Legal questions come up regularly when working with API data – how long you may keep the results, whether you can use them in a paid product, how GDPR applies, and what happens to your data after cancellation. Most of these questions can be answered directly from our three governing documents: the Terms of Service, the Privacy Policy, and the Data Processing Agreement (DPA).
In this FAQ, we answer the questions our clients ask most often, based on the current Terms of Service (12 June 2026), Privacy Policy (29 October 2026), and DPA (12 June 2026). Each answer links to the exact provisions it refers to, and you can find the latest versions of all three documents in the useful links at the end.
1. Can you confirm our product / use case complies with Section 7.1?
Unfortunately, we are unable to confirm whether a particular product or implementation complies with our Terms of Service, as we have not reviewed or assessed the specific use case, and we have no possibility to do that.
However, we can clarify that Section 7.1 of the Terms of Service establishes restrictions on the use of SERP (Search Engine Results Page) data and other content obtained through our Service. In particular, such data must not be used to compete with the search engines from which it originates or to harm their legitimate business interests.
We kindly recommend that you review the relevant provisions of our Terms of Service and assess your intended use accordingly.
The key consideration is not necessarily whether a product uses service data, but how that data is used, what the product does, and whether its use conflicts with the interests of the originating search engine provider.
For example, this could include:
- Direct competition: Using search results or ranking data to build a competing search engine or a service that replicates the search engine’s core functionality.
- Commercial exploitation: Using the collected data to create a commercial database or competing service that substitutes for the original search engine’s offering.
- Harm to business interests: Using the data in ways that divert users, advertising revenue, customers, or other commercial opportunities away from the search engine provider.
- Unfair competitive advantage: Using proprietary or restricted search data to gain a competitive advantage that would not otherwise be available under the provider’s permitted terms of use.
2. How long may we keep the data we retrieved?
The Terms of Service set no limit on how long a client keeps its own copies, and do not require deletion when service ends. The published retention figures describe DataForSEO’s own storage, not the client’s:
- Privacy Policy Section 5.a – API task data stored for 365 days; Section 6.c – data stored more than 365 days is permanently deleted from our system.
- DPA Annex I.B(7), for personal data under GDPR – 31 days for SERP API output, 7 days for HTML, 6 months for pingback/postback results, 12 months for client tasks/results/payload.
3. Can we resell, redistribute, sublicense, or give our customers raw API access?
No, not under the standard Terms. The Terms of Service grant no resale, sublicensing or redistribution right, so any onward distribution of our datasets as an untransformed standalone feed, database dump, public endpoint, or raw API service requires a separate written agreement. This includes white-label API access, MCP endpoints, marketplace actors, open datasets, and per-query wallet resale models.
4. Are there attribution, branding or display requirements?
None. Neither the Terms of Service nor the Privacy Policy imposes attribution, branding, citation, interface or format requirements on data obtained through the Service. The Terms also prescribe no transformation threshold. Any attribution owed in respect of the originating provider’s own content is a matter under that search engine’s terms, not ours.
5. Who is responsible for complying with Google’s, Bing’s, other search engines own terms?
The client is responsible for ensuring compliance with the applicable terms and conditions of Google, Bing, and any other relevant search engine providers.
Our Terms of Service do not grant any licenses from, or confer any rights under, the terms and conditions of, any upstream provider. Furthermore, Section 7.2 of the Terms of Service requires the client to indemnify, defend, and hold DataForSEO harmless against claims, damages, and losses arising from violations of Section 7.1, including the use of SERP data in a manner that infringes the terms of service or legal rights of search engine providers. Section 8.1 further clarifies that DataForSEO assumes no responsibility for the use of client accounts.
As the permissibility of a particular use depends on the applicable terms and conditions of the relevant platform, we kindly recommend that the client review the respective provider’s terms to determine whether their intended use is permitted.
DataForSEO collects only publicly available data, information that any visitor can see without logging in, creating an account, or otherwise authenticating. We do not access password-protected or gated areas, and we do not circumvent authentication controls. Collecting unauthenticated public data in this manner is lawful under applicable law.
6. Can we use the data commercially, in a paid product, shown to our own customers?
Nothing in the Terms of Service conditions use on the product being free or non-commercial. Section 3.1 makes the Service available on a pay-as-you-go and/or subscription basis. The Terms do not restrict processing API outputs into analytics, reports, dashboards or scores inside the client’s own product, or showing those to the client’s own paying users, and set no cap on end-user numbers. The limit that applies is Section 7.1.
Our Terms do not grant a right to resell, sublicense, or redistribute DataForSEO datasets as an untransformed standalone data feed, database dump, or raw API service.
