Last updated: May 16, 2026

Applicability: This privacy policy applies to the use of Sero, the applications, website, integrations, and services offered by Sero.

At Sero, everything revolves around trust. We want you to work, create integrations, and use data with peace of mind, without having to worry about what happens to your data behind the scenes. Your data remains yours. In this privacy policy, we clearly explain which personal data and Google user data we process, why we do it, how long we retain data, with whom we may share data, and what choices and rights you have.

This policy also applies to data we receive when you log in with Google via OAuth or when you add Google integrations to Sero, such as Google Analytics, Google Search Console, or other Google services that you actively integrate yourself.

1. Who is responsible for your data?

Sero is responsible for the processing of personal data within Sero, unless stated otherwise in a specific situation. This privacy policy is intended as a dedicated privacy policy for Sero and is meant to be published on an HTML or rich-text web page on a domain owned or verified by Sero.

We try not to make privacy more complicated than necessary. Therefore, we only process data that is required to keep Sero working well, securely, and reliably.

2. What data do we process?

Depending on how you use Sero, we may process the following categories of personal data:

• account data, such as your name, email address, account ID, and profile picture;

• login and authentication credentials;

• data you enter, upload, integrate, or generate yourself within Sero;

• data from integrations you activate yourself, for example, statistics or property data from Google Analytics or Google Search Console;

• technical data, such as IP address, browser type, device and session data, log files, and security information;

• communication data, for example, when you contact us;

• billing and administrative data, if applicable.

We do not collect more data than necessary for the purposes for which this data is processed. We do not store anything "just in case" if it is not necessary for the operation, security, or support of Sero.

3. Google OAuth and Google User Data

Sero uses Google OAuth 2.0 to allow users to log in securely and to give users the option to add Google integrations to Sero themselves. Examples include integrations with Google Analytics, Google Search Console, or other Google services supported within Sero.

You decide whether to add a Google integration. Without your consent, we do not request access to your Google account or Google services. When you create an integration, Google displays which permissions or scopes are requested. Sero only uses these permissions for the features for which you activate the integration.

3.1 What Google data do we collect during Google login?

When you sign up or log in via Google, we may receive and process the following Google user data:

• your first and last name;

• your email address;

• your profile picture, if available;

• your unique Google account ID, to the extent necessary to securely link your Sero account to your Google login.

We use this data to verify your identity, create your account, or log you in securely.

3.2 What Google data do we process for Google integrations?

If you voluntarily add a Google integration in Sero, we may—depending on the chosen integration and the scopes approved by you—retrieve or process data from that Google service. Examples include:

• Google Analytics account information, properties, data streams, reports, statistics, traffic data, conversions, and performance indicators;

• Google Search Console sites, verified properties, search performance, search queries, pages, impressions, clicks, positions, and technical indexing or performance data;

• basic data required to show which Google account or property is linked to Sero;

• access and refresh tokens required to make the integration work technically, as provided by Google and as long as the integration is active.

The exact data depends on the integration you activate and the scopes for which you grant permission. Sero only requests scopes necessary for the functionality you use. If an integration only requires read permissions, we do not request write permissions.

3.3 Examples of Google OAuth Scopes

Sero may request access to scopes, depending on the functionality used, including:

• openid, email, and profile for secure login and basic profile data;

• Google Analytics scopes, for example, for reading Analytics accounts, properties, and reporting data;

• Google Search Console scopes, for example, for reading Search Console sites and search performance;

• other Google API scopes required for future or additional integrations within Sero.

When additional scopes are required, we ask for permission separately via Google OAuth. We use Google data exclusively for the function for which you have granted permission.

3.4 What do we use Google user data for?

We only use Google user data to deliver, secure, and improve Sero for you as a user. Specifically, we use this data for the following purposes:

• to verify your identity;

• to create your account or log you in securely;

• to link your Sero account to your Google login;

• to enable Google integrations chosen by you within Sero;

• to clearly display integrated Google data in dashboards, reports, analyses, or workflows within Sero;

• to provide insights, recommendations, or automations based on the data you integrated;

• to prevent technical errors, abuse, unauthorized access, and security incidents;

• to offer support when you contact us about your account or integrations.

