SereaneBack to home
Your data, plainly

Privacy Policy

This policy explains what data Sereane handles, why, who it is shared with, and how to exercise your rights.

Last updated: 4 September 2026

This is a translation, provided so you can read it. The document is governed by French law, and the French version is the one that legally applies. Read the French version

1. Data controller

Sereane is published by Benjamin Pierre Alain GILLET, a sole trader (entrepreneur individuel) registered under SIREN number 928 700 772, established at 1 Lieu-dit La Basque, 33420 Jugazan, France.

Contact for any question about privacy or to exercise your rights: admin@sereane.com.

2. Data processed

Sereane processes only the information necessary for the service to operate:

  • Account and authentication: email address, account identifier, role, subscription status, sign-in events and session tokens.
  • Google OAuth: the email address and technical identifiers returned by Google to sign you in. Sereane never receives your Google password.
  • Etsy shops: shop identifiers and names, orders, references, products, variations, amounts, buyers, delivery addresses where fulfilling an order requires them, after-sales messages, and shipping or tracking information.
  • AliExpress: account and product identifiers, variations, prices, orders, payment states declared by the user, carriers and tracking needed to reconcile with Etsy.
  • Sereane payment: plan, subscription status, invoice references, Stripe identifiers and billing event history. Full card details are collected and held by Stripe, not by Sereane.
  • Support and security: exchanges with the team, diagnostics, technical logs, IP address and browser or device information where needed for security and troubleshooting.
  • Cookies and local storage: session cookies or equivalent mechanisms strictly necessary for authentication, security and keeping your preferences. Sereane sets no advertising cookies.

3. Purposes and legal bases

  • Performing the contract: creating and securing your account, connecting the services you choose, displaying your cockpit, automating or assisting order and tracking processing, drafting after-sales replies, providing support and managing the subscription.
  • Complying with our legal obligations: invoicing, accounting, handling rights requests and responding to authorised authorities.
  • Legitimate interest: preventing fraud and abuse, protecting the service, diagnosing incidents, measuring reliability and improving existing features without incompatible reuse of your data.
  • Consent or a positive action by the user: authorising an OAuth connection or an optional third-party integration. This authorisation can be withdrawn from the third-party service and, where applicable, from Sereane.

4. Source of the data

The data comes from you, from your use of Sereane, from the Etsy shops and AliExpress accounts you choose to connect, from Google during OAuth authentication, and from Stripe for billing information. Sereane does not buy prospecting files containing your data.

5. Recipients and processors

Access is limited to authorised Sereane personnel and to the necessary providers, each for their role:

  • Cloudflare: hosting, running the service, technical storage, content delivery and traffic protection.
  • Stripe: subscription, payment, billing and fraud prevention.
  • Google OAuth: authentication and the consent screen when you choose "Continue with Google".
  • Resend: sending transactional emails, in particular sign-in links and welcome messages.
  • ntfy: technical alerts sent to the Sereane team (outage, stuck queue, request to handle). This channel is not authenticated: we only write counters and technical identifiers to it, never a buyer's name, e-mail, address or message. We would rather tell you it is public than present it as a private channel.
  • Tracktaco: supplies replacement tracking numbers, and only if you enable tracking relay on a shop. We send it the parcel's destination — the country, the city, and the state for the United States — so it can return a number consistent with it. Neither the name, nor the exact address, nor the e-mail, nor your buyer's messages are sent to it.
  • Cainiao (the AliExpress group's logistics arm) : we query its public tracking service to find out where a parcel sent from China stands, and to retrieve, where one exists, the local carrier's tracking number — the only one Etsy can recognise. We send it the parcel's tracking number, and nothing else.
  • The language-model provider that drafts after-sales replies — OpenAI, or Anthropic, depending on which model is used for the service. It is the only provider we send the content exchanged with your buyers to outside our hosting — Cloudflare hosts it, since that is where your data lives. We would rather write this precisely than let you guess.

