Your privacy at SerenAI
Published:
Who we are
SerenAI is a wellbeing companion provided by SerenAI Labs, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States. We are responsible for how your information is used. You can reach our privacy contact at [email protected].
You share personal things with Serena. This page says plainly what happens to them.
This notice explains how we handle your information under the General Data Protection Regulation (GDPR).
What we collect
You choose what to share in your conversations. This can include sensitive information about your health, relationships, beliefs or personal life. Please avoid sharing identifying details about other people when they are not needed.
| Category | What it includes |
|---|---|
| Account and access | Phone number, account identifiers, language, time zone, sign-in and consent records |
| Conversations and memory | Messages and replies, information remembered for continuity, summaries and insights |
| Voice and uploads | Audio, transcripts, images, documents and generated voice when you use these features |
| Purchases | Subscription, receipt, payment status, store and entitlement information |
| Device and service use | Device and app version, session and push identifiers, diagnostic events, IP-related information and usage |
| Campaigns and links | Campaign, referral, click and advertising identifiers, attribution and purchase events |
| Support | Information and attachments you send us, and records of how we handle your request |
We receive information from you, your device, the stores and payment services you use, and providers that help deliver, secure or measure the service. Memory and insights can be generated from what you share; they can be incomplete or mistaken.
Why we use it
| Purpose | Why we may process it |
|---|---|
| Sign you in and provide your account or purchase | To provide the service you request and meet our contract with you |
| Respond to your conversations, use memory and provide voice features | Your consent, including explicit consent for your own sensitive information |
| Handle support and privacy requests | To help provide your service, meet legal duties and resolve concerns |
| Protect accounts, diagnose failures and prevent repeated free trials | Our legitimate interest in a reliable service and proportionate fraud prevention |
| Optional analytics, advertising measurement and website replay | Your permission where consent is required; these are separate from sensitive conversation processing |
| Maintain necessary financial or legal evidence | Applicable legal duties and our legitimate interest in resolving claims |
We do not use your wellbeing conversations or derived wellbeing profiles to target advertising. A trial-eligibility hash helps apply the one-trial-per-phone rule. A hash is still personal information when it can be linked to you.
Conversations may mention other people. We limit this incidental information to the conversation's purpose and protect it with the same access safeguards. We do not routinely contact those people about what you have said.
Who sees it
Providers help us host the service, process AI and audio, deliver sign-in codes and notifications, handle purchases, diagnose failures and measure usage. Our provider list explains their roles, including services used for company operations.
Anthropic's commercial API terms do not permit training on your inputs and outputs by default, and ordinarily allow retention for up to 30 days, with stated safety, legal and feature exceptions. Google's paid Gemini API terms do not use paid inputs and outputs to improve its products; security and abuse-prevention logging can still occur. ElevenLabs model improvement is switched off in our workspace. This is not a promise of zero retention or removal from past training.
Authorized staff may access information when needed for support, a verified privacy request, security or another approved service task. Sensitive stored content is encrypted, but our backend and the AI or audio providers need readable information to process your request. That means it is not end-to-end encrypted.
Push notifications may include a preview of a reply. Your device settings affect where that preview appears, including on the lock screen. Notification services and your device may retain delivered notifications. We no longer run conversations over WhatsApp. It is used only for sign-in codes and for moving old accounts, and the provider may keep its own records of past messages.
Payment and app-store providers also use some information for their own legal, fraud-prevention and account purposes. Their privacy notices apply to that use. We may disclose information where legally required or necessary to protect rights and safety, with the scope limited to the reason for disclosure.
Where it is processed
SerenAI is based in the United States. Our current production database and primary hosting are in Europe, while some development, support, AI, audio and other provider processing takes place in the United States and other countries. European hosting does not mean every service or remote access stays in Europe.
Our providers' data-processing agreements use EU-approved contract terms for the transfers they cover. Some recipients have separate roles and safeguards. You can ask [email protected] for information about the safeguards that apply to your data or a copy of the relevant terms.
How long we keep it
Our inactivity policy is 24 months without account activity, followed by a 30-day warning period before deletion. Opening the app or sending a message keeps your account active. Automatic inactivity deletion is currently disabled while the warning and review process is introduced.
We retain account information, conversations, archives and memory while they are needed to provide your service, subject to your choices and applicable rights. Moving an older conversation into an archive does not delete it.
You can request account deletion. Some information may remain where needed for financial duties, security, consent evidence, fraud prevention or legal claims. We limit it to that purpose. A retained trial-eligibility hash helps prevent repeated trials. Providers have their own retention periods and legal exceptions.
Some copies can remain in restricted backups after account deletion. Offline devices, device backups and notifications already delivered may also retain copies. We cannot promise that deleting your server account immediately removes every such copy. Ask us about the retention criteria for a particular category.
Your choices and rights
In Settings → Privacy, “Request my data” opens an email draft to our support team with an account reference. It does not include your phone number or conversations, and you decide whether to send it. You can also choose “Withdraw consent”. After two confirmations, Serena pauses: no new replies, check-ins, offers, insights or push notifications are sent. Your conversations stay saved and account deletion remains available. Choose “Give consent again” on the paused screen to continue; we record the withdrawal and renewed consent times.
Contact [email protected] to request access, a copy, correction, deletion, restriction, or transfer of eligible information. You can object to processing based on legitimate interests and object to direct marketing at any time. You can withdraw consent without changing the lawfulness of earlier processing. Tell us which purpose you want to stop; withdrawing sensitive-content consent affects the conversation features that need it.
We may need proportionate information to confirm your identity. We normally respond within one calendar month. If a lawful extension or exception applies, we explain it. You do not need a paid account or legal wording to make a request. You can also complain to a data-protection authority, including one where you live or work.
You can manage notification permissions in your device settings and use the account deletion route in the app's privacy settings. Deleting an account, cancelling a store subscription and requesting a refund are separate actions; check the store's subscription controls.
We do not use SerenAI to make wholly automated decisions that have legal or similarly significant effects on you. AI replies and memory can be wrong; you can ask us to help correct information.
Cookies and tracking
Use “Privacy choices” in the website footer to reopen the banner at any time. “Reject all” prevents Google tools from loading on subsequent pages. If you change an earlier acceptance, our website stops sending new optional measurement events and the next page starts without Google tools. Tools already loaded may finish earlier work; changing your choice cannot recall information already sent. Your choice applies across pages that share this banner.
The website uses necessary storage for sign-in, security and your privacy choice. Optional website tracking and session replay load only after you choose “Accept all”. Your website choice is remembered for 180 days.
The app uses device and campaign services, including Firebase, Adjust and Meta, and its controls depend on the app version and device permissions. Website choices do not automatically change every app or device setting. See the cookie notice for more detail or contact us for help with your choices.
Children
SerenAI is intended for adults aged 18 and over. If you believe a child has provided information, contact us so we can review and handle it.
Changes
We update this notice when our practices change. We will make the current version available with its publication date and explain material changes through an appropriate service channel.
Contact
For questions or privacy requests, email [email protected] or write to SerenAI Labs, Inc. at the address above. Because of our size we have a privacy contact rather than a formal data protection officer. An EU representative has not yet been appointed; you can contact us directly about EU privacy matters.