We do not use Google user data for purposes other than delivering, securing, supporting, or improving the user-facing functionality of Sero.

3.5 What do we NOT use Google user data for?

We never sell Google user data. We also do not use Google user data for:

• targeted advertising;

• personalized advertising;

• retargeting;

• interest-based advertising;

• selling to data brokers;

• transfer to information brokers or data resellers;

• creditworthiness assessments;

• lending or financing purposes;

• building external databases outside of Sero's functionality;

• training, enriching, or improving third-party AI models.

Google user data is not used for advertising purposes and is not transferred to third parties for advertising, data brokering, or reselling purposes.

3.6 Sharing of Google User Data

We do not share Google user data with third parties, except when strictly necessary to deliver, secure, or support Sero, or when we are legally required to provide data.

Examples of parties that may process data on our behalf include:

• hosting and infrastructure providers;

• security and monitoring services;

• authentication or account management providers;

• support or administrative systems, where necessary;

• AI or analytics providers that deliver functionality within Sero solely on our behalf, if necessary for a feature you use.

These parties may only process data in accordance with our instructions, for the agreed purposes, and under appropriate contractual and security obligations. We do not allow these parties to sell Google user data or use it for their own advertising, reselling, or AI training purposes.

3.7 Google API Services User Data Policy

Sero's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This means, among other things, that we only use Google user data for permitted, user-facing functionality within Sero and not for prohibited purposes such as advertising, data sales, or training third-party AI models.

3.8 Storage and Retention Periods of Google User Data

We retain Google user data as long as your Sero account is active or as long as necessary for the purposes described in this privacy policy.

For Google integrations, the following applies:

• we retain basic data about the integration as long as the integration is active;

• we only retain access tokens and refresh tokens as long as necessary to keep the integration working;

• we retain retrieved reporting or analytics data as long as necessary for the operation of dashboards, reports, analyses, support, security, or administration within Sero;

• when you remove an integration, we stop retrieving new data through that integration.

When you delete your account or ask us to delete your data, we delete the Google login data and Google integration data associated with your account, unless we must retain certain data longer due to legal obligations, security, dispute resolution, or administrative reasons.

Active account data is typically deleted within 30 days after a valid deletion request. Data in backups is overwritten or deleted within normal backup cycles, unless longer retention is legally required.

3.9 Revoking Google Access

You can revoke Sero's access to your Google account at any time via the security settings of your Google account. You can manage this via:

https://myaccount.google.com/permissions

You can also remove or reconnect specific integrations within Sero, if available. After revoking or removing an integration, Sero can no longer retrieve new data through that Google integration, unless you grant permission again.

Revoking Google access does not automatically delete all previously processed data from your Sero account. If you want your account or personal data deleted, please contact us using the contact details in this policy or use the deletion options within Sero, if available.

4. How do we use personal data?

We process personal data for the following purposes:

• providing and operating Sero;

• creating, managing, and securing user accounts;

• enabling integrations that you add yourself;

• displaying dashboards, reports, analyses, and insights within Sero;

• providing support and customer service;

• personalizing the user experience within the application;

• improving the performance, reliability, and security of Sero;

• preventing fraud, abuse, and unauthorized access;

• complying with legal obligations;

• administration, billing, and contract management, if applicable.

We only process personal data when there is a valid legal basis, such as the performance of a contract, consent, legal obligation, or our legitimate interest in securing and improving our services.

5. Secure EU Servers

All our servers are located within the European Union, primarily in the Netherlands. This means your data is protected within a strong European privacy framework, including the General Data Protection Regulation (GDPR).

If data is nevertheless processed outside the European Economic Area, we ensure appropriate safeguards are in place, such as standard contractual clauses, supplementary security measures, or other mechanisms permitted under the GDPR.

6. We do not share data, unless necessary for Sero

We never share sensitive information with third parties for commercial sale, advertising, or data resale. Sometimes, however, it is necessary for certain vendors to process data to make Sero work properly, for example, for hosting, security, monitoring, authentication, support, or technical infrastructure.

