Version of 18 October 2026 Document address: https://serpmode.com/legal/privacy/
This is an English translation of the Russian original: https://serpmode.com/ru/legal/privacy/. In case of any discrepancy, the Russian version prevails.
1. General provisions
1.1. This Policy describes how Individual Entrepreneur Ilya Aleksandrovich Abaev (the Operator, “we”) processes and protects personal data. The Policy is adopted under Part 2 of Article 18.1 of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (the Personal Data Law).
1.2. The Policy applies to personal data the Operator receives:
- on the website https://serpmode.com (the Website);
- in the SerpMode service at https://app.serpmode.com (the Service);
- in the SerpMode Telegram bots: the notification bot and the support bot @serpmode_support_bot;
- in email correspondence.
1.3. The Policy does not apply to third-party websites linked from the Website or the Service, including link exchange websites.
1.4. The person responsible for organizing personal data processing is Ilya Aleksandrovich Abaev. Personal data requests: info@serpmode.com.
2. Terms
- Personal data — any information relating to a directly or indirectly identified or identifiable individual.
- User — a person registered in the Service.
- Visitor — a person using the Website without registration.
- Processing — any action with personal data: collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer (provision, access), depersonalization, blocking, deletion, destruction.
Other terms have the meaning given in the Personal Data Law.
3. Principles
We process personal data lawfully and only for predefined purposes. We collect only the data needed for those purposes. We keep it no longer than the purpose or the law requires. Once the purpose is achieved, we destroy or depersonalize the data.
4. Purposes, data, legal grounds and retention periods
| Purpose | Data | Data subjects | Legal ground | Retention period |
|---|---|---|---|---|
| Registration, sign-in and use of the Service | Email, password (as a hash), field of activity specified at registration, first and last name (if entered in settings), interface language, Sape project number (if entered), API token, catalog settings, lists and exports | Users | Performance of a contract (Clause 5, Part 1, Article 6 of the Personal Data Law) | Until the account is deleted |
| Payment, auto-renewal, payment records | Email, payment and subscription history, internal balance, payment method ID at the payment service, masked card number (first 6 and last 4 digits), card network, card expiry date | Users | Performance of a contract | Until the account is deleted. Payment records — 5 years (Subclause 8, Clause 1, Article 23 of the Russian Tax Code) |
| Cash receipts | Email, amount, item name | Users | Legal obligation (Clause 2, Part 1, Article 6), Federal Law No. 54-FZ | 5 years |
| One-time trial period | Hash of the first 6 and last 4 card digits and the card expiry date | Users | Legitimate interest of the Operator (Clause 7, Part 1, Article 6) — preventing repeated trials | Until the end of the card’s expiry month. If the expiry date is unknown — 5 years |
| Service notifications | Email; Telegram chat ID — if you connected the notification bot | Users | Performance of a contract; for Telegram — consent (Clause 1, Part 1, Article 6) | Email — until the account is deleted. Chat ID — until the bot is disconnected |
| Replies to inquiries by email and in Telegram, including automatic replies from the AI assistant in Telegram | Email, name (if provided), message text and attached files; in Telegram — ID, name and username. Only the text of the question is passed to the AI assistant; emails, phone numbers, card numbers and API tokens in it are masked | Users and Visitors | Performance of a contract; for Visitors — entering into a contract at their request | Email: Users — until the account is deleted, Visitors — 1 year after the last email. Telegram — 1 year after the last inquiry |
| Security | IP address, browser data (User-Agent), sign-in and session data, security events, Yandex SmartCaptcha data | Users and Visitors | Legitimate interest of the Operator — protecting the Service and accounts | Security events — 90 days. Server logs — 30 days. Sign-in attempt counter — 4 hours. Session — until sign-out or up to 90 days with “Remember me” |
| Consent records | Consent type, document version date, date and time, IP address, method (checkbox, setting, letter) | Users | Obligation to prove consent (Part 1, Article 9 of the Personal Data Law; Part 1, Article 18 of the Advertising Law) | Until the account is deleted. After data deletion the IP address is erased; the rest is kept for 5 years |
| Traffic analytics | Cookies, Yandex Metrica data: pages viewed, referral source, device and browser type, approximate location | Visitors and Users | Legitimate interest of the Operator (Clause 7, Part 1, Article 6) — improving the Website and the Service | Cookies — until deleted in the browser; Metrica data — under Yandex rules |
| Marketing and informational mailings | Email; Telegram chat ID | Users | Separate marketing consent (Part 1, Article 18 of the Advertising Law; Article 15 of the Personal Data Law) | Until consent is withdrawn |
| Data destruction log | Account number, email and name before deletion; for Telegram correspondence — ID and username; date of request and deletion | Former Users; persons whose Telegram correspondence has been deleted | Legal obligation (Roskomnadzor Order No. 179 of 28.10.2022) | 3 years |
| Backups | All of the above as part of a database copy | Users | Same as the source data | Up to 32 days, then the copy is deleted automatically |
5. Where we get data from
- From you — at registration, in the Service settings, when paying, in correspondence by email and in Telegram.
- Automatically — IP address, browser data, cookies.
- From the payment service — masked card number, card network, expiry date and payment method ID. The full card number and CVC are entered only on the payment service page and never reach us.