What exactly goes to this provider. Two things need to be told apart, because they follow different rules.

1. What Sereane adds from its own records. The buyer's first name, the delivery country, the order and tracking details, and a summary of their previous requests. Their full delivery address is added only when the conversation is identified as a request to change or correct an address; for every other conversation, only the country is added. This identification is done automatically: it can get it wrong, in either direction.

2. What your buyer wrote themselves. Their latest messages and the photo they may have attached. We remove nothing from them: if they write their address there, or photograph a shipping label, that content goes along with it — it is the message we are replying to. We only limit its volume: the most recent messages in the thread, truncated beyond a certain length, and a single photo, sent only if it could be retrieved.

When. Every time a conversation needs to be understood or drafted. Automatically, when a message arrives: sorting it, analysing its tone, then drafting the reply — the sorting happens even when no draft is ultimately produced. At your request, when you use an assisted action in the cockpit: translating a message, rephrasing a reply, suggesting reply options. And when learning a shop's tone, where its message history is analysed to extract its voice. Outside these cases, nothing from your conversations is sent to it, and it receives neither your credentials, nor your payment details, nor your accounts.

AliExpress is not on this list, and that is not an oversight. It is not our provider: it is yours. The account is yours, the choice of supplier is yours, and you are the one who decides to ship from China by placing the order. Our software transmits the delivery address on your instruction — we spell this out precisely for that reason, in §6 — but we are not the controller in that relationship, and we cannot impose anything on a marketplace where you hold your own account.

Data may also be disclosed to a legally authorised authority. It is neither sold nor rented.

6. Transfers outside the European Economic Area

A general sentence such as "the transfer relies on a recognised mechanism" tells you nothing: it says neither who, nor where, nor which one. So here is the detail, recipient by recipient.

  • Cloudflare — hosting and running the service. Processing possible from the United States and other countries. Mechanism: the European Commission's standard contractual clauses.
  • Stripe — payment and billing. Ireland and the United States. Mechanism: standard contractual clauses.
  • Google — OAuth authentication. United States. Standard contractual clauses.
  • Resend — transactional e-mails. United States. Standard contractual clauses.
  • The language-model provider (OpenAI or Anthropic) — United States. Standard contractual clauses. This is the recipient that receives the content of messages; §5 states exactly what.
  • ntfy — technical alerts to the team. Server located in Europe. Unauthenticated channel (see §5).
  • Tracktaco — replacement tracking numbers. United States. No transfer commitment has been signed with this provider. Nothing is sent to it unless you enable tracking relay.
  • Cainiao — tracking of parcels sent from China. China. This is a public tracking service we query: here too, no negotiated contract, and China benefits from no adequacy decision. What is sent is limited to the parcel's tracking number — §5 states exactly that.

And a SECOND transfer to China, which is not ours, but which our software carries out for you. The tracking query just above leaves our servers and is therefore ours; this one is of a different nature. Your buyer's delivery address is sent to China so the parcel can be shipped to them. That one is yours: your supplier account, your choice to ship from there, and you are the one who orders it by placing the order — without the address, there is no delivery. Our role is limited to carrying it out on your instruction.

We tell you this because you need to know it, and because it is up to you to inform your buyers: China benefits from no adequacy decision, and this transfer is covered by no contract that we negotiated — it falls under the marketplace's terms, which you accept by opening an account there. We would rather write it than let you discover it, and it is one of the points that §8 bis says should be assessed by a professional.

You may ask us for a copy of the safeguards applicable to a given recipient: write to admin@sereane.com.