7. Does Section 7.1 apply to data that isn’t SERP data?
Section 7.1 is written around “search engine results page (SERP) data” and “search engine providers,” and applies to all service data.
8. Can we feed the data into AI – inference, RAG, model training?
The Terms of Service contain no provision addressing AI processing, inference, retrieval pipelines, or training and fine-tuning of models. Section 7.1 applies to the use of the data however it is processed. Note that sending data to a third-party AI provider makes the client responsible for that processor arrangement under DPA Section 4 where personal data is involved.
As the terms governing AI processing and model training may vary between providers, we kindly recommend that you review the applicable terms and policies of the relevant originating data provider and any third-party AI provider directly to determine whether your intended use is permitted.
9. What are the GDPR arrangements?
The DPA is incorporated into the Terms of Service where GDPR applies; no separate signature is described as a precondition. Under DPA Section 2 the client is controller and DataForSEO is processor for Service Data. DPA Section 4 makes the client solely responsible for lawfulness, transparency, data subject procedures and data minimization. DPA Section 8 applies the 2021/914 Standard Contractual Clauses; Clauses 17 and 18 give Estonian governing law and forum. DPA Annex I.B(2) describes the transferred personal data as contact or other personal data appearing on a SERP; Annex I.B(3) excludes national ID numbers, credentials and sensitive data. DPA Section 7 covers data subject requests received directly by us.
10. Can our customers export or download their own records?
The Terms of Service do not address or restrict how a customer selects, stores or exports individual records inside their own workspace, including CSV export of derived analysis. The line to watch is point 3: an export that amounts to handing over our dataset as such is distribution, not in-product use. Where an export is designed to deliver raw or near-raw API responses to third parties is considered a violation of Terms of Service.
11. Do we need an additional license, license tier, or enterprise agreement?
The published documents set no commercial/non-commercial license tiers, no endpoint or volume minimums, and no separate data license. Access is as described in Section 3.1 of the Terms of Service. A separate written agreement is required only for distribution outside the standard terms.
12. We’re based in a certain country – are we eligible?
Section 6.2 of the Terms of Service prohibits access and use by anyone located, incorporated or otherwise established in, or resident of: the Russian Federation, Belarus, Cuba, Iran, Syria, Myanmar, North Korea, and Crimea and the Ukrainian territories temporarily occupied by the Russian Federation. Section 6.1 reserves our right to refuse, cancel or suspend service at our sole discretion. Sanctions or export control obligations arising under other law are outside these documents.
13. Can we run many unrelated end clients through one account?
The Terms of Service do not require separate accounts per end client. Section 2.a of the Privacy Policy makes the account holder fully responsible for all activities occurring under the account, whether authorized or not; Section 8.1 of the Terms of Service states DataForSEO holds no responsibility for the use of clients’ accounts. Giving those end clients direct API access is a distribution question (point 3), not a multi-tenancy question.
14. What happens to data we already hold if we cancel?
The Terms of Service do not require deletion of the client’s own copies on cancellation. However, please note that the restrictions set out in Section 7.1 continue to apply to any data retrieved prior to termination.
15. Can you delete our data on request / do you offer zero data retention?
We do not offer zero data retention. Data is processed and stored in the ordinary course of providing the Service, subject to the retention periods and deletion rights described below.
Privacy Policy Sections 8.a and 8.b give rights of access, rectification, erasure and restriction over personal data, with account deletion available in-profile; Privacy Policy Section 6.b offers export to CSV or JSON on request within five business days. DPA Addendum I Clause 8.1(d) covers deletion or return at the end of processing.
Furthermore, all client data stored by us may be deleted upon the client’s request, and all data associated with a client account is deleted if the client deletes that account. The only exception is data that must be retained to meet DataForSEO’s accounting and tax obligations under Estonian law, which is kept for the statutory retention period and then deleted.
16. Who are your sub-processors, and how are changes notified?
Privacy Policy Section 7.b lists the current processors. DPA Sections 9.3 – 9.4 cover sub-processor change notifications, 30 days’ notice of changes, a 14-day objection window with termination as sole remedy, and our continuing liability. Third-country transfers rely on SCCs or adequacy (Privacy Policy Section 7.c).
17. What law governs, and where are disputes heard?
DPA Clauses 17 and 18 give Estonian law and the courts of the Republic of Estonia for the Clauses. The contracting entity is DataForSEO OÜ, company No. 14502291, Tallinn, Estonia.
18. Useful links
- Latest version of the Terms of Service
- Latest version of the Privacy Policy
- Latest version of the Data Processing Agreement (DPA)
If your question isn’t covered in this FAQ, don’t hesitate to contact our support team.