Sereneo Privacy Policy

Effective date: 19 September 2026

Sereneo is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store and share personal information when you use the Sereneo mobile application, our website and related services (together, the “Service”).

Sereneo is operated by Planviah Helgesen, a sole proprietorship registered in Norway under organisation number 935 477 549, with registered address at Kringsjåveien 19, 5162 Laksevåg, Norway.

For questions about this Privacy Policy or how we process personal information, you may contact us at privacy@sereneo.app.

1. Information We Collect

We collect information that you provide to us, information generated through your use of Sereneo, and limited technical information necessary to operate, protect and improve the Service.

Information you provide

When you create and use a Sereneo account, we may collect:

your name or display name;
your email address;
your date of birth;
account and authentication information;
language, time zone and preferences;
journal entries;
your voice, while you choose to dictate a journal entry;
mood check-ins and associated notes;
stress entries;
gratitude entries;
tags, goals, reminders and other information you choose to record;
information you provide when contacting us; and
information you choose to submit through optional features.

The nature of Sereneo means that some information you choose to record may reveal information about your physical or mental wellbeing. We treat this information with particular care.

Information generated through the Service

We may create or process information derived from your use of Sereneo, including:

summaries and statistics based on your entries;
weekly, monthly and yearly Reflections;
AI-generated summaries, analyses or insights where you have enabled AI features;
subscription status and entitlement information; and
records of the privacy choices and consents you have made.

Technical and usage information

We may collect limited technical and usage information, such as:

app version and operating system;
device type;
app launches and feature usage;
screens or features viewed;
interaction and performance information;
crash and diagnostic information;
IP address and standard server request information;
security and authentication events; and
information about how you reached or interact with our website or application.

Where required by applicable law, optional analytics and similar technologies are used only after you have provided the relevant permission or consent.

2. How We Use Personal Information

We use personal information for the following purposes:

to create, authenticate and maintain your account;
to provide the journaling, mood, gratitude, Reflection and other features of Sereneo;
to synchronise and store your information across supported devices;
to personalise your experience based on the information and preferences you provide;
to provide AI-powered features where you have chosen to enable them;
to manage subscriptions and access to paid features;
to send account, security, service and notification messages;
to send you marketing emails, such as tips, news and offers, if you have agreed to receive them;
to provide customer support;
to maintain the security, reliability and integrity of the Service;
to identify and resolve technical problems;
to understand how Sereneo is used and improve our products and features;
to measure the effectiveness of our marketing and advertising;
to prevent fraud, misuse and unauthorised access;
to comply with applicable legal obligations; and
to establish, exercise or defend legal claims.

We do not use your journal entries, mood notes, gratitude entries, Reflections, AI conversations or similar wellbeing content to personalise advertising.

We do not sell your personal information.

3. Wellbeing and Sensitive Information

Sereneo is designed to help users reflect on their thoughts, emotions, habits and wellbeing. Information that you choose to enter into Sereneo may therefore constitute health data or other sensitive personal information under applicable law.

Where the GDPR applies, we process health-related information only where a valid legal basis and an applicable condition under Article 9 GDPR are available. For the core wellbeing features of Sereneo, this processing is based on your explicit consent.

You may withdraw your consent at any time. Withdrawal does not affect processing that was lawful before the withdrawal.

Because processing this information is necessary for certain core Sereneo features, withdrawing consent to the processing of wellbeing information may mean that those features can no longer be provided.

4. Artificial Intelligence Features

Sereneo offers optional features that use artificial intelligence to provide summaries, reflections, patterns or other insights based on information you have recorded.

AI processing is optional and is not enabled unless you provide the required consent.

When you use an AI feature, information relevant to the requested feature may be securely transmitted to an AI service provider acting on our behalf. Depending on the feature, this may include portions of your journal entries, notes, gratitude entries, wellbeing information, statistics or previously generated summaries.

We limit the information shared to what is reasonably necessary to provide the feature.

We do not send your name or email address as part of the content submitted for AI generation where this is not necessary for the service.

Information submitted through Sereneo’s AI features is not used by us to train general-purpose AI models.

AI-generated content is intended for reflection and informational purposes only. It is not medical advice, diagnosis or treatment and should not be relied upon as a substitute for professional healthcare.

