Legal · Privacy
Privacy Policy
Seren introduces you to people worth meeting, and reveals who you are only when you both say yes. This policy explains what personal data we process to do that, why, and the rights you have.
1. Who we are
Seren ("Seren", "we", "us") is a private introduction service that helps people meet the right people at real-world events. Seren is operated by Yamu Ltd, which is the data controller for personal data processed through Seren. You can reach our privacy contact at privacy@seren.social.
2. Scope
This policy covers the Seren website (seren.social), the Seren web app, and the Seren mobile apps. By using Seren you confirm you are 18 or older and have read this policy.
3. The data we process
- Account data — name, email address, password (stored hashed), login identifiers and, where you choose to sign in with a third party, the identifiers that provider gives us.
- Profile & matching signals — what you do, what you're open to, what you can help with, your interests, and the free text you give your agent. We derive embeddings (mathematical representations of meaning) from this to match you. We do not ask for special-category data (such as health, religion or sexual orientation) and ask that you don't volunteer it.
- Connection & messaging data — introductions made, your consent choices at each stage, and messages you send through Seren once two people are connected.
- Event data — events you join or host, registration and check-in, and (for hosts) attendee and outcome data for the events you run.
- Optional nearby discovery — when you switch Nearby on in the iPhone app, Seren exchanges temporary codes over Bluetooth with other participating phones. Our service links these short-lived sessions to signed-in accounts to check eligibility and consider introductions. We do not broadcast your name, email or account ID, collect GPS coordinates through this feature, or send Bluetooth device identifiers to our service.
- Payment data — for host event passes and optional event ticketing, payments are processed by Stripe. We receive confirmation and limited billing metadata (such as purchase, status and payment references); we do not store full card numbers.
- Usage & device data — interactions with the website and apps, device and log data, and the technical device and log data needed to operate and secure the service.
4. How and why we use it (lawful bases under UK GDPR)
| Purpose | Lawful basis |
|---|---|
| Provide the service — accounts, events, introductions, messaging | Performance of a contract |
| Match you with people via your agent and embeddings | Consent (you can pause your agent at any time) |
| Keep people safe — moderation, reports, blocking, fraud prevention | Legitimate interests |
| Payments, billing and ticketing | Performance of a contract / legal obligation |
| Service emails and push notifications (transactional) | Performance of a contract |
| Marketing emails | Consent (opt-in; unsubscribe any time) |
| Understanding how Seren is used, to improve it | Legitimate interests |
5. The blind broker — privacy by design
Nearby discovery is off by default and asks for Bluetooth permission only when you choose to start. It runs while Seren is open, stops after ten minutes or when you leave the app, and can be switched off at any time from Connect or You. It does not restart automatically. Short-lived nearby signals help your agent consider relevant introductions; they do not reveal identities, grant attendance or send messages. Pausing your agent, Quiet mode and Discreet mode disable nearby participation.
Identity on Seren is released in stages, and only by mutual consent. Before a mutual "yes", the other person sees only an abstract, reasoned match — never your surname, photos or contact details. First name, full profile and photos, and contact details are three separate consents; withdrawing consent halts any further disclosure. You can see who saw what, and when, in your activity log.
6. Who we share data with
We share personal data only with processors acting on our instructions, under data-processing agreements. Our current sub-processors are:
- MongoDB Atlas — database hosting
- OpenAI — generating embeddings and match reasoning from your profile signals
- Stripe — host event-pass payments and optional event ticketing
- SendGrid — transactional email delivery
- Expo and Apple Push Notification service — delivering optional iPhone notifications using device push tokens. Notification previews do not include names, introduction reasons or message text.
- Browser notification services (Apple, Google, Mozilla or Microsoft, depending on your browser) — delivering optional desktop alerts using a browser subscription. Alert content is encrypted for your browser and does not include names or message text.
- Our cloud hosting and error-monitoring providers
An up-to-date list is available on request from privacy@seren.social. We do not sell your personal data and we do not share it with advertisers. We may disclose data where required by law or to protect the safety of our members.
7. International transfers
Some processors are outside the UK and EEA. Where that happens we rely on appropriate safeguards — the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or an adequacy decision. Details are available on request.
8. Retention
Your notification history is kept for 30 days. Queued delivery records expire after two days; device registrations expire after 60 days without renewal. You can pause alerts in Notifications or disable them in your device or browser settings. Signing out revokes the associated notification session.
Nearby sessions expire after no more than ten minutes; individual radio codes rotate about every minute and reciprocal observations expire after ninety seconds. Expired signals are rejected immediately and temporary records are automatically removed from the database. Switching off requests immediate session removal; if the phone is offline, the session becomes inactive after its short heartbeat lease expires. Nearby signals are not added to your agent memory or a movement history. Any resulting introduction follows the same consent and retention rules as your other introductions.
We keep personal data only as long as needed for the purposes above. When you delete your account we erase or anonymise your personal data — including your profile, embeddings, introductions and messages — except where we must retain limited records for legal, accounting or safety reasons. Deletion is processed within 30 days, and backups cycle out within a further 30 days. See Your data & deletion.
9. Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict and port your data, to object to processing, and to withdraw consent at any time. You can export your data and delete your account from within Seren (open Agent & privacy) or by emailing privacy@seren.social. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.
10. Security
We use encryption in transit, hashed passwords, access controls, server-assigned roles, signed payment webhooks and rate limiting, among other measures. No system is perfectly secure, but we work hard to protect your data and will notify you and the ICO of a qualifying breach within the required timeframes.
11. Cookies & browser storage
Seren uses only strictly necessary browser storage to keep you signed in — no advertising or third-party tracking cookies. See our Cookie & storage policy.
12. Children
Seren is for adults. It is not directed at anyone under 18 and we do not knowingly process their data. If you believe someone under 18 is using Seren, contact privacy@seren.social.
13. Changes to this policy
We may update this policy from time to time. We'll post the new version here with a new effective date and, for material changes, notify you in-app or by email.
14. Contact
Yamu Ltd, 61c Rivington St, London EC2A 3QQ, United Kingdom · privacy@seren.social