Schedule your free demo

Privacy & Security

Last updated: September 16, 2026


Scope: this privacy policy applies to the useof Sero, the applications, website, connections, and services offered by Sero.

Trust is at the heart of everything we do at Sero. We want you to work, create connections, and use data with confidence—without worrying about what happens to your data behind the scenes. Your data remains yours. In this privacy policy, we clearly explain which personal data and Google user data we process, why we do so, how long we retain data, with whom we may share data, and which choices and rights you have.

This policy also applies to data we receive when you sign in with Google via OAuth or when you add Google connections to Sero, such as Google Analytics, Google Search Console, Google Ads, Google Merchant Center, Google Drive, Google Calendar, or other Google services you actively connect yourself.


1. Who is responsible for your data?

Sero is responsible for processing personal data within Sero, unless stated otherwise in a specific situation. This privacy policy applies to Sero's services, applications, website and integrations.

We don’t make privacy more complicated than necessary. That’s why we process only the data needed to keep Sero working properly, securely, and reliably.


2. What data do we process?

Depending on how you use Sero, we may process the following categories of personal data:

  • account details, such as your name, email address, account ID, and profile photo;

  • login and authentication data;

  • data you enter, upload, connect, or generate within Sero;

  • data from connections you activate yourself, such as statistics or property data from Google Analytics or Google Search Console, campaign and performance data from Google Ads, or product listings from Google Merchant Center;

  • usage data from our website via Google Analytics, only if you consent through the cookie banner;

  • technical data, such as IP address, browser type, device and session data, log files, and security information;

  • communication data, such as when you contact us;

  • billing and administrative data, where applicable.

We don’t collect more data than necessary for the purposes for which it is processed. We don’t store anything “just in case” if it isn’t needed for the operation, security, or support of Sero.


3. Google OAuth and Google User Data

Sero uses Google OAuth 2.0 to let users sign in securely and to give users the ability to add Google connections to Sero themselves. Examples include connections with Google Analytics, Google Search Console, Google Ads, Google Merchant Center, Google Drive, Google Calendar, or other Google services supported within Sero.

You decide whether to add a Google connection. Without your consent, we do not request access to your Google Account or Google services. When you create a connection, Google shows you which permissions or scopes are requested. Sero uses these permissions only for the features for which you activate the connection.

3.1 What Google Data Do We Collect When You Log In with Google?

When you sign up or log in through Google, we may receive and process the following Google user data:

  • your first and last name;

  • your email address;

  • your profile picture, if available;

  • your unique Google Account ID, where necessary to securely link your Sero account to your Google login.

We use this data to verify your identity, create your account, or allow you to sign in securely.


3.2 Which Google data do we process through Google connections?

If you voluntarily add a Google integration in Sero, we may retrieve or process data from that Google service, depending on the selected integration and the scopes you approved. Examples include:

  • Google Analytics account information, properties, data streams, reports, metrics, traffic data, conversions, and performance indicators;

  • Google Search Console sites, verified properties, search performance, search queries, pages, impressions, clicks, positions, and technical indexing or performance data;

  • Google Ads accounts and customer IDs, campaigns, ad groups, ads, keywords, budgets, bids, targeting, ad assets, recommendations, keyword ideas, and performance data such as impressions, clicks, cost, and conversions;

  • Google Merchant Center accounts, account status and notifications, product listings, product statuses and product issues, and performance and price competitiveness reports;

  • Google Drive files you open, create, or share through Sero yourself, and Google Calendar events and availability, to the extent you activate those connections;

  • basic data needed to show which Google account or property is connected to Sero;

  • access and refresh tokens needed to make the connection work technically, to the extent provided by Google and for as long as the connection is active.

The exact data depends on the connection you activate and the scopes you authorize. Sero requests only the scopes needed for the functionality you use. If a connection requires read-only access, we do not request write access. For connections that also let you have changes made through Sero, such as Google Ads and Google Merchant Center, section 3.3 explains how we handle this.


3.3 Google Ads and Google Merchant Center: Management on Your Instruction

When you connect Google Ads, Sero requests the scope https://www.googleapis.com/auth/adwords. This allows us to read your Google Ads accounts, campaigns, and performance and display them in Sero, and to make changes in your own Google Ads account on your instruction. This includes creating or editing campaigns, ad groups, ads, keywords, negative keywords, budgets, bids, targeting, ad schedules, and ad assets, applying recommendations, and pausing or enabling items.

