Serasmart AISerasmart AI Privacy Policy
This Privacy Policy explains which personal data we process when you use Serasmart AI, why, on what legal basis, to whom we disclose it, how long we keep it and what rights you have. It is drawn up in accordance with Regulation (EU) 2016/679 (the "GDPR"), Romanian Law no. 190/2018 on measures implementing the GDPR and Romanian Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector. Capitalised terms (for example User, Account, User Content, Outputs, Third-Party Model, Connector) have the meaning given in the Serasmart AI Terms and conditions.
1. Who the controller is and how to contact us
1.1 The controller of your data is SERANO CONSULT SRL, sole registration code 25281467, trade register number J2009000644234, with its registered office at [to complete: sediu] (hereinafter "we"). We decide the purposes and means of the processing described in this Policy.
1.2 For any question or request about your personal data you can write to us at support@serasmartai.com. The same address is used to exercise the rights described in section 9.
1.3 This Policy applies to the serasmartai.com website, the installable phone app, the Windows app, the phone app that runs through Cloudflare and access through the API, wherever you use Serasmart with your Account. In the Windows app, part of the data (for example conversations, files and settings) may be kept by the app's local service, in its data folder on your computer.
1.4 This Policy does not apply to third-party sites, apps and services that you open from Serasmart (for example the Stripe payment page or the apps you connect). They have their own policies.
2. What data we process
2.1 Account data. E-mail address, name, password (we keep only a bcrypt fingerprint of it, not the password itself), the role and status of the Account, the date of creation and the date of the last sign-in. At registration we send you a code to confirm your e-mail address; we keep only a fingerprint of the code, valid for 15 minutes and for at most 5 attempts.
2.2 Sessions and security. For each device you sign in on we keep a fingerprint of the session token, the type of browser or app (user agent), the IP address, the date of creation and the time of the last activity. You can see them in Settings → Account. The IP address also appears: in the security log (at registration and at sign-in), in the attempt limiters kept temporarily in the server's memory (failed sign-ins and new accounts) and, for the phone app that runs through Cloudflare, in the record of sign-in attempts, deleted daily.
2.3 Your content. Conversations and messages (including generated answers), projects, assistants, memories and their search index, skills, automations, plugins, designs, files in the Library and the text extracted from them, connected apps (including the access tokens received from them) and Account settings (nickname, occupation, "about me", custom instructions, tone, profile picture, appearance preferences).
2.4 Voice and images. When you dictate, the recording is turned into text and is not saved by us. When you ask for an image or a video, the text of the request is sent to the provider that generates it (see section 5.2).
2.5 Usage and Plan. For each Account and day: the number of messages, images, videos, seconds of voice, the Usage consumed, the models used and the last 100 actions. The Plan, the Usage wallet with its history and the renewals. A log of the actions taken in connected apps, which keeps only the names of the fields sent, not their values.
2.6 Payments. Payments are made on the Stripe page. We keep the link between your Account and the Stripe customer and the latest payment events. When a payment starts we send Stripe your e-mail address, the Account identifier, the Plan, the billing period and the currency; Stripe asks you for your billing address and card details. Only Stripe sees the card details; we do not receive them.
2.7 Improvement data (optional). Only if you turn on the switches in Settings → Privacy and only when you rate an answer with 👍 or 👎. The details are in section 11.
2.8 Communications. The messages you send us by e-mail and our replies. In-app notifications (for example the result of an automation or Usage warnings). The only e-mail sent automatically at present is the confirmation code at registration; we do not send marketing e-mails.
2.9 Technical data. With every request, the servers receive the IP address and the technical data of the request (for example the browser and the page requested). The update server of the Windows app sees the IP address, the type of app and its version. [TO BE COMPLETED: whether the web server keeps access logs (IP address, requested address, time) and for how long]
2.10 What we do not ask for. We do not ask you for sensitive data (for example about health, religion, political opinions or biometric data), we do not use traffic-analytics or advertising tools and we do not track your location. If you yourself include such data in your Content, we process it only to answer you, at your request (see section 3.4).
3. Why we process the data and on what legal basis
3.1 We process the data for the purposes and on the bases in the table below (Article 6(1) GDPR):
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and managing the Account, signing in, confirming the e-mail address | Account data, sessions | performance of the contract (point b) |
| Providing the Services: AI answers, memory, Library, projects, Connectors, automations, images, video, voice, export | your content, Account settings | performance of the contract (point b) |
| Plans, Usage, payments and renewals | Usage and Plan, payments | performance of the contract (point b) |
| Issuing and keeping invoices and accounting records | payments, Account data | legal obligation (point c) |
| Security, prevention of abuse and fraud, limiting attempts, the security log | sessions, IP addresses, technical data | legitimate interest (point f): protecting the Services, the Users and ourselves |
| Improvement data (ratings and, optionally, the question and the answer) | improvement data | consent (point a), withdrawable at any time |
| In-app notifications and communications about the Account | Account data, Usage | performance of the contract (point b) |
| Answering your requests about your data and requests from authorities | the data relevant to the request | legal obligation (point c) |
| Establishing, exercising or defending legal claims | the data relevant to the dispute | legitimate interest (point f) |
3.2 Where processing is based on legitimate interest, we have weighed our interest against your rights and limited the data to what is necessary. You can object to this processing (see section 9.1).
