Last updated: June 26, 2026

Application: This Privacy Policy applies to the use of Sero, the applications, website, integrations, and services offered by Sero.

At Sero, everything revolves around trust. We want you to be able to work, create connections, and use data with peace of mind, without worrying about what happens to your information behind the scenes. Your data remains yours. In this Privacy Policy, we clearly explain which personal data and Google user data we process, why we do so, how long we retain data, with whom we may share data, and what choices and rights you have.

This policy also applies to data we receive when you log in with Google via OAuth or when you add Google integrations to Sero, such as Google Analytics, Google Search Console, Google Ads, or other Google services that you actively connect yourself.

1. Who is responsible for your data?

Sero is responsible for the processing of personal data within Sero, unless stated otherwise in a specific situation. This Privacy Policy is intended as a dedicated privacy policy for Sero and should be published on an HTML or rich-text webpage on a domain owned by or verified by Sero.

We try not to make privacy more complicated than necessary. Therefore, we only process data that is required to let Sero operate properly, securely, and reliably.

2. What data do we process?

Depending on how you use Sero, we may process the following categories of personal data:

• Account details, such as your name, email address, account ID, and profile picture;

• Login and authentication data;

• Data you enter, upload, connect, or generate yourself within Sero;

• Data from integrations that you activate yourself, for example, statistics or property data from Google Analytics or Google Search Console;

• Technical data, such as IP address, browser type, device and session data, log files, and security information;

• Communication data, for example, when you contact us;

• Billing and administrative data, if applicable.

We do not collect more data than is necessary for the purposes for which this data is processed. We do not store anything "just in case" if it is not required for the operation, security, or support of Sero.

3. Google OAuth and Google User Data

Sero uses Google OAuth 2.0 to allow users to log in securely and to give users the option to add Google integrations to Sero themselves. Examples include connections with Google Analytics, Google Search Console, Google Ads, or other Google services supported within Sero.

You decide whether to add a Google integration. Without your permission, we do not request access to your Google account or Google services. When you create a connection, Google shows which permissions or scopes are requested. Sero uses these permissions only for the functions for which you activate the integration.

3.1 What Google data do we collect during Google login?

When you sign up or log in via Google, we may receive and process the following Google user data:

• Your first and last name;

• Your email address;

• Your profile picture, if available;

• Your unique Google account ID, as far as necessary to securely link your Sero account to your Google login.

We use this data to verify your identity, create your account, or allow you to log in securely.

3.2 What Google data do we process with Google integrations?

If you voluntarily add a Google integration in Sero, we may—depending on the chosen integration and the scopes approved by you—retrieve or process data from that Google service. Examples include:

• Google Analytics account information, properties, data streams, reports, statistics, traffic data, conversions, and performance indicators;

• Google Search Console sites, verified properties, search performance, queries, pages, impressions, clicks, positions, and technical indexing or performance data;

• Basic data necessary to show which Google account or property is linked to Sero;

• Access and refresh tokens necessary to make the connection work technically, as provided by Google and as long as the connection is active.

The exact data depends on the integration you activate and the scopes you authorize. Sero only requests scopes necessary for the functionality you use. If an integration only requires read permissions, we do not ask for write permissions.

Some integrations do require write permissions. For example, when you enable ad activation, Sero—exclusively upon your instruction—synchronizes the audiences you build in Sero to your own linked advertising account (such as Google Ads Customer Match). We only request such write permissions for the function you activate and use them exclusively for that purpose. This involves writing your own audiences to your own account; we do not use this access to read or collect data from your advertising or analysis accounts other than what is necessary for the activation to work.

3.3 Examples of Google OAuth Scopes

Sero may, depending on the functionality used, request access to scopes such as:

• openid, email, and profile for secure login and basic profile data;

• Google Analytics scopes, for reading Analytics accounts, properties, and reporting data;

• Google Search Console scopes, for reading Search Console sites and search performance;

• Google Ads and Google Data Manager scopes (such as https://www.googleapis.com/auth/datamanager), for synchronizing audiences you have built to your own Google Ads account (Customer Match)—only when you enable ad activation yourself;

• Other Google API scopes necessary for future or additional integrations within Sero.

When additional scopes are required, we will ask for permission separately via Google OAuth. We use Google data exclusively for the function for which you have given permission.