7. Retention periods

  • For as long as your account exists, its data is kept: we do not close an account for inactivity, and we would rather write that than let you think there is an automatic clean-up.
  • If you request deletion of your account from your workspace, your request is handled within a target of 30 days from the request: your e-mail address, those of the members you invited, your sign-in links and your shops' seller e-mail address are erased, and the account is marked closed. What must be kept for accounting reasons remains (next line), and an erased item of data may survive for up to 7 days in our backups.
  • Closing your account does not cancel your subscription, and cancelling does not close your account: these are two separate actions. We therefore refuse to erase an account while a subscription is still active on it — otherwise we would keep charging you after erasing the address that let us reach you. Ask us for both in the same message, or cancel first: admin@sereane.com. Cancellation takes effect under §7 of the terms.
  • Records and information required by accounting or tax obligations may be kept for up to 10 years.
  • Security and diagnostic logs are kept for a maximum of 12 months, unless an incident justifies a longer evidentiary retention.
  • A magic link expires after 15 minutes. The application session expires according to its technical duration and may be interrupted by signing out or revocation.

A deletion request may lead to faster erasure, subject to legal obligations and to data strictly necessary as evidence of a contract, a payment or a dispute.

7 bis. Your buyers' data

To track your orders, Sereane processes data that does not concern you, but your buyers: their name, their delivery address, sometimes their e-mail or phone number, and the content of the messages they send you on Etsy. These people are not Sereane's customers and have never heard of us.

Who is responsible for what. The detail of our commitments to you on this data lives in the data processing addendum. In short: towards your buyer, you are the controller: you are the one who collects the data, you decide what it is used for. Sereane acts on your behalf, on your instructions: we are the processor. This discharges us of nothing towards you — we must secure this data, process it only for what has been agreed, and delete it when you ask or when the period expires.

  • We keep it for 180 days, counted from the order date — not the date we saw it. Once that period has passed, a daily sweep erases the name, address, e-mail, phone number, customs identifier and message content.
  • The order itself remains. We only erase the fields that identify a person. Amounts, dates and product references remain: they are your figures, your accounts, and you are entitled to keep them.
  • An after-sales conversation is counted from its last message: as long as it is live, it stays readable. A conversation open for more than 365 days nonetheless has its details erased, even if active — an exception must not become permanent. Its recent messages, however, are spared as long as they are less than 180 days old: we never erase a message you have not yet had the chance to read.
  • Our backups are kept for 7 days. An erased item of data may therefore survive there for up to seven more days. ⚠️ This sentence was false until 23 August 2026: the clean-up kept the last seven backups, which is not the same thing — if they failed for a week, seven backups could cover months. It is now a cap in days, and it applies even when only a single backup remains. We mention this rather than fix it silently.
  • If a buyer demands erasure, they will contact you. You can erase their data yourself from your cockpit, immediately, without writing to us and without waiting for the 180 days.

One exception: the delivery address is sent to the supplier shipping the parcel, including outside the European Union. Without it, the order cannot be delivered.

8. Cookies and trackers

Sereane uses only trackers necessary for sign-in, security and interface preferences. They are not used to build an advertising profile. You can clear them in your browser; this will sign you out or reset some preferences.

9. Your rights

Depending on your situation and the legal basis of the processing, you have the rights of access, rectification, erasure, restriction, objection and portability. You can withdraw your consent at any time where a processing activity relies on it. You can also set directives on what happens to your data after your death, under the conditions laid down by French law.

Write to admin@sereane.com describing your request. Proof of identity will only be requested where there is reasonable doubt. Sereane generally responds within one month, a period that may be extended in the cases provided for by the GDPR.

You may lodge a complaint with the CNIL (the French data protection authority) if you believe your rights are not being respected.

10. Who is responsible for what

For Etsy or AliExpress data that you entrust to Sereane in the course of your business, you remain responsible for informing your own buyers and for the lawfulness of processing their data. Sereane acts to provide the requested features and does not reuse this data for its own prospecting.

11. Security and changes

Sereane applies proportionate technical and organisational measures: access control, encryption of communications, account isolation, minimisation of exposed data and error monitoring. As no system is infallible, an incident presenting a risk will be handled and notified in accordance with applicable obligations.

This policy may evolve to reflect the service or the regulations. The update date appears at the top of the page; any substantial change will be brought to users' attention by an appropriate means.