Privacy Policy

Serre Labs LLC is a Texas limited liability company. This policy covers our websites, business communications, and services. Our launch service is offered to US-based business customers. US-only availability does not mean that every provider stores or accesses information only in the United States.

We determine how information is used for our own website, business relationships, account administration, billing, and marketing. When a customer submits personal information to a workspace for processing on its behalf, we handle it under our agreement and that customer's instructions.

Within the app, access to workspace information and actions such as managing users, viewing content, sharing, or exporting depend on assigned roles and workspace permissions. Authorized administrators can manage users and workspace information within those permissions.

Questions or requests? Email privacy@serre.app. If a customer controls the information concerned, we may direct your request to that customer or assist it with responding.

Account and contact information: name, business email, company, account identifiers, authentication information, and details you provide when contacting us or requesting access. Passwords, where used, are stored as hashes.

Service content: business information, documents, communications, instructions, and other content that you or your organization submit, connect, or generate through the service. This can include personal information contained in that content. The information processed depends on how you use the service and which features and integrations you enable.

Billing and communications: subscription and transaction records, billing-contact details, support messages, feedback, meeting requests, and marketing preferences. Payment providers handle payment-card details under their applicable terms and notices.

Technical and usage information: IP address, device and browser information, pages and features used, timestamps, account or device identifiers, error reports, and diagnostic logs. Product analytics can be associated with your account, including your user ID, name, and email. Product session replay can record on-screen interactions to help diagnose problems; it is not solely anonymous statistical reporting.

Connected services and third-party sources: information from sign-in providers and integrations you authorize, public business information used by enabled research features, and business-contact information supplied by marketing-data providers when you allow visitor identification.

Information can come from you, your organization and its authorized users, your use of the service, and the sources described above. Please do not submit sensitive or regulated information requiring safeguards or agreements we have not agreed to provide, such as protected health information or full payment-card details in workspace content. If such information is included in a submission, it can still be processed as part of that content; this restriction is not a claim that collection is technically impossible.

We use information to authenticate users; provide, administer, and secure workspaces; perform requested research, calculations, and AI-assisted tasks; generate and deliver outputs; process billing; provide support; diagnose errors; prevent abuse; and improve the service.

We also use appropriate information to manage business relationships, understand interest in Serre, and send business communications subject to your choices and applicable law. Security, account, and transaction messages are separate from optional marketing.

Internal pattern analysis: we may aggregate and deidentify information from content and activity across our services to identify patterns and trends in the backend and inform product development and service improvements. This analysis is for internal use, not to make customer content available to other customers. We maintain appropriate safeguards against identification and do not attempt to reidentify information treated as deidentified. This use remains subject to our confidentiality obligations and our commitment not to use customer content to train AI models.

We may also use or retain information to meet legal obligations, respond to lawful requests, enforce agreements, and establish or defend legal claims. This policy does not transfer ownership of your workspace content to us.

We use AI service providers to support features and workflows, including processing information, generating responses and other outputs, and assisting with support. Depending on the feature, relevant content, communications, instructions, and related information are sent to those providers as needed to perform the requested function. Inputs and outputs may be stored as part of the service. The providers supporting this processing are described on our Subprocessors and Service Providers page.

We do not use customer content to train AI models. Providers processing that content on our behalf must be subject to contractual restrictions consistent with that commitment. No model training is not a promise of zero retention: operational, security, and legal retention depends on the provider, feature, and applicable agreement.

Review generated content before relying on it or sharing it. Only submit information you have authority to provide.

We disclose information needed by providers that support hosting, databases, AI inference, communications, support, diagnostics, and analytics. See our Subprocessors and service providers page for services and purposes. Payment, authentication, and connected-service providers may have independent responsibilities for some processing.

Information is also disclosed to your organization and authorized users, and to recipients or integrations you select through sharing and export features. You are responsible for choosing appropriate recipients and permissions.

An authorized integration permits the information exchanges needed for the selected function. You can revoke the permissions available through the connected provider and ask us for help disconnecting it. Revocation stops future access covered by that permission, but does not by itself delete information already imported into Serre or sent to another service. Sharing and exporting can create copies outside your workspace's access controls.