3.4 What do we use Google user data for?

We use Google user data only to provide, secure, and improve Sero for you as a user. Specifically, we use this data for the following purposes:

• To verify your identity;

• To create your account or allow you to log in securely;

• To link your Sero account to your Google login;

• To enable Google integrations chosen by you within Sero;

• To display linked Google data clearly in dashboards, reports, analyses, or workflows within Sero;

• To—only when you enable this yourself—synchronize the audiences you build in Sero to your own linked advertising accounts (such as Google Ads Customer Match), so you can run your own campaigns;

• To provide insights, recommendations, or automations based on the data you have linked;

• To prevent technical errors, abuse, unauthorized access, and security incidents;

• To provide support when you contact us about your account or integrations.

We do not use Google user data for purposes other than providing, securing, supporting, or improving the user-centric functionality of Sero.

3.5 What do we NOT use Google user data for?

We never sell Google user data. We also do not use Google user data for:

• Targeted advertising;

• Personalized advertising;

• Retargeting;

• Interest-based advertising;

• Sale to data brokers;

• Transfer to information traders or data resellers;

• Creditworthiness assessments;

• Lending or financing purposes;

• Building external databases outside the functionality of Sero;

• Training, enriching, or improving third-party AI models.

Google user data is not used for Sero's own advertising purposes and is not transferred to third parties for advertising, data brokering, or reselling purposes.

For clarification: the above restrictions apply to the use of Google user data by Sero itself. The ad activation feature is different: with it, you—at your own instruction and based on your own consent—send your own audiences built in Sero to your own advertising account for your own campaigns. We do not use Google user data for Sero's own advertisements, do not aggregate them into profiles for third-party advertising purposes, and do not sell or share them with third parties for advertising, data brokering, or reselling purposes.

3.6 Sharing of Google User Data

We do not share Google user data with third parties, except when strictly necessary for providing, securing, or supporting Sero, or when we are legally required to provide data.

Examples of parties that may process data on our behalf include:

• Hosting and infrastructure providers;

• Security and monitoring services;

• Authentication or account management providers;

• Support or administrative systems, as necessary;

• AI or analysis providers that exclusively provide functionality within Sero on our behalf, if necessary for a feature you use.

These parties may only process data according to our instructions, for the agreed purposes, and under appropriate contractual and security obligations. We do not allow these parties to sell Google user data or use it for their own advertising, reselling, or AI training purposes.

3.7 Google API Services User Data Policy

Sero's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This means, among other things, that we only use Google user data for permitted, user-centric functionality within Sero and not for prohibited purposes such as Sero's own advertisements, data sales, or training of third-party AI models.

3.8 Storage and Retention Periods of Google User Data

We retain Google user data as long as your Sero account is active or as long as necessary for the purposes described in this Privacy Policy.

For Google integrations:

• We retain basic information about the integration as long as the integration is active;

• We retain access tokens and refresh tokens only as long as necessary for the integration to work;

• We retain retrieved reporting or analysis data as long as necessary for the operation of dashboards, reports, analyses, support, security, or administration within Sero;

• For ad activation, the audiences you build are only written to your linked advertising account at your instruction; if you remove an integration or an audience, we stop synchronizing to that account;

• When you remove an integration, we stop retrieving new data via that integration.

When you delete your account or ask us to delete your data, we delete the Google login data and Google integration data associated with your account, unless we must retain certain data longer due to legal obligations, security, dispute resolution, or administrative reasons.

Active account data is typically deleted within 30 days after a valid deletion request. Data in backups is overwritten or deleted within normal backup cycles, unless longer retention is legally necessary.

3.9 Revoking Google Access

You can revoke Sero's access to your Google account at any time via your Google account security settings. You can manage this via: https://myaccount.google.com/permissions

Additionally, within Sero, if available, you can remove or reconnect specific integrations. After revocation or removal of an integration, Sero can no longer retrieve or write new data via that Google integration unless you grant permission again.

Revoking Google access does not automatically remove all previously processed data from your Sero account. If you want to have your account or personal data deleted, please contact us via the contact details in this policy or use the deletion options within Sero, if available.

4. How do we use personal data?

We process personal data for the following purposes:

• Offering and operating Sero;

• Creating, managing, and securing user accounts;

• Enabling integrations that you add yourself;

• Displaying dashboards, reports, analyses, and insights within Sero;

• Providing support and customer service;

• Personalizing the user experience within the application;

• Improving performance, reliability, and security of Sero;

• Preventing fraud, abuse, and unauthorized access;

• Complying with legal obligations;

• Administration, billing, and contract management, if applicable.

We only process personal data when there is a valid legal basis, such as the execution of an agreement, consent, legal obligation, or our legitimate interest in securing and improving our services.

5. Secure EU Servers

All our servers are located within the European Union, primarily in the Netherlands. This means your data is protected within a strong European privacy framework, including the General Data Protection Regulation (GDPR).