Sereneo does not use AI to make decisions that produce legal or similarly significant effects about you.

Dictation

If you choose to speak a journal entry instead of typing it, Sereneo converts your speech to text. For most languages, this happens on your device, using the speech recognition built into your device.

For some languages, and only if you have enabled AI features, your voice is streamed securely to our AI service provider so that it can be transcribed. We use the audio only to produce the text, and we do not store it. The resulting text becomes part of your journal entry.

Sereneo uses the microphone only while you are dictating.

5. Analytics and Advertising Measurement

We use analytics to understand how Sereneo is used, identify problems and improve the Service.

Where required, analytics in the application or website is activated only after you have made the relevant privacy choice.

Analytics information may include technical information and events such as app launches, screen views, feature usage, session information, subscription status and similar interaction data.

We do not include the content of your journal entries, mood notes, gratitude entries, Reflections or AI-generated wellbeing content in product analytics.

We may also work with advertising and measurement providers to understand whether our marketing campaigns result in application installs, registrations, trials, subscriptions or other selected conversion events.

This may involve privacy-preserving attribution technologies provided by operating-system providers and limited information supplied to advertising or measurement partners.

We do not use advertising identifiers to track you across applications or websites where you have not provided the permissions required by applicable law.

Sereneo does not require cross-app tracking in order to use the Service.

Our advertising measurement is intended to measure the effectiveness of campaigns and improve how we allocate our marketing budget. Sensitive wellbeing content is not shared with advertising platforms for advertising purposes.

We share an account identifier with our measurement provider, so that a subscription which starts, converts from a trial or renews at a later date can be matched to the campaign that led to it. That identifier is the one we use internally to recognise your account. It is not your name, your email address, or anything you have written in Sereneo.

Advertising platforms are joint controllers with us

Some of the advertising platforms we measure campaigns on are not simply our service providers. For the conversion information they receive about actions taken in Sereneo — such as creating an account, completing onboarding, starting a trial or subscribing — we and the platform together decide why and how that information is used at the point it is collected and sent. Under the GDPR that makes us joint controllers with them for that step. The platforms are Meta, TikTok, Apple and Snapchat.

This is the essence of those arrangements, which we are required to make available to you:

We and the platform are jointly responsible for collecting that conversion information in Sereneo and transmitting it to the platform.
Once the platform has received it, the platform alone determines what it does with it, under its own terms and its own privacy policy, and the platform is responsible for that processing.
Each platform is responsible for informing you about its own processing and for answering you when you exercise your rights in relation to it.
You may exercise your data-protection rights against us or against the platform. If you contact us, we will tell you what we can do ourselves and where to go for the rest.

This sharing happens only on devices where you have agreed to analytics and advertising measurement. If you have not agreed, no conversion information is sent.

6. Subscriptions and Payments

If you purchase a subscription through the App Store, payment processing is handled by Apple.

We do not receive or store your payment-card details.

We may receive limited information relating to your purchase or subscription, such as:

the subscription product;
subscription status;
trial status;
purchase and renewal dates;
expiry or cancellation information; and
information required to determine your entitlement to premium features.

We may use service providers to help validate purchases and manage subscription entitlements.

Deleting your Sereneo account does not automatically cancel an App Store subscription. Subscriptions must be cancelled through your Apple account settings.

We disclose personal information only where necessary for the purposes described in this Privacy Policy.

Service providers

We use third-party service providers to help operate Sereneo. These may include providers of:

cloud hosting and infrastructure;
artificial intelligence;
product analytics;
advertising measurement and attribution;
subscription management;
email delivery, including transactional and marketing email;
crash reporting and diagnostics;
infrastructure monitoring;
website hosting; and
customer support and communication tools.

These providers may process personal information on our behalf only as necessary to provide their services and subject to contractual and legal requirements applicable to the relationship.

Where possible, we limit the information provided to each service provider to what is necessary for its particular function.

Advertising platforms

The advertising platforms named in Section 5 receive conversion information about actions taken in Sereneo. For that information we are joint controllers with them rather than their customer instructing a service provider, and the essence of the arrangement is set out in Section 5.

Platform providers

Certain services are provided directly by third parties acting under their own privacy terms. For example, Apple may process information when you download Sereneo from the App Store, use Sign in with Apple, enable push notifications or make an App Store purchase. Google may process information if you choose to use Google Sign-In.

