Data processing agreement
Last updated 24 September 2026 · forms part of the terms
When your team uses Seren, you are the controller of the client information you bring in, and Seren (Alex George, trading as Seren, United Kingdom) is your processor. This agreement sets out what we may and may not do with it, as UK GDPR Article 28 requires. If your organisation needs it signed, write to hello@seren.my and we'll countersign a copy.
1. What we process, and why
| Purpose | Building and showing your team's ledger of each client relationship: what was agreed, what changed, what's owed, with the source behind every line. Drafting messages for a person to review. Nothing else. |
| Data | The emails, call notes, transcripts, documents and records you choose to connect or upload for an account, and what Seren derives from them (terms, promises, dates, quotes). |
| People | Your staff, your clients' staff, and anyone named in the material you connect. |
| Special data | Not intended. Don't map sources whose main content is health, criminal or other special-category data. |
| Duration | While you use Seren, then deleted as in section 6. |
2. We act only on your instructions
- We process your data only to run Seren for you, as you configure it (which sources, which accounts, who sees what), or where UK law requires us to, in which case we'll tell you first unless the law forbids it.
- We never sell it, never use it for advertising, and never use it to train AI models, ours or anyone else's.
- Seren never sends or changes anything in your tools unless a person on your team has turned that permission on, previewed the action and confirmed it.
3. Confidentiality and security
- Anyone who can reach your data is bound by confidentiality. Today that is one person, Alex George, and only when you ask for help with a specific problem or the law requires it. Every such access is logged.
- Data is encrypted in transit and at rest. Access inside your workspace is enforced by the database (row-level security), not just the interface: colleagues see the ledger and short quotes, never each other's mail.
- The sealed vault. Real client mail will be processed inside hardware-isolated machines whose keys our own staff can't use to read it. Until that vault has been independently reviewed, no real client mail is connected to Seren; pilots before then use sample or synthetic material only.
4. Sub-processors
You authorise these providers. We'll email you at least 30 days before adding or replacing one, and you can object; if we can't resolve it, you can end the agreement and we'll refund any prepaid time.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | London, UK |
| Render | Runs the application | Frankfurt, EU |
| Cloudflare | Domain, network and email routing | Global network |
| Anthropic | AI reading. Once the vault is live it receives only de-identified tasks: names, companies, amounts and dates removed | United States |
| Resend | Sending sign-in links and digests | United States |
| Stripe | Billing (your billing contact only, never client data) | United States / Ireland |
Transfers outside the UK rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum, with each provider's own data processing terms.
5. Helping you
- People's rights. We'll help you answer access, correction and deletion requests. You can export or delete an account's data yourself at any time.
- Breaches. We'll tell you without undue delay, and within 48 hours of becoming aware of a breach affecting your data, with what we know and what we're doing.
- Assessments. We'll give you the information you reasonably need for a data protection impact assessment or a consultation with the ICO.
- Audits. We'll answer security questionnaires and make available the information needed to show we meet this agreement. Once the vault is live, anyone can check what runs inside it (its published build and attestation).
6. When it ends
When you delete a workspace or the agreement ends, we delete your data within 30 days, including from backups as they roll over, unless UK law requires us to keep something. You can export everything before then.
7. The rest
Liability under this agreement follows the terms. If this agreement and the terms disagree about your data, this agreement wins. It's governed by the law of England and Wales. Questions: hello@seren.my.