Should data be processed outside the European Economic Area, we ensure appropriate safeguards, such as standard contractual clauses, additional security measures, or other mechanisms permitted under the GDPR.

6. We do not share data, unless necessary for Sero

We never share sensitive information with third parties for commercial sale, advertising, or data reselling. Sometimes it is necessary for certain suppliers to process data for Sero to work properly, for example, for hosting, security, monitoring, authentication, support, or technical infrastructure.

In those cases, we only share what is necessary. Your data remains yours, and parties processing data on our behalf may not use that data for their own purposes.

7. Full GDPR Compliance

Sero operates in line with the GDPR. We conclude appropriate agreements with processors, as required under Article 28 of the GDPR. These state, among other things, that they may only process data according to our instructions and must take appropriate technical and organizational measures.

We process personal data according to the principles of lawfulness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

8. AI Processing and No Model Training

Sero may use AI functionalities and AI providers to deliver the service. This may include summarizing, analyzing, or structuring information within features you use.

We enter into data processing agreements or similar data protection agreements with our AI providers. These agreements oblige providers to process data exclusively according to our instructions and to apply appropriate security measures.

User data, including Google user data, may not be used to train, enrich, or improve third-party AI models, unless you give explicit and separate permission for this. By default, your data is not used for model training.

Your data remains your data.

9. Encryption and Privacy

We take appropriate technical and organizational measures to protect personal data and Google user data against loss, misuse, unauthorized access, disclosure, alteration, and destruction.

Our security measures include:

• Hosting on secure servers within the European Union, primarily in the Netherlands;

• Encryption of data during transit where possible via TLS/HTTPS;

• Encrypted storage for sensitive data where appropriate (including access and refresh tokens of integrations);

• Access restriction based on the need-to-know principle;

• Limited internal access to functional systems;

• Logging, monitoring, and security checks;

• Regular security audits and checks;

• Backup and recovery procedures;

• Contractual security obligations with processors.

We design Sero with privacy and data protection as a starting point, in line with privacy by design and privacy by default as intended in Article 25 of the GDPR.

10. Retention Periods

We retain personal data no longer than is necessary for the purposes for which we collected it, unless a longer retention period is legally required or permitted.

In general:

• Account data is retained as long as your account is active;

• Data from active integrations is retained as long as necessary to provide the integration and associated functions;

• Support and communication data is retained as long as necessary to handle your request and for administrative purposes;

• Billing data is retained in accordance with legal administrative obligations;

• Security logs are retained as long as necessary for security, monitoring, and incident investigation;

• Deleted data may temporarily remain in backups until the backup cycle has expired.

When a retention period expires, we securely delete or anonymize the data.

11. Deletion of Data

At Sero, you are in control of your data as much as possible. You can request the deletion of your personal data, Google integrations, or your entire Sero account.

Following a valid deletion request, we delete your data unless we must retain certain data due to legal obligations, security, disputes, or legitimate administrative purposes.

Deletion requests can be submitted via: [email protected]

If your Sero account is linked to Google login, we also delete the Google login data associated with your Sero account upon account deletion. If you have added Google integrations, we also delete the associated integration data and stop retrieving or writing new data.

12. Your Rights

Under the GDPR, depending on the situation, you have the following rights:

• Right of access to your personal data;

• Right to rectification of incorrect data;

• Right to erasure (right to be forgotten);

• Right to restriction of processing;

• Right to data portability;

• Right to object to certain processing activities;

• Right to withdraw consent when processing is based on consent;

• Right to lodge a complaint with a supervisory authority.

You can submit a request via [email protected]. We may ask you to verify your identity before we comply with your request.

13. No Sale of Personal Data

We do not sell personal data and we do not sell Google user data. We do not provide personal data to third parties for advertising purposes, data brokering, data reselling, creditworthiness assessments, lending or financing purposes, or similar purposes.

14. Minors

Sero is not intended for use by children under the age at which they can independently give consent for data processing under applicable law. If we discover that we have processed personal data of a minor without valid consent, we will delete this data where necessary.

15. Changes to this Privacy Policy

We may adjust this Privacy Policy from time to time, for example, when our services, integrations, legislation, or data processing activities change. The most current version is always available on this dedicated privacy policy webpage.

If we materially change how we use Google user data or other personal data, we will clearly inform users, for example, via email, in-app notification, or a notification on our website. Where legally required, we will ask for consent again.

16. Contact

For questions about this Privacy Policy, privacy rights, or the processing of personal data, you can contact:

Sero
Email: [email protected]
Website: https://sero.tech
Address: Herengracht 231, 1016BG, Amsterdam