Privacy Policy

Effective date: [[EFFECTIVE_DATE]]

1. Who we are and what this covers

Seros, LLC ("Seros", "we", "us") provides a task delegation service at https://seros.dev (the "Service"). This policy explains what personal information we collect when you visit our website, sign up, use the Service, or contact us; why we collect it; who we share it with; how long we keep it; and what rights you have.

This policy covers personal information for which we are the controller — for example, your account and billing details, and the way you use the Service. It does not cover the content our business customers put into the Service about their own staff and clients. For that content we act as a processor on the customer's instructions. Our Data Processing Addendum governs that relationship. If you are an employee of a customer and you want your data changed or deleted from their workspace, contact that customer first; we will help them respond.

Contact: privacy@seros.dev. Postal: [[ENTITY_ADDRESS]]. EU/UK representative or data protection officer, if appointed: Not appointed.

Assumptions this document is built on

These are assumptions, not verified facts. Correct any that are wrong before publishing.

Seros, LLC will be a limited liability company formed in Georgia. The entity is not yet confirmed as formed. Nothing here should be read as a statement that it exists.
The product is a business-to-business subscription service: a web application and API that connects to a customer's own tools (chat, ticketing, documents, calendar) and uses AI models to draft, route, assign and track tasks.
Pricing is per seat, monthly or annual, with a free trial, sold both self-serve and through sales conversations.
The service is multi-tenant, hosted in the United States, and uses third-party large language model providers as subprocessors.
Customer content is processed to provide the service and is not used to train third-party models by default.
Customers are businesses. The service is not offered to consumers or to children. Business contact details are still personal data under GDPR, UK GDPR and CCPA/CPRA.

2. What we collect, why, and on what legal basis

"Legal basis" is a GDPR and UK GDPR concept (Article 6). If you are outside the EU, EEA, UK or Switzerland, the "why" column is still the honest answer to what we do.

Category	Examples	Why we process it	Legal basis (GDPR Art. 6)	Typical retention
Account data	Name, work email, password hash, job title, company name, workspace and team membership, role and permissions, authentication events, single sign-on identifiers	Create and secure your account, authenticate you, apply permissions, provide support	Art. 6(1)(b) performance of a contract; Art. 6(1)(f) legitimate interests in account security	Life of the account, then for the life of the account, then 30 days after closure
Billing data	Billing contact, billing address, tax identifiers, plan and seat count, invoices, payment status, partial card details and payment tokens held by our payment processor	Take payment, prevent fraud, meet tax and accounting duties	Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation for tax and accounting records	Financial records kept for 7 years as required by law
Usage and telemetry	Pages and features used, API endpoints called, timestamps, request volumes, latency, device and browser type, operating system, approximate location derived from IP address, IP address, crash and error reports, session identifiers	Operate the Service, diagnose faults, measure reliability, prevent abuse, decide what to build	Art. 6(1)(f) legitimate interests in running, securing and improving the Service	13 months, aggregated after 90 days
Customer content	Messages, documents, tickets, calendar entries, task descriptions, comments, files and the connected-tool data the customer chooses to bring in, together with the AI-generated tasks, summaries and routing suggestions derived from it	Deliver the delegation features the customer asked for	Processed on the customer's instructions under the DPA. The customer determines its own legal basis	For the life of the workspace; deleted on the schedule in Section 5
Support communications	Emails, in-app messages, support tickets, call notes, screenshots and logs you send us	Answer your question, reproduce and fix bugs, keep a record of what was agreed	Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interests in support quality	24 months
Marketing and prospect data	Work contact details you give us, event and demo requests, email open and click events, marketing preferences	Reply to enquiries, send service and product email you asked for	Art. 6(1)(a) consent where consent is required; otherwise Art. 6(1)(f) legitimate interests in business-to-business marketing	Until you opt out, then a suppression record kept indefinitely so we do not email you again
Cookies and similar technologies	Session cookies, security cookies, preference cookies, and analytics identifiers	Keep you signed in, remember settings, understand aggregate usage	Strictly necessary cookies: legitimate interests. All others in the EU, EEA and UK: consent	See the Cookie Policy
Security and audit logs	Sign-in attempts, IP addresses, admin actions, permission changes, security alerts	Detect and investigate unauthorised access, meet our security commitments	Art. 6(1)(f) legitimate interests in security; Art. 6(1)(c) where a law requires it	12 months

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights. You can ask us for a summary of that assessment at privacy@seros.dev.

What we do not do

We do not sell personal information.
We do not share personal information for cross-context behavioural advertising.
We do not use customer content to train our own general-purpose models, and we do not permit our AI model providers to train their models on it. See AI-DISCLOSURE.md.
We do not make decisions with legal or similarly significant effects about you using automated processing alone. The Service produces drafts and suggestions; a person at the customer decides.

3. Where the information comes from

Most of it comes from you or from your employer's administrator. Some comes from the tools you connect: when an administrator authorises a connection to a chat, ticketing, document or calendar system, we receive the data that connection is scoped to. Some is generated automatically when you use the Service, such as logs and telemetry. If we buy or receive business contact data from a third-party source for sales outreach, we will say so here and name the source: [[TBD_PROSPECT_SOURCE]] or "none" if we do not.

4. How we use AI

The Service sends the parts of customer content that are needed for a given feature to third-party AI model providers, which return generated text. Our contracts with those providers are intended to prohibit training on the data we send and to require deletion within the provider's stated window. The AI-specific detail, including the current stance on training and retention, is in AI-DISCLOSURE.md. The identity of the providers is in SUBPROCESSORS.md.

AI output can be wrong. Do not rely on it without review. That is a legal point as well as a practical one and it is repeated in the Terms of Service.