3.3 The e-mail address and the password are needed to conclude the contract: without them we cannot create the Account. The other profile data is optional.
3.4 We do not use your Content for purposes other than those above. If your Content includes special categories of data (Article 9 GDPR), we process them only because you have made them known in your request and only to answer you. We recommend that you do not enter such data unless necessary.
4. Where the data comes from
4.1 We receive most data directly from you: at registration, in settings and through the Content you send.
4.2 Some data is generated automatically when you use the Services: sessions, IP addresses, Usage, the connected-apps log and the Outputs generated by models.
4.3 We receive some data from third parties: from Stripe (payment status and customer identifier), from the apps you connect (only the data you authorise, within the permissions granted) and from the web searches or pages you ask to be read.
4.4 If you enter data about other people, it comes from you (see section 14).
5. To whom we disclose the data
5.1 We do not sell your data and do not disclose it for advertising. We disclose it only to the recipients below, to the extent needed for the purpose.
5.2 The recipients and what they receive:
| Recipient | What it receives | Why and when |
|---|---|---|
| Hetzner Online GmbH, the provider of the server Serasmart runs on; data centre: [TO BE COMPLETED: country of the data centre] | all data kept on the server | hosting, permanently |
| AI model providers (for example Anthropic, Google, OpenAI, xAI); [TO BE COMPLETED: list of the model providers used in production] | your message, the current conversation, the text extracted from attached files, the personalisation instructions, relevant memories, excerpts from past chats, the results of plugins and web searches, excerpts from the Library | for each answer, only the provider of the model that answers |
| Semantic search providers (for example Google or Cloudflare), if configured | the text of memories and the question for the memory search | memory search; otherwise the search matches words, without a provider |
| Transcription providers (for example Groq, Google, Cloudflare, OpenAI) and the browser maker, if you use the browser's dictation | the voice recording | dictation; we do not keep the recording |
| Image and video generation providers (for example Google, xAI, Cloudflare) | the text of the request | when you ask for an image or a video |
| Search and public-information services (DuckDuckGo, Wikipedia, the National Bank of Romania, Open-Meteo) | the search or the page address | when you ask for a web search, for a link to be read or for a built-in plugin |
| Stripe Payments Europe, Ltd. | the e-mail, the Account identifier, the Plan, the period, the currency; on the Stripe page, the billing address and the card | payments and subscriptions |
| The e-mail sending provider: [TO BE COMPLETED: name of the e-mail provider used for confirmation codes] | your e-mail address and the confirmation code | at registration |
| Our e-mail provider | the messages you send us | when you write to us |
| The apps you connect (for example Google, Notion, GitHub) | what the action you approved requires | only after you connect the app and, for actions that change something, after your approval |
| Cloudflare, Inc. | the Account data and the content sent from the phone app that runs through Cloudflare | only if you use that app |
| The browser's notification service (Apple, Google or Mozilla) | the name and e-mail of a new account, in the approval notification sent to the administrator | when an account is created |
| Public authorities and courts | the data requested | only when the law obliges us |
5.3 Depending on the service and their contracts, some recipients act as processors (they process the data on our behalf, for example hosting), and others as independent controllers, under their own policies (for example Stripe for payment data or the apps you connect).
5.4 For Users' Accounts we use only the paid APIs of AI model providers. These providers process the requests to generate the answer and may keep them for a limited period, under their own terms (for example for safety and abuse prevention). What the providers may do with the requests they receive is governed by their commercial API terms.
5.5 An AI model is chosen for each request, by you or automatically (see section 12). The Content sent reaches only the provider of the model used for that answer; if that model does not answer, the request may be sent to the next available model.
5.6 In the event of a reorganisation, merger or sale of the business, the data may be transferred to the successor, which will be bound to comply with this Policy. We will inform you beforehand.
6. Transfers outside the European Economic Area
6.1 Some recipients in section 5.2, in particular AI model providers, may be established or may process data outside the European Economic Area (for example in the United States of America), consistently with Terms clause 14.1.
6.2 For these transfers, the providers rely on the safeguards provided by Chapter V GDPR: an adequacy decision of the European Commission (for example, for certified US companies, the EU–US Data Privacy Framework) or the standard contractual clauses adopted by the European Commission, as each provider's terms provide.