Their processing is governed by their respective privacy policies.

Legal requirements and protection

We may disclose information where reasonably necessary to:

comply with applicable law or a legally binding request;
respond to lawful requests from courts or public authorities;
protect the rights, security or property of Sereneo, our users or others;
investigate fraud, abuse or security incidents; or
establish, exercise or defend legal claims.

Business transfers

If Sereneo or its business is involved in a merger, acquisition, financing, restructuring or sale of assets, personal information may be transferred as part of that transaction, subject to applicable law and appropriate safeguards.

We do not sell personal information for monetary consideration.

8. Legal Bases for Processing

Where the GDPR or equivalent EEA data-protection rules apply, our processing generally relies on one or more of the following legal bases:

Performance of a contract. We process information necessary to create and administer your account, provide the Service, manage subscriptions and provide features you request. This includes the account and service emails described in Section 14.

Consent. We rely on consent where required, including for the processing of health-related information, optional AI processing, certain analytics technologies, certain notifications, marketing emails and other optional features.

Legitimate interests. We may process limited information where necessary for legitimate interests such as securing and maintaining the Service, preventing misuse, diagnosing technical problems, improving reliability, operating our website and measuring the effectiveness of our business activities, provided those interests are not overridden by your rights and freedoms.

Legal obligations. We process information where necessary to comply with obligations imposed by applicable law, including accounting, tax, security and data-protection requirements.

Where we process health data or other special-category data, we also rely on an applicable condition under Article 9 GDPR, normally your explicit consent.

9. International Data Transfers

Sereneo is based in Norway, and our primary application infrastructure is hosted within the European Economic Area.

Some of our service providers or their sub-processors may process information in countries outside Norway or the EEA, including the United States.

Where personal information is transferred outside the EEA, we use appropriate safeguards where required by law. These may include:

an adequacy decision adopted by the European Commission;
the European Commission’s Standard Contractual Clauses;
participation in an approved data-transfer framework where applicable; or
other safeguards permitted under applicable data-protection law.

Our email delivery provider is established in the United States. It stores the information described in Section 14 there, and its own service providers also process that information in the United States. This transfer relies on the provider’s certification under the EU-U.S. Data Privacy Framework.

You may contact us at privacy@sereneo.app if you would like more information about the safeguards applicable to an international transfer.

10. Data Security

We use technical and organisational safeguards designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures include, where appropriate:

encryption in transit;
encryption of sensitive stored content;
access controls;
secure authentication and credential storage;
encrypted backups;
monitoring and security logging;
restrictions on access to production systems; and
measures designed to detect vulnerabilities and unauthorised activity.

Sereneo is not end-to-end encrypted. Our systems must be capable of processing certain information in order to provide functions such as synchronisation, Reflections and optional AI features.

No system can be guaranteed to be completely secure. If you believe you have identified a security vulnerability, you may contact security@sereneo.app.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Service, complying with legal obligations, resolving disputes and maintaining security.

In general:

account information and user-created wellbeing information are retained while your account remains active;
information that you delete is removed from active systems and may remain temporarily in encrypted backups;
security and server logs are retained for limited periods appropriate to their security purpose;
diagnostic information is retained for a limited period;
subscription and accounting records may be retained where required by law; and
analytics and advertising-measurement information is retained according to the relevant purpose, privacy settings and applicable retention controls.

We periodically review retention periods and delete or anonymise information when it is no longer required.

12. Account Deletion

You may delete your Sereneo account from within the application.

Deleting your account removes your account and associated user-created information from our active systems, subject to limited exceptions required for security, legal compliance, accounting, dispute resolution or backup processes.

Information remaining in routine backups will be deleted as those backups expire according to our retention schedule.

Some records may be retained where required by law or where reasonably necessary to establish, exercise or defend legal claims.

Deleting your Sereneo account does not cancel an active App Store subscription.

13. Your Privacy Rights and Choices

Depending on where you live, you may have rights regarding your personal information.

Where the GDPR applies, these include the right to:

access personal information we hold about you;
correct inaccurate information;
request deletion of your information;
restrict certain processing;
receive certain information in a portable format;
object to processing based on legitimate interests;
object at any time, without giving a reason, to the use of your personal information for direct marketing, including marketing emails; and
withdraw consent at any time where processing is based on consent.