In those cases, we only share what is necessary. Your data remains yours, and parties processing data on our behalf may not use that data for their own purposes.

7. Full GDPR Compliance

Sero operates in compliance with the GDPR. We enter into appropriate processing agreements with processors, as required under Article 28 GDPR. These state, among other things, that they may only process data according to our instructions and must implement appropriate technical and organizational measures.

We process personal data in accordance with the principles of lawfulness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

8. AI Processing and No Model Training

Sero may use AI functionalities and AI providers to deliver the service. For example, for summarizing, analyzing, or structuring information within features you use.

We enter into data processing agreements or similar data protection agreements with our AI providers. These agreements oblige providers to process data solely in accordance with our instructions and to apply appropriate security measures.

User data, including Google user data, may not be used to train, enrich, or improve third-party AI models, unless you explicitly and separately consent to this. By default, your data is not used for model training.

Your data remains your data.

9. Encryption and Privacy

We take appropriate technical and organizational measures to protect personal data and Google user data against loss, misuse, unauthorized access, disclosure, alteration, and destruction.

Our security measures include, but are not limited to:

• hosting on secure servers within the European Union, primarily in the Netherlands;

• encryption of data in transit where possible via TLS/HTTPS;

• encrypted storage for sensitive data where appropriate;

• access restriction based on the need-to-know principle;

• restricted internal access to functional systems;

• logging, monitoring, and security controls;

• regular security audits and reviews;

• backups and recovery procedures;

• contractual security obligations with processors.

We design Sero with privacy and data protection as starting points, in line with privacy by design and privacy by default as intended in Article 25 GDPR.

10. Retention Periods

We do not retain personal data longer than necessary for the purposes for which we collected it, unless a longer retention period is legally required or permitted.

In general:

• account data is retained as long as your account is active;

• data from active integrations is retained as long as necessary to provide the integration and associated features;

• support and communication data is retained as long as necessary to handle your request and for administrative purposes;

• billing data is retained in accordance with legal administrative retention obligations;

• security logs are retained as long as necessary for security, monitoring, and incident investigation;

• deleted data may temporarily remain in backups until the backup cycle has expired.

When a retention period expires, we securely delete or anonymize the data.

11. Data Deletion

At Sero, you are in control of your data as much as possible. You can request the deletion of your personal data, Google integrations, or your entire Sero account.

Upon receiving a valid deletion request, we delete your data, unless we must retain certain data due to legal obligations, security, disputes, or legitimate administrative purposes.

Deletion requests can be submitted via: [email protected]

If your Sero account is linked to a Google login, we also delete the Google login data associated with your Sero account upon account deletion. If you have added Google integrations, we also delete the associated integration data and stop retrieving new data.

12. Your Rights

Under the GDPR, depending on the situation, you have the following rights:

• right of access to your personal data;

• right to rectification of incorrect data;

• right to erasure (deletion) of data;

• right to restriction of processing;

• right to data portability;

• right to object to certain processing operations;

• right to withdraw consent when processing is based on consent;

• right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

You can submit a request via [email protected]. We may ask you to verify your identity before we comply with your request.

13. No Sale of Personal Data

We do not sell personal data, and we do not sell Google user data. We do not provide personal data to third parties for advertising purposes, data brokers, data reselling, creditworthiness assessments, lending or financing purposes, or similar purposes.

14. Minors

Sero is not intended for use by children under the age at which they can independently consent to data processing under applicable law. If we discover that we have processed personal data of a minor without valid consent, we will delete this data where necessary.

15. Changes to This Privacy Policy

We may update this privacy policy from time to time, for example, when our services, integrations, legislation, or data processing activities change. The most current version will always be available on this dedicated privacy policy web page.

If we make material changes to how we use Google user data or other personal data, we will clearly inform users, for example, via email, in-app notification, or a notice on our website. Where legally required, we will ask for your consent again.

16. Contact

For questions about this privacy policy, privacy rights, or the processing of personal data, please contact:

Sero
Email: [email protected]
Website: https://sero.tech
Address: Herengracht 231, 1016BG, Amsterdam