6. Cookies
6.1. Cookies are small text files that a website stores in your browser.
6.2. We use:
| Type | Purpose | Examples | Consent required |
|---|---|---|---|
| Necessary | Signing in to the Service, form protection, language, remembering dismissed notices | Session and form-protection cookies in the Service, pll_language, my_popup_hide | No: the Website and the Service do not work without them |
| Analytics | Visit statistics | Yandex Metrica (_ym_*) | No. Legal ground — the Operator’s legitimate interest. A notice informs you about cookies on your first visit |
6.3. You can block or delete cookies, including analytics cookies, in your browser settings. The Service will not work without necessary cookies.
7. Who receives the data
7.1. We do not sell personal data and do not share it with third parties for their own advertising.
7.2. Data is received only by the parties listed below, to the extent needed for their function.
| Recipient | Function | Data | Where processed |
|---|---|---|---|
| Beget (beget.com) | Hosting of the Website and the Service | All Service data | Russia |
| Selectel (selectel.ru) | Storage of encrypted backups | Database backups | Russia |
| smtp.bz, IE A. M. Tutaev | Sending emails on behalf of the Operator | Email, message text. Message texts are kept up to 14 days, delivery logs up to 365 days | Russia |
| YooKassa (yookassa.ru) | Accepting payments, saving the payment method for auto-renewal, cash receipts | Email, amount, card data (entered on their page) | Russia |
| Fiscal data operator and the Russian Federal Tax Service | Transmission of cash receipts (Federal Law No. 54-FZ) | Email, amount, item name | Russia |
| Yandex (yandex.ru) | Yandex Metrica, Yandex SmartCaptcha protection of forms and the catalog | Cookies, IP address, browser data | Russia |
| RuTube (rutube.ru) | Video player on the Website | IP address, browser data | Russia |
| Telegram (telegram.org) | Delivery of notifications, if you connected the notification bot, and of support correspondence, if you wrote to @serpmode_support_bot | Chat ID, Telegram name and username, texts of notifications and correspondence | Outside Russia |
| Government authorities | On request in cases provided by law | To the extent of the request | Russia |
7.3. Parties processing data on our behalf must keep it confidential and comply with the Personal Data Law.
8. Cross-border transfer
8.1. Transfers outside Russia take place only via Telegram and only in two cases:
- notifications — if you connected the notification bot in the Service “Settings”;
- support correspondence — if you wrote to @serpmode_support_bot yourself.
8.2. Both are your choice. You can disconnect the notification bot in “Settings” or by blocking it in Telegram. Instead of Telegram support, you can write to support@serpmode.com — we will reply in the same way.
8.3. Cross-border transfer is carried out in compliance with Article 12 of the Personal Data Law, including notification of Roskomnadzor.
9. Storage and localization
Personal data of Russian citizens is recorded, systematized, accumulated, stored, clarified and retrieved using databases located in Russia (Part 5, Article 18 of the Personal Data Law).
10. How we protect data
- Servers and backups are located in Russia. Backups are encrypted.
- Passwords are stored only as hashes; we do not know your password.
- Connections to the Website and the Service are encrypted (HTTPS).
- Only the Operator has access to the data.
- One account — one active session. Signing in from a new device requires confirmation, and we notify you by email.
- After three wrong passwords, sign-in is blocked for 4 hours. Forms and the catalog are protected by a captcha.
- Backups and monitoring of security events.
11. Your rights
11.1. You have the right to:
- receive information about the processing of your data (Article 14 of the Personal Data Law);
- demand that your data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose;
- withdraw your consent to data processing;
- unsubscribe from marketing mailings;
- appeal the Operator’s actions to Roskomnadzor or in court.
11.2. To exercise your rights, write to info@serpmode.com from the email address of your account. Our Telegram support will explain how to do this, but the request itself must be sent by email from the account address — this is how we make sure that the account holder is writing.
11.3. Response times:
- we answer requests for information within 10 working days. The period may be extended by 5 working days with an explanation;
- we correct inaccurate data within 7 working days;
- after consent is withdrawn, we stop processing and destroy the data within 30 days unless there is another legal ground to continue.
11.4. You can unsubscribe from marketing at any time:
- via the “Unsubscribe” link in an email;
- in “Settings → Events” in the Service;
- with the button in the Telegram notification bot.
12. Deleting your account and data
12.1. To delete your account and data, write “Please delete my account and data” to info@serpmode.com from the email address of your account. We will delete them within 30 days. If you have written to Telegram support, include your Telegram username in the email — we will delete that correspondence as well.
12.2. After deletion, the following remains:
- payment records — 5 years, as required by tax law;
- an entry in the data destruction log — 3 years, as required by Roskomnadzor;
- consent records without the IP address — 5 years;
- a hash of the card digits used to grant the trial period only once — until the end of the card’s expiry month, or 5 years if the expiry date is unknown;
- data in backups — until they are deleted automatically, no longer than 32 days.
13. Incidents
In the event of a personal data leak, we notify Roskomnadzor within 24 hours and report the investigation results within 72 hours (Part 3.1, Article 21 of the Personal Data Law).
14. Changes to this Policy
14.1. The current version is published at https://serpmode.com/legal/privacy/. Previous versions are listed in the “Versions” section at the end of this Policy.
14.2. We notify Users by email about material changes — new purposes, data types or recipients. If a new purpose requires consent, we will ask for it separately.
15. Operator
| Operator | Individual Entrepreneur Ilya Aleksandrovich Abaev |
| Taxpayer ID (INN) | 772609458203 |
| State registration number (OGRNIP) | 326774600783249 |
| Address | 7 bldg. 2, Artekovskaya St., Moscow, 117556, Russia |
| Personal data requests and general questions | info@serpmode.com |
| Technical support | support@serpmode.com |
16. Versions
- 18 October 2026 — current version.