When you connect Google Merchant Center, Sero requests the scope https://www.googleapis.com/auth/content. Google does not offer a separate read-only scope for Merchant Center. Sero uses this connection to read your Merchant Center accounts, account status, product listings, product statuses, product issues, and performance data and display them in Sero. We only make changes to your product listings or account settings if you explicitly instruct us to do so.

For both connections, Sero never makes changes on its own. A change is first shown to you as a proposal and only carried out after you have explicitly confirmed it. New campaigns and ads are created in a paused state so you can review them before they go live, and Sero does not delete campaigns or ad groups.

We use Google Ads and Merchant Center data solely to display, analyze, and, on your instruction, manage your own ads and product listings within your own accounts. We do not use this data to show, target, or personalize ads ourselves, for our own marketing, or for other Sero customers.

If you build an audience in Sero CDP and link it to your own Google Ads account (Customer Match), Sero requests the scope https://www.googleapis.com/auth/datamanager. We use it to send only the audience lists you have selected, with email addresses and phone numbers in hashed form (SHA-256), to your own Google Ads account on your instruction. We do not retrieve any data from Google through this scope for other purposes.


3.4 Google OAuth Scopes Sero May Request

Depending on the Sero product and the functionality you use, Sero may request access to the following scopes:

  • openid, email, and profile for secure sign-in and basic profile information;

  • https://www.googleapis.com/auth/analytics.readonly to read Google Analytics accounts, properties, and reporting data;

  • https://www.googleapis.com/auth/webmasters.readonly to read Google Search Console sites and search performance;

  • https://www.googleapis.com/auth/adwords to read and, on your instruction, manage your Google Ads accounts, campaigns, and reports;

  • https://www.googleapis.com/auth/content to read and, on your instruction, manage your Google Merchant Center accounts and product listings;

  • https://www.googleapis.com/auth/datamanager to send audience lists you have built to your own Google Ads account on your instruction;

  • https://www.googleapis.com/auth/drive.file to access only the Google Drive files you open, create, or share through Sero yourself;

  • https://www.googleapis.com/auth/calendar.events and https://www.googleapis.com/auth/calendar.events.freebusy to read and, on your instruction, create or update events and to view your availability in Google Calendar;

  • other Google API scopes needed for future or additional connections within Sero.

When additional scopes are needed, we request separate consent through Google OAuth. We use Google data only for the function you consented to.


3.5 How Do We Use Google User Data?

We use Google user data only to provide, secure, and improve Sero for you as a user. Specifically, we use this data for the following purposes:

  • verifying your identity;

  • to create your account or let you sign in securely;

  • linking your Sero account to your Google login;

  • to enable Google connections you choose within Sero;

  • displaying linked Google data clearly in dashboards, reports, analyses, or workflows within Sero;

  • to provide insights, recommendations, or automations based on the data you connect;

  • preventing technical errors, misuse, unauthorized access, and security incidents;

  • to provide support when you contact us about your account or connections.

We do not use Google user data for purposes other than providing, securing, supporting, or improving Sero’s user-facing functionality.


3.6 What Do We Not Use Google User Data For?

We never sell Google user data. We also do not use Google user data for:

  • targeted advertising;

  • personalized advertising;

  • retargeting;

  • interest-based advertising;

  • selling data to data brokers;

  • transfers to information brokers or data resellers;

  • creditworthiness assessments;

  • loan or financing purposes;

  • building external databases outside Sero’s functionality;

  • training, enriching, or improving third-party AI models.

Google user data is not used for advertising purposes and is not transferred to third parties for advertising, data brokerage, or reselling purposes.

Managing your own Google Ads campaigns, audience lists, and product listings on your instruction, as described in section 3.3, is the functionality you grant permission for. This does not constitute use of your data for advertising purposes by Sero.


3.7 Sharing Google User Data

We do not share Google user data with third parties, except when strictly necessary to provide, secure, or support Sero, or when we are legally required to disclose data.

Examples of parties that may process data on our behalf include:

  • hosting and infrastructure providers;

  • security and monitoring services;

  • authentication or account management providers;

  • support or administrative systems, where necessary;

  • AI or analytics providers that provide functionality within Sero solely on our behalf, when necessary for a feature you use.

