Sereya Tech is a trend research platform. This policy explains, in plain words, which personal data we collect when you use sereya.tech, why, who else handles it, how long we keep it and how you can exercise your rights under Brasil's General Data Protection Law (LGPD, Lei nº 13.709/2018).
1. Who is responsible for your data
The controller of your personal data is Yasmim Seadi, the founder of Sereya Tech (a trademark registered at INPI), based in Brasil. Yasmim also acts as the person in charge of data protection (the encarregada, art. 41 of the LGPD).
Contact for anything about your data: privacidade@sereya.tech
2. What we collect
Data you give us
- Account: your name, email address and password. The password is stored only in encrypted (hashed) form; nobody at Sereya can read it.
- Profile: your bio, the categories and regions you chose to follow and, if you add one, your profile photo.
- What you do on the platform: your comments and replies, your likes, the signals you save and your invite code when you join.
- Messages you send us by email.
Data collected automatically
- Session cookies that keep you logged in. They are strictly necessary: without them the login does not work. We do not use advertising or tracking cookies, and we do not use analytics tools that follow you across sites.
- Technical records (IP address, date and time of access, browser and device type) kept by our hosting providers for security and to keep the service running.
We do not collect sensitive personal data (art. 5, II of the LGPD) on purpose. Please do not share it in comments.
3. Why we use it and on which legal basis
| Purpose | Legal basis (LGPD) |
|---|---|
| Create and run your account, let you log in, comment, like and save signals | Performance of a contract you are part of (art. 7, V) |
| Show your name, photo and comments to other members | Performance of a contract (art. 7, V) |
| Choose the signals that match the interests you picked | Performance of a contract (art. 7, V) |
| Keep the platform secure, prevent abuse and fraud, fix errors | Legitimate interest (art. 7, IX) |
| Keep access records required by law and defend rights in legal proceedings | Legal obligation (art. 7, II) and regular exercise of rights (art. 7, VI) |
| Answer your requests and messages | Performance of a contract (art. 7, V) or legitimate interest (art. 7, IX) |
We never sell your personal data and we do not use it for advertising.
4. Who else handles your data
We rely on a few trusted providers (operators, in LGPD terms) who process data only on our instructions:
- Supabase: database, login and file storage (your account, profile, photo, comments).
- Vercel: website hosting and delivery.
- Google Fonts: serves the platform's typeface, so your browser connects to Google's servers and shares your IP address with them.
- News sources' websites: some signals show photos loaded directly from the original publisher's site, which then receives your IP address like any visit to that site.
We may also share data when required by law, by a court order or by a competent authority, or to defend Sereya's rights.
5. International transfer
Supabase, Vercel and Google may store or process data on servers outside Brasil, including in the United States. These transfers are made under art. 33 of the LGPD, relying on the contractual safeguards and security commitments these providers offer.
6. How long we keep it
- Account and profile data: while your account is active. When you ask us to delete your account, we delete or anonymize your data within 15 days, except what the law requires us to keep.
- Comments: while your account is active. When it is deleted, your comments are deleted with it.
- Access records: up to 6 months, as the Marco Civil da Internet (art. 15) requires of application providers.
- Backups made by our providers are overwritten in their normal cycles.
7. Your rights
Under art. 18 of the LGPD you can, at any time and free of charge:
- confirm whether we process your data and access it;
- correct incomplete, inaccurate or outdated data (you can also do it yourself in Settings);
- ask for anonymization, blocking or deletion of unnecessary or excessive data;
- ask for portability of your data to another service;
- ask for deletion of your data and of your account;
- know with whom we share your data;
- withdraw consent where processing is based on it, and be told what that means;
- object to processing based on legitimate interest.
Write to privacidade@sereya.tech from the email of your account. We answer within 15 days. You may also complain to Brasil's data protection authority, the ANPD (www.gov.br/anpd).
8. Security
Your data travels encrypted (HTTPS), passwords are hashed, and database rules make sure each member can only change their own data. No system is completely safe: if an incident may cause you relevant risk or harm, we will tell you and the ANPD, as art. 48 of the LGPD requires.
9. Children and teenagers
Sereya is meant for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will delete it.
10. Changes to this policy
We may update this policy as Sereya grows (for example, if paid plans are launched). We will post the new version here with its date and, for important changes, let members know on the platform or by email before they take effect.