6.3 You can ask us, at the address in section 1.2, for information about the safeguards used for a given recipient.
7. How long we keep the data
7.1 We keep the data only as long as necessary for the purpose for which it was collected:
| Data | How long |
|---|---|
| Account data | until the Account is deleted; accounts that have not confirmed their e-mail address are deleted after one day |
| E-mail confirmation code | valid for 15 minutes |
| Sessions | expire after 30 days in which they were not used; expired sessions are deleted automatically, and signing out ends the session |
| Conversations | as you choose, in Settings → Privacy: forever (default), 30 days, 90 days or one year; pinned conversations stay; you can delete them at any time |
| Memories, Library, projects, assistants, skills, automations, designs, connected apps | until you delete them or delete your Account |
| In-app notifications | 90 days, at most 500 per Account |
| Daily Usage record | 120 days |
| Log of the actions in connected apps | the last 500 entries per Account |
| Improvement data | until you turn the switch off, withdraw it or delete your Account; at most 5,000 entries are kept in total, the oldest being replaced |
| Security log (registration, sign-in, Account deletion) | [TO BE COMPLETED: retention period of the security log]; a period has not been set yet |
| Invoices and accounting records | the period required by accounting and tax law |
| Payment records and the Usage wallet | for the duration of the contract; [TO BE COMPLETED: the period after which they are deleted once the Account is closed] |
| Messages sent to us by e-mail | as long as necessary to answer you and, where applicable, to defend a legal claim |
| Backups | [TO BE COMPLETED: whether backups of the server are made and how long they are kept] |
| Data kept in your browser | until you sign out or delete it (see the Cookie policy) |
7.2 When the Account is deleted, we delete the Account, the sessions, the permissions, the notifications, the access requests, the codes, your content (conversations, memories, Library, projects, assistants, skills, automations, connected apps, designs, settings), the Usage record, the connected-apps log, the improvement data and the API access keys. Separately, we keep only what the law obliges us to keep (for example invoices and accounting records) and what is necessary to establish, exercise or defend legal claims. [TO BE COMPLETED: which data from the payment records and the security log remains after the Account is deleted, and for how long]
7.3 Deleting a conversation, a memory or a file from Settings removes it from our Services. Data already sent to an AI model provider for an answer is kept by that provider under its terms (see section 5.4).
8. How we protect the data
8.1 We use technical and organisational measures appropriate to the risk, including:
- passwords are kept only as a bcrypt fingerprint; session tokens, API access keys and confirmation codes are kept only as fingerprints;
- connections use HTTPS, with automatically renewed certificates, and security headers (HSTS, a strict content policy, no sending of the page address to other sites);
- the number of sign-in attempts and of account creations is limited;
- each Account's data is separated in queries, and requests to addresses given by Users are checked so they cannot reach internal networks;
- connected-app actions have risk classes and, for those that change something, ask for your approval;
- sessions are visible and can be ended at any time on all devices.
8.2 We tell you openly what we do not do yet: conversations, files and the tokens of connected apps are not encrypted at application level on the server; they are protected by restricted access to the server, file permissions and container isolation.
8.3 No system is completely secure. If a personal data breach occurs that poses a risk to your rights, we notify the Romanian National Supervisory Authority for Personal Data Processing and, where the law requires, inform you without undue delay.
8.4 Please use a strong password that you do not use elsewhere, and sign out of devices you no longer use.
9. Your rights
9.1 Under the GDPR, you have the right: (a) of access to your data; (b) to rectification of inaccurate data; (c) to erasure of the data; (d) to restriction of processing; (e) to data portability; (f) to object to processing based on legitimate interest; (g) to withdraw your consent at any time, without affecting the processing carried out before; (h) not to be subject to a decision based solely on automated processing that produces legal effects (see section 12); (i) to lodge a complaint with the supervisory authority (see section 9.5).
9.2 You can exercise many of these rights yourself, directly in Serasmart:
| What you want | Where |
|---|---|
| A copy of your data (access, portability) | Settings → Privacy → "Download all my data" (a JSON file; without the password fingerprint, tokens or keys) |
| To correct your profile data | Settings → General |
| To delete conversations, memory, files or all data | Settings → Privacy → "Delete data", with confirmation |
| To delete your Account | Settings → Account → "Delete account", with the password |
| To see and end sessions | Settings → Account → "Active sessions" and "Log out of all devices" |
| To turn off memory or search in past chats | Settings → Memory → "Use memory" and "Search past chats" |
| To choose how long conversations are kept | Settings → Privacy → "Keep chats" |
| To withdraw your consent for improvement data | Settings → Privacy → "Help improve Serasmart AI": turning the switch off deletes what was kept; "Delete what I shared" |
| To disconnect an app or withdraw an "Always allow" approval | Settings → Connectors; for external apps that use your Account, Settings → Connected apps (when external access is on) |
9.3 For any other right, or if you cannot use Settings, write to us at the address in section 1.2, preferably from your Account's e-mail address. We may ask for additional information only to confirm that the request comes from you.
