Privacy Policy

openSERP uses account identity, usage and payment records to provide search APIs, account access, billing and service monitoring. Google and GitHub provide sign-in identity. Stripe processes payments; openSERP does not store full card details.

Search data

Your query and selected search parameters are sent to the chosen search provider. If you request Markdown, the organic result URLs are sent to ScrapingDog or ScrapingBee. These providers process requests under their own policies.

Normalized search results and the parameters needed to identify them may be shared across accounts. All cacheable requests have a five-minute reuse window, including requests with caching disabled. Enabling extended caching allows the chosen longer age. Dedicated full-page Markdown response caches are private to the account. No-expiration cached results remain until refreshed, purged or invalidated. Coordinates bypass cache reads and writes. Private Markdown artifacts and account records are not shared.

Usage and security

Free-query and key-issuance quotas use a keyed hash of an IPv4 address or IPv6 /56 prefix. When an anonymous visitor first creates an API key, we separately record the edge-provided IP address, network prefix, approximate country, region, city, timezone and ASN/network owner for account administration and abuse prevention. Cloudflare is the primary source. Missing fields may be looked up using FreeIPAPI or ipapi.is, which receive the IP address for that purpose. These first-key network details are visible only to the main site administrator and expire after 28 days. A private, network-hashed lookup cache lasts up to 24 hours. Signing in attaches the original network record to the account without changing its capture time or extending its retention. Cloudflare processes network request information to deliver the service. API keys and session tokens are stored as keyed hashes. Operational attempt details are retained for 35 days; billing and security records may be retained longer as required to operate the service and meet legal obligations.

Anonymous account expiry

Unclaimed anonymous visitor accounts and their API keys expire 30 days after the first key is created. Signing in in the original browser before expiry keeps the keys and attaches their history to the signed-in account. Creating another anonymous key does not extend the account’s expiry. Expired account identities, key hashes, visitor sessions, projects and private response receipts are removed in bounded scheduled cleanup. Network records already expire after 28 days. Usage counts, outcomes, cache hits and source expenses are combined into a read-only historic account; daily aggregate totals are retained beyond the 35-day operational detail window. Temporary opaque cleanup IDs are retained for 35 days after retirement to safely finish storage deletion and attribute delayed telemetry. Shared search caches retain their existing policy. Financially linked accounts are preserved for reconciliation.

Account choices

You can revoke keys and agent connections, disable auto-recharge and link identities explicitly. Contact l@rehmann.co for account access, deletion or privacy requests. Necessary financial records may be retained after an account is closed.