With your visitor-identification permission, technical and browsing information is disclosed to visitor-identification providers and their matching partners for matching with business-contact data and sales follow-up. Depending on applicable law and the processing arrangement, marketing disclosures may be treated as a sale, sharing, or targeted advertising. You can decline this processing using Privacy choices; we do not condition site access on allowing it.

We may disclose information when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or establish or defend legal claims. Information may also be disclosed to advisers or counterparties in a financing, acquisition, or reorganization, subject to appropriate confidentiality protections.

Our marketing site uses analytics for traffic measurement. Visitor identification is a separate, optional purpose: with your permission, we and our providers use cookies and similar technologies to collect pages viewed, browsing activity, IP address, and device details, and combine this with third-party business-contact information to identify visitors for sales follow-up.

Third-party tracking and matching services may associate information from this site with information about activity over time and across other websites or services. The visitor-identification choice concerns that optional purpose, not merely whether a cookie is stored.

The visitor-identification tag does not load until you select “Allow visitor identification.” An earlier generic analytics choice is not permission for this purpose. You can decline or withdraw at any time using Privacy choices. We treat Global Privacy Control and browser Do Not Track signals as a refusal of this site's visitor identification, including when an earlier choice allowed it.

Withdrawing permission stops further loading on this browser and reloads a page if the tag was already active. It cannot undo information already sent or automatically erase vendor-held information. Your choice applies to this browser, not every device or all product analytics.

For an existing matched profile or downstream marketing-data request, contact privacy@serre.app. Direct provider opt-out options are available in our visitor-identification privacy resources. Marketing-email unsubscribe is a separate choice. See Cookies and tracking for details.

We retain account and workspace information to provide the service and administer the relationship, subject to the deletion commitment below. We retain billing and transaction records for accounting, tax, disputes, and legal requirements; support records for resolving and documenting requests; and technical, analytics, and security records for troubleshooting, service improvement, and abuse prevention. Marketing-contact information is kept for permitted business communications, subject to your choices, while limited suppression records help us honor opt-outs. Retention depends on the purpose, sensitivity, ongoing need, and applicable obligations, rather than one period for every category.

To request account deletion, email privacy@serre.app. We will remove your account data within 30 days of your request, subject to identity and authority verification and legally required retention. Audit records may be retained longer where required. We continue to protect information retained for legal obligations and limit its use to the relevant purpose.

Aggregated and deidentified information used for internal pattern analysis may be retained after account closure only where it no longer identifies a person or customer and retention is permitted by applicable law and our agreement. Combining records alone does not make them deidentified or authorize us to retain otherwise deletable personal information or confidential content.

Our primary workspace data is stored in encrypted databases hosted in the United States, with encrypted backups. Production-data access is restricted and audited. Other providers may process or access information in other locations. We use administrative, technical, and organizational safeguards, but no service can guarantee absolute security.

Email privacy@serre.app to request access, correction, deletion, or a portable copy of your information, or to ask about sale, sharing, or targeted-advertising opt-outs. Depending on applicable law and your relationship with us, you may have additional rights, including an appeal. We verify identity and authority as appropriate, respond within applicable deadlines, and explain any lawful limitations. An authorized agent may contact us with evidence of authority.

To appeal a privacy decision where that right applies, reply to our response or email privacy@serre.app with “Privacy appeal” in the subject. We will not unlawfully discriminate against you for exercising your rights. These requests do not require you to create an account. Contact us if you need this notice or help making a request in an accessible format.

Where available, authorized account and workspace controls also provide export and deletion functions. Deleting a user's account does not necessarily delete records controlled by an organization that continues to use Serre. Contact that organization regarding information it controls.

Use the unsubscribe link in a marketing email or contact us to stop marketing communications. We may keep limited suppression information to honor your choice. Necessary account, security, and transaction messages may continue.

Serre is a business service intended for adults aged 18 or older, not children. Contact privacy@serre.app if you believe a child has provided personal information.

We will post the current policy and its effective date. For material changes, we will email registered users at least 14 days before the changes take effect and obtain any additional consent required by law.

A change in provider or technical configuration does not by itself authorize a materially different use of information. We will review new purposes and disclosures against our existing commitments and provide additional notice or obtain permission where required before using information in that way.