5. Retention and deletion

We keep personal information only as long as we need it for the purpose it was collected for, plus any period a law requires.

Customer content is retained while the workspace is active. On termination, the customer may export it during a window of 30 days. After that window we delete or irreversibly anonymise it within 30 days, except where law requires us to keep it.
Backups roll off on their own cycle. Deleted data can persist in encrypted backups for up to 35 days before being overwritten.
Financial records are kept for 7 years because tax and accounting rules require it.
Aggregate statistics that cannot identify anyone may be kept indefinitely.

We share personal information with:

Subprocessors and service providers — hosting, email delivery, payments, analytics, error tracking, AI model providers and support tooling. The current list, with each vendor's purpose and location, is in SUBPROCESSORS.md. Each is bound by a written contract that limits use to providing the service to us.
Your organisation. If you use a work account, your workspace administrator can see your account details, your activity in the workspace, and the content you create there.
Professional advisers — lawyers, accountants, auditors and insurers, under duties of confidence.
Authorities, where we are legally required to disclose. Where we are permitted to, we will tell the affected customer before we disclose so they can object.
A buyer or successor, if the business or the relevant assets are sold, merged or reorganised. We will give notice before your information becomes subject to a different privacy policy.

We do not disclose customer content to anyone else without the customer's instruction.

7. International transfers

We are based in the United States and the Service is hosted in the United States. If you are in the EEA, the UK or Switzerland, your personal information will be transferred to a country that those laws do not treat as providing an equivalent level of protection by default.

For those transfers we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, together with the UK International Data Transfer Addendum for UK transfers, and the Swiss addendum for Swiss transfers. We carry out a transfer impact assessment and apply supplementary measures such as encryption in transit and at rest.

We do not currently claim certification under the EU-US Data Privacy Framework, the UK Extension, or the Swiss-US Data Privacy Framework. If Seros, LLC certifies in future, this section will be updated and the certification will be verifiable on the official DPF list. Do not state or imply DPF participation until that is true.

Copies of the transfer mechanisms we use are available on request at privacy@seros.dev.

8. Security

We apply administrative, technical and physical safeguards proportionate to the risk, including encryption in transit and at rest, role-based access control, least-privilege access for staff, logging and monitoring, and a documented incident response process. The current control set is described in SECURITY.md and in Annex II of the DPA.

We do not hold SOC 2, ISO 27001 or any other security certification, and we do not claim one. No system is perfectly secure. If you find a vulnerability, the disclosure process is in SECURITY.md.

9. Your rights

If you are in the EEA, the UK or Switzerland

You have the right to: access your personal information; correct it; delete it; restrict or object to processing, including profiling; receive it in a portable format; and withdraw consent at any time where processing is based on consent, without affecting processing done before the withdrawal. You can lodge a complaint with your supervisory authority. In the UK that is the Information Commissioner's Office; in the EU it is the authority of your member state.

If you are in California

Under the CCPA as amended by the CPRA you have the right to know what personal information we collect, use, disclose and retain; to access it and receive a copy; to correct it; to delete it; to limit the use of sensitive personal information; and not to receive discriminatory treatment for exercising a right. We do not sell personal information and we do not share personal information for cross-context behavioural advertising, so there is nothing to opt out of; if that ever changes we will publish a "Do Not Sell or Share My Personal Information" link before making the change. We do not knowingly collect or use sensitive personal information for purposes that would trigger the right to limit.

The categories of personal information we collect, the sources, the business purposes and the categories of recipients are set out in the table in Section 2 and in Section 6. We disclose the categories listed there to service providers for business purposes only.

If you are in another US state with a privacy law

Residents of states including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Montana have broadly similar rights of access, correction, deletion, portability and opt-out of targeted advertising and profiling with legal effects. We honour those requests through the same process. Some states allow you to appeal a refusal; if we refuse your request you can appeal by replying to our decision email, and we will respond within the period your state's law allows.

How to exercise a right

Email privacy@seros.dev with the request and the account or workspace it relates to. We will verify your identity, usually by confirming control of the email address on the account, or by asking for additional detail if the request is broad. We respond within 30 days, or within 45 days where a US state law allows, and we will tell you if we need an extension. You may use an authorised agent; we will ask for proof of authority.

If your request concerns content inside a customer's workspace, we will forward it to that customer and assist them, because they decide.

10. Children

The Service is for businesses. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. Users must be at least 18 to hold an account. Where local law sets a lower digital-consent age, we still do not permit anyone under 16 to use the Service. If you believe a minor has given us personal information, email privacy@seros.dev and we will delete it.

11. Changes to this policy

We will update this policy when the Service or the law changes. If a change is material we will give notice by email to account administrators or by a notice in the Service at least 30 days before it takes effect, unless a shorter period is required by law. The effective date at the top always reflects the current version. Prior versions are available on request.

12. Contact

Privacy questions and rights requests: privacy@seros.dev
Legal notices: legal@seros.dev
Support: hello@seros.dev
Postal: [[ENTITY_ADDRESS]]
Security reports: see SECURITY.md

What I need from you

Fill these before this policy is published.

Legal name, state of formation, and registered address once the entity exists.
The real email addresses for privacy, legal and support.
The actual retention periods: for the life of the account, then 30 days, 13 months, aggregated after 90 days, 24 months, 12 months, 7 years, 35, 30, 30.
Confirmation that we genuinely do not sell or share personal information for cross-context behavioural advertising, including through any analytics or advertising pixel on the marketing site. If a pixel is added, this policy must change.
Whether an EU or UK representative is required under GDPR Art. 27 and, if so, who Not appointed is.
Whether any prospect data is bought or scraped, and from where.
Notice period for policy changes: 30.