These parties may process data only according to our instructions, for the agreed purposes, and subject to appropriate contractual and security obligations. We do not allow these parties to sell Google user data or use it for their own advertising, reselling, or AI training purposes.


3.8 Google API Services User Data Policy

Sero’s use and transfer of information received through Google APIs complies with the Google API Services User Data Policy, including the Limited Userequirements. This means, among other things,that we use Google user data only for permitted, user-facing functionality within Sero and not for prohibited purposes such as advertising, selling data, or training third-party AI models.

This applies to all data we receive through Google APIs, including data from Google Ads, Google Merchant Center, Google Drive, and Google Calendar. Section 8 explains how we handle AI processing.


3.9 Storage and Retention Periods for Google User Data

We retain Google user data for as long as your Sero account remains active or as long as necessary for the purposes described in this privacy policy.

For Google connections:

  • we retain basic connection data for as long as the connection remains active;

  • we retain access tokens and refresh tokens only for as long as necessary to keep the integration working;

  • retrieved reporting, campaign, product, or analytics data is retained as long as needed for the operation of dashboards, reports, analyses, support, security, or administration within Sero;

  • when you remove a connection, we stop retrieving new data through that connection.

When you delete your account or ask us to delete your data, we delete the Google login data and Google connection data associated with your account, unless we need to retain certain data longer due to legal obligations, security, dispute resolution, or administrative reasons.

Active account data is generally deleted within 30 days after a valid deletion request. Data in backups is overwritten or deleted within the normal backup cycles, unless longer retention is legally required.


3.10 Revoking Google Access

You can revoke Sero’s access to your Google account at any time through your Google account’s security settings. You can manage this through:

https://myaccount.google.com/permissions

You can also remove or reconnect specific connections within Sero, where available. After you revoke or remove a connection, Sero can no longer retrieve new data or make changes through that Google connection unless you grant permission again.

Revoking Google access does not automatically remove all previously processed data from your Sero account. If you want your account or personal data deleted, please contact us using the contact details in this policy or use the deletion options within Sero, if available.


4. How Do We Use Personal Data?

We process personal data for the following purposes:

  • providing and operating Sero;

  • creating, managing, and securing user accounts;

  • enabling connections that you add yourself;

  • displaying dashboards, reports, analyses, and insights within Sero;

  • providing support and customer service;

  • personalizing the user experience within the application;

  • improving the performance, reliability, and security of Sero;

  • preventing fraud, misuse, and unauthorized access;

  • complying with legal obligations;

  • administration, billing, and contract management, where applicable.

We process personal data only when we have a valid legal basis, such as performing a contract, obtaining consent, complying with a legal obligation, or pursuing our legitimate interest in securing and improving our services.


5. Secure EU servers

All our servers are located within the European Union, primarily in the Netherlands. This means your data is protected under a strong European privacy framework, including the General Data Protection Regulation (GDPR).

If data is processed outside the European Economic Area, we ensure appropriate safeguards, such as standard contractual clauses, additional security measures, or other mechanisms permitted under the GDPR.


6. We Don’t Share Data Unless Necessary for Sero

We never share sensitive information with third parties for commercial sales, advertising, or data resale. In some cases, certain vendors need to process data to keep Sero running properly, for example for hosting, security, monitoring, authentication, support, or technical infrastructure.

In those cases, we share only what is necessary. Your data remains yours, and parties that process data on our behalf may not use that data for their own purposes.


7. Full GDPR Compliance

Sero operates in accordance with the GDPR. We enter into appropriate agreements with processors, as required under Article 28 of the GDPR. These agreements state, among other things, that processors may process data only according to our instructions and must implement appropriate technical and organizational measures.

We process personal data according to the principles of lawfulness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.


8. AI Processing and No Model Training

Sero may use AI functionality and AI providers to deliver the service. For example, this may include summarizing, analyzing, or structuring information within features you use.

We enter into data processing agreements or comparable data protection agreements with our AI providers. These agreements require providers to process data only according to our instructions and to implement appropriate security measures.

User data, including Google user data, may not be used to train, enrich, or improve third-party AI models unless you expressly and separately grant permission to do so. By default, your data is not used for model training.

We do not use data we receive through Google APIs, including data from Google Workspace services such as Google Drive and Google Calendar, to develop, improve, or train generalized, non-personalized AI or machine learning models. AI features within Sero process your data only to perform the function you are using at that moment, such as answering a question about your campaigns or drafting a proposal that you then review.

