprocessors to run the service: cloud hosting inside the EU, a SERP data provider, transactional email delivery, and payments. They act on our behalf under data processing agreements. The current list is available on request and we'll announce changes on this page.
7. Your rights
Under the GDPR you can access, rectify, export or delete your personal data, object to or restrict processing, and lodge a complaint with a supervisory authority — in Estonia, the Andmekaitse Inspektsioon. Export and deletion are self-service from your account settings; for anything else, write to us and we answer within 30 days.
8. Contact
Privacy questions and requests: through the contact options on this website, or by post to Kadiaak OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia.