← Back to home

Privacy Policy

1. Who We Are

SereneAI Ltd is a company registered in England and Wales (Company No. 16646814), with its principal place of business in Blackpool, England. We build human-centred software and provide practical AI and automation services.

For the purposes of UK data protection law, SereneAI Ltd is the data controller for personal data collected through this website and in connection with our services.

You can contact us regarding data matters at: daniel.turner@sereneai.co.uk

2. What Data We Collect

2.1 Website Enquiries and Contact Forms

When you submit an enquiry through our website, we collect:

• Your name, work email address and optional telephone number
• Your organisation name
• Your selected enquiry type and team size
• The content of your message

2.2 Email Correspondence

If you contact us by email, we retain the content of that correspondence and your email address for the purpose of responding to your enquiry and maintaining a record of our communication.

2.3 Website Analytics

We may collect anonymised, aggregated data about how visitors use our website (such as pages visited and time on site). Where we do so, this data cannot be used to identify you individually. We do not use third-party advertising or tracking cookies.

2.4 Client Engagement Data

Where you become a client of SereneAI, engagement-specific processing will be documented in the solution design and, where appropriate, a Data Processing Agreement. This policy covers our website and pre-engagement activities; section 12 also explains the data used by the Life@Me Chrome extension and its supporting service.

3. How We Use Your Data

We use the data we collect for the following purposes:

• Responding to enquiries — to reply to your message and arrange a discovery call if appropriate
• Client communication — to maintain ongoing communication if you become a client
• Legal obligations — to comply with our legal and regulatory obligations
• Legitimate interests — to improve our services and understand how prospective clients find us

We will not use your data to send marketing communications without your explicit consent. We will never sell your data to third parties.

4. Legal Basis for Processing

Under UK GDPR, we rely on the following legal bases:

• Legitimate interests — for responding to business enquiries, understanding prospective client needs, preventing abuse and maintaining proportionate business records
• Steps at your request before entering a contract — where an enquiry relates to services you may purchase as an individual
• Legal obligation — where processing is required to comply with applicable law

5. Service Providers and International Processing

Our website and the supporting Life@Me service are delivered through Cloudflare Workers. Cloudflare's global network may process technical connection data outside the United Kingdom. Where international processing occurs, we rely on the contractual and legal safeguards provided by the relevant service provider.

Website fonts are delivered by Google Fonts, which means your browser connects to Google's servers to retrieve font files. We do not use Google advertising services on this website.

Life@Me connects to Microsoft Entra, Microsoft Graph and, for enabled users, Atlassian Jira. Those providers process authentication and service data under their own terms and the client's organisational arrangements. Where an engagement requires specific hosting, data-residency or subprocessor controls, these will be documented for that deployment.

Review Cloudflare's Privacy Policy, Microsoft's Privacy Statement, Atlassian's Privacy Policy and Google's Privacy Policy for more information.

6. How Long We Keep Your Data

• Enquiry data — retained for 12 months from the date of enquiry, or until you request deletion
• Client correspondence — retained for the duration of the engagement plus 6 years, in line with our legal obligations
• Email correspondence — retained for 12 months unless a longer period is required for legal or business reasons
• Life@Me API sessions — expire after no more than 8 hours
• Optional Jira connection — retained while the connection remains active, until access is revoked or deletion is requested, subject to applicable client instructions

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — to request a copy of the data we hold about you
• Right to rectification — to request correction of inaccurate data
• Right to erasure — to request deletion of your data, where no legal obligation requires us to retain it
• Right to restrict processing — to request that we limit how we use your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests
• Right to withdraw consent — if we ask for consent for a separate purpose, to withdraw it at any time

To exercise any of these rights, contact us at daniel.turner@sereneai.co.uk. We will normally respond within one month, subject to the rules that apply to the request.

8. Complaints

If you have concerns about how we handle your data, please contact us in the first instance and we will do our best to resolve the matter.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

• Website: ico.org.uk
• Phone: 0303 123 1113

9. Cookies

Our website does not use advertising cookies or third-party tracking cookies. We may use strictly necessary technologies to operate and protect the service. If we introduce non-essential cookies or similar tracking, we will update this notice and provide an appropriate choice mechanism before using them.

10. Third-Party Links

Our website may contain links to third-party websites, including LinkedIn. We are not responsible for the privacy practices of those sites and recommend you review their privacy policies separately.

11. Changes to This Policy

We may update this privacy policy from time to time. The date at the top of this page reflects when it was last revised. We encourage you to review this policy periodically.

12. Life@Me Chrome Extension

Life@Me is a Chrome extension and supporting service for authorised business users. It uses Microsoft Entra sign-in and Microsoft Graph, with an optional separate Atlassian Jira connection for clients and users where Jira has been enabled.

Life@Me may access and display the signed-in user's name, email address, Microsoft tenant and user identifiers, today's Outlook meeting information, assigned Planner task information, recent Microsoft document metadata and links, and client-managed navigation content from SharePoint lists. For an authorised Jira connection, it may also retrieve assigned unresolved issue summaries, due dates and links for display.

Chrome synchronised storage holds preferences such as theme and which navigation icons are visible. Chrome session storage holds the short-lived Microsoft access token and Life@Me API session token. The Microsoft access token is not stored permanently by the extension.

The supporting Cloudflare service keeps short-lived API session records in Cloudflare D1. These records contain a hashed session token plus the user, client and tenant identifiers needed to enforce access. Where Jira is connected, D1 also stores encrypted Jira access and refresh tokens, approved scopes and accessible Jira resource metadata so the connection can continue until it is revoked or removed.

Life@Me does not collect passwords, PINs, security questions, payment information, health information, location data, Chrome browsing history or arbitrary webpage content. It does not sell user data, use it for advertising or transfer it for unrelated purposes. Data is used only to provide authenticated daily work information, optional Jira work and centrally managed business navigation.