You can manage several privacy choices directly within Sereneo, including applicable analytics, AI, notification and marketing email settings.

You may also request a copy of your information using Sereneo’s export functionality or by contacting us.

To exercise your rights, contact privacy@sereneo.app.

We may need to verify your identity before completing certain requests.

Where GDPR applies, we normally respond within one month, subject to the extensions permitted by law.

You also have the right to lodge a complaint with a competent supervisory authority. Our lead supervisory authority is:

Datatilsynet The Norwegian Data Protection Authority Norway www.datatilsynet.no

14. Notifications and Communications

If you enable notifications, Sereneo may process information necessary to deliver them, including a device notification token and your notification preferences.

You can control notifications through Sereneo and your device settings.

We may send service-related emails that are necessary to operate your account, such as email verification, password resets, important security notices or material service updates.

We send marketing emails, such as tips, news about Sereneo and offers, only if you have agreed to receive them. You give that consent in Sereneo. The choice is never pre-selected, and saying no does not affect your use of the Service. This consent is also the prior consent that Norwegian marketing law requires before a business sends marketing by email. We keep a record of when you gave or withdrew it.

We use an email platform to send both account emails and marketing emails. Every Sereneo account that has an email address is held on that platform, so that we can send the account and service emails described above. For each account, the platform holds your email address, your language, an account identifier and whether you have agreed to marketing emails. When it sends you an account email, it also receives the name we use to greet you and the link or address that email contains. It does not receive your journal entries, mood notes, gratitude entries, Reflections, subscription status or any other wellbeing information.

Marketing emails are sent only to people who have agreed to receive them and whose email address has been confirmed.

You can stop marketing emails at any time, in either of two ways:

turn off marketing emails in Sereneo’s privacy settings; or
use the unsubscribe link included in every marketing email.

Stopping marketing emails does not stop the account and service emails you need to use Sereneo, such as email verification and password resets.

If you delete your account, we also delete your contact record from the email platform.

15. Website, Cookies and Similar Technologies

Our website may process standard technical information necessary to deliver and secure the site, including IP address, browser information and requested pages.

We may also use analytics technologies to understand how visitors use the website.

Where storing or accessing information on your device requires consent under applicable law, those technologies will not be activated until you have made the relevant choice.

You can change applicable cookie or analytics preferences through the controls made available on the website.

We may use privacy-preserving or aggregate measurements that do not identify individual visitors.

16. Children

Sereneo is not intended for persons under 16 years of age.

We do not knowingly provide the Service to or collect personal information from children under 16.

We request date-of-birth information during account setup to enforce this age requirement. If the information provided indicates that a user is under 16, the Service will not be made available and associated account information will be deleted.

If we learn that we have collected personal information from a child under 16, we will take reasonable steps to delete it.

Concerns regarding a child’s information may be reported to privacy@sereneo.app.

17. California and Other U.S. Privacy Rights

Residents of certain U.S. states may have additional privacy rights under applicable state law.

Depending on the jurisdiction, these may include rights to:

know or access categories and specific pieces of personal information;
request correction or deletion;
obtain a portable copy of personal information;
obtain information about categories of recipients; and
opt out of certain uses of personal information where applicable.

Sereneo does not sell personal information for monetary consideration.

Sereneo does not use sensitive wellbeing information for targeted advertising.

Where applicable law treats certain disclosures for targeted or cross-context behavioural advertising as a “sale” or “sharing,” Sereneo will provide the choices and mechanisms required by that law.

You may exercise applicable privacy rights by contacting privacy@sereneo.app.

We will not discriminate against you for exercising a privacy right.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time as Sereneo, our technology or applicable law changes.

When we make changes, we will update the effective date at the top of this page.

If a change materially affects how we process sensitive information or otherwise requires renewed consent under applicable law, we will provide appropriate notice and obtain consent where required.

The current version of this Privacy Policy is available at sereneo.app/privacy.

19. Contact Us

The controller responsible for the processing described in this Privacy Policy is:

Planviah Helgesen Organisation number: 935 477 549 Kringsjåveien 19 5162 Laksevåg Norway

Privacy: privacy@sereneo.app General support: support@sereneo.app Security: security@sereneo.app