Your data remains your data.


9. Encryption and Privacy

We take appropriate technical and organizational measures to protect personal data and Google user data against loss, misuse, unauthorized access, disclosure, alteration, and destruction.

Our security measures include:

  • hosting on secure servers within the European Union, primarily in the Netherlands;

  • encryption of data in transit, where possible, using TLS/HTTPS;

  • encrypted storage for sensitive data where appropriate;

  • access restrictions based on the need-to-know principle;

  • limited internal access to functional systems;

  • logging, monitoring, and security checks;

  • regular security audits and checks;

  • backups and recovery procedures;

  • contractual security obligations with processors.

We design Sero with privacy and data protection at its core, in line with privacy by design and privacy by default as referred to in Article 25 of the GDPR.


10. Retention periods

We do not retain personal data longer than necessary for the purposes for which it was collected, unless a longer retention period is legally required or permitted.

In general:

  • account data is retained for as long as your account remains active;

  • data from active integrations is retained for as long as necessary to provide the integration and associated features;

  • support and communications data is retained for as long as necessary to handle your request and for administrative purposes;

  • billing data is retained in accordance with statutory record-keeping requirements;

  • security logs are retained for as long as necessary for security, monitoring, and incident investigation;

  • deleted data may remain temporarily in backups until the backup cycle expires.

When a retention period expires, we securely delete or anonymize the data.


11. Data Deletion

At Sero, you remain in control of your data as much as possible. You can request the deletion of your personal data, Google connections, or your entire Sero account.

After a valid deletion request, we delete your data unless we need to retain certain data due to legal obligations, security, disputes, or legitimate administrative purposes.

Deletion requests can be submitted through: [email protected]

If your Sero account is linked to Google login, we also delete the Google login data associated with your Sero account when your account is deleted. If you have added Google connections, we also delete the associated connection data and stop retrieving new data.


12. Your Rights

Under the GDPR, depending on the circumstances, you have the following rights:

  • right to access your personal data;

  • the right to correct inaccurate data;

  • right to delete data;

  • right to restrict processing;

  • right to data portability;

  • right to object to certain processing activities;

  • the right to withdraw consent when processing is based on consent;

  • the right to lodge a complaint with the Dutch Data Protection Authority.

You can submit a request through[email protected]. We may ask you to verify your identity before we process your request.


13. No Sale of Personal Data

We do not sell personal data or Google user data. We do not provide personal data to third parties for advertising purposes, data brokerage, data resale, credit assessments, lending or financing purposes, or similar purposes.


14. Children

Sero is not intended for use by children under the age at which they may independently consent to the processing of personal data under applicable law. If we discover that we have processed a minor’s personal data without valid consent, we will delete that data where necessary.


15. Changes to this privacy policy

We may update this privacy policy from time to time, for example when our services, integrations, legislation or data processing change. The latest version is always available on this page.

If we materially change how we use Google user data or other personal data, we will clearly inform users, for example by email, in-app notification, or a notice on our website. Where legally required, we will request consent again.


16. Cookies and Google Analytics on our website

On sero.tech, we only use strictly necessary cookies, such as for your language and cookie preferences, and analytics cookies from Google Analytics 4. We do not set advertising or marketing cookies.

We only set analytics cookies after you give consent through the cookie banner. Google Analytics shows us how visitors use the website, for example which pages are viewed and how often a demo is booked or a contact form is submitted. This helps us improve the website.

We use Google Consent Mode. Without consent, Google Analytics does not set cookies and Google only receives limited signals without cookies or identifiers, so we can see aggregated visitor statistics. Advertising signals are always turned off for our website, and data is never used for personalized advertising.

Google processes this data on behalf of Sero. Google Analytics 4 does not store IP addresses. Google may process data outside the European Economic Area, subject to appropriate safeguards such as the EU-U.S. Data Privacy Framework and standard contractual clauses. Analytics cookies expire after no more than two years; we keep your cookie preference for twelve months.

You can change or withdraw your choice at any time via “Cookie settings” at the bottom of every page. If you withdraw consent, we immediately remove the analytics cookies from your browser.


17. Contact

For questions about this privacy policy, privacy rights, or the processing of personal data, you can contact:


Sero
Email: [email protected]
Website: https://sero.tech
Address: Herengracht 231, 1016 BG Amsterdam