9.4 We answer within one month at most of receiving the request. The period may be extended by two further months for complex or numerous requests; in that case we tell you within the first month and explain why. Exercising your rights is free of charge; for manifestly unfounded or excessive requests we may charge a reasonable fee or refuse, with reasons.
9.5 You can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), Bulevardul General Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro, or with the authority of the state where you live or work. Please write to us first, so that we can solve the problem. You may also go to court.
10. Memory, history and conversations
10.1 Memory and search in past chats are on by default. When they are on, Serasmart keeps by itself the preferences, decisions and lasting details from your conversations and uses them when relevant, and for a question it searches your other conversations for what is related. You can turn them off at any time in Settings → Memory; with memory off, nothing new is kept. You can see, change and delete existing memories from the Memory page.
10.2 Serasmart has no incognito mode or temporary conversation. Conversations are kept according to the choice in section 7.1; if you do not want a conversation to remain, you can delete it.
10.3 For the memory search, the text of memories and the question may be sent to a semantic search provider (see section 5.2).
11. We do not train models on your conversations; improvement data
11.1 Serasmart does not use your conversations to train artificial intelligence models (Terms clause 7.3).
11.2 Improvement data is kept only if you turn on the switches in Settings → Privacy → "Help improve Serasmart AI" (off by default) and only when you rate an answer with 👍 or 👎:
- with the first switch ("Keep my ratings to improve Serasmart AI") the rating, the kind of task, the model and the number of tokens are kept, without the text of the conversation;
- with the second switch ("Also keep the question and the answer", which can be turned on only together with the first) the rated question and answer are also kept, each of at most 3,000 characters.
11.3 Before being kept, e-mail addresses are replaced with [email] and phone numbers with [number], by an automatic pattern search. This replacement is not guaranteed, and proper names and other data are not removed. Do not turn on the second switch if you rate conversations containing personal data.
11.4 An entry does not contain the name, e-mail or identifier of the Account, only two keyed fingerprints (for the Account and for the answer), which allow an old rating to be replaced and your data to be withdrawn. The data is pseudonymised, not anonymous. Only the Serasmart administrator can consult it, to choose more suitable models and to understand where answers went wrong.
11.5 Turning a switch off deletes what was kept under it. You can delete everything at any time with "Delete what I shared". The data is included in the data export and is deleted with the Account.
12. Automated decisions
12.1 When you choose "Serasmart Auto" or do not choose a model, an automated system decides which model answers, according to the type and difficulty of the request and to your Plan. Plan limits and the move to the Free Plan after a failed payment are applied automatically, under the Terms.
12.2 These decisions serve to perform the contract and do not produce legal effects concerning you or similarly significant effects, within the meaning of Article 22 GDPR. If you disagree with a decision, you can write to us at the address in section 1.2 and a person will review it.
13. Children
13.1 Serasmart may be used from the age of 16 (Terms clause 4.1). The age from which a person can give consent alone for information society services, in Romania, is 16 (Article 8 GDPR).
13.2 We do not currently verify age automatically at registration. If we learn that an Account belongs to a person under 16, we close the Account and delete the data, with the exceptions in section 7.2. A parent or legal representative can write to us at the address in section 1.2.
14. Data of other people that you enter
14.1 If you enter data about other people in Serasmart (for example colleagues or clients), you are responsible for the legal basis of that processing and for informing them (Terms clause 7.4). Enter only what is necessary.
14.2 A data processing agreement for organisations that use Serasmart on their behalf has not yet been published. Until then, please write to us before using Serasmart for personal data of an organisation's clients or employees.
15. Browser storage and cookies
15.1 Serasmart does not use cookies. The app keeps a few necessary items in your browser (for example the session and the language). The details are in the Cookie policy, at serasmartai.com/legal/cookie-uri/.
16. Changes to the Policy
16.1 We may update this Policy, for example when the Services, the recipients or the law change. The version in force is always the one published at serasmartai.com/legal/, with the effective date and the version history.
16.2 For material changes we notify you at least 30 days before they take effect, by an in-app message and, where possible, by e-mail. For new processing based on consent we ask for your consent beforehand.
16.3 This Policy is drawn up in Romanian; translations are for information, and in case of difference the Romanian version prevails.
17. Contact
For any question about this Policy or about your data, write to us at support@serasmartai.com. Controller: SERANO CONSULT SRL, sole registration code 25281467, trade register no. J2009000644234, registered office: [to complete: sediu].
Version history
- Version 1.0 — first published version, effective from [to complete: data_in_vigoare].