Privacy Policy
Last updated 16 October 2026
1. Who we are
Serafini d.o.o., trading as Serafinity, is the data controller for the personal data described in this policy.
- Registered address: Horvatovac 76B, 10000 Zagreb, Croatia
- OIB: 57640459658
- VAT: HR57640459658
- Email: support@serafinity.com
We have not appointed a Data Protection Officer, as we are not required to.
2. What this policy covers
This policy covers personal data we collect through serafinity.com, through our onboarding process, and in the course of delivering audits and subscriptions. Our Terms of Service govern the services themselves.
3. What we collect, and why
| What we collect | Where it comes from | Why we use it | Lawful basis |
|---|---|---|---|
| Name and email address | Checkout and the onboarding form | To deliver your audit and communicate with you about it | Performance of a contract |
| Company name, website, billing address | Checkout and the onboarding form | To issue invoices and identify the business we are working with | Performance of a contract, and legal obligation for invoicing |
| VAT identification number | Checkout | To apply the correct VAT treatment | Legal obligation |
| Payment card details | Entered directly with our payment processor. We never see or store them | To take payment | Performance of a contract |
| Business information you give us at onboarding, including spend, targets, margins, competitors and customer description | The onboarding form | To produce the audit you purchased | Performance of a contract |
| Advertising account data, including campaign, spend, conversion and creative performance data | Read-only access you grant to your advertising account | To produce the audit you purchased | Performance of a contract |
| Correspondence with us | To answer questions and keep a record of what was agreed | Legitimate interests | |
| Waitlist email address | The Minimum waitlist form | To tell you when Minimum, our free tier, opens | Consent |
| Usage data: pages viewed, clicks, device, browser and approximate location | Your browser, through Google Analytics and PostHog, only if you accept analytics cookies | To understand how the site is used and improve it | Consent |
| Session recordings and heatmaps: how pages are used, with anything you type hidden | Your browser, through PostHog, only if you accept analytics cookies | To find where the site is confusing or broken | Consent |
We do not use personal data for automated decision-making or profiling.
4. Advertising account access
When you grant us read-only access to an advertising account, we can view campaign structure, spend, performance and conversion data, and the datasets connected to that account. We cannot create, edit, pause or delete anything.
We use that access only to produce the audit you purchased. We do not use your data to inform work for any other client, and we do not retain access after an engagement ends unless you have an ongoing subscription with us.
You can revoke access at any time in Meta Business Suite, and we ask you to do so once your engagement is complete.
5. Who we share data with
We do not sell personal data and we do not share it for anyone else's marketing. We use the following processors to run the business:
| Processor | What they handle | Where data is processed |
|---|---|---|
| Stripe | Payments, invoicing and tax calculation | European Union and United States |
| Tally | Our onboarding form and its submissions, hosted on Tally's own domain | European Union |
| Lovable | Website hosting, delivered through Cloudflare's global network | European Union and worldwide |
| Google Workspace | Email correspondence | European Union and United States |
| Google Analytics | Usage data from visitors who accept analytics cookies | European Union and United States |
| PostHog | Usage data, session recordings and heatmaps from visitors who accept analytics cookies | European Union |
| Trustpilot | Review invitations and published reviews, from the point we enable reviews | European Union |
Where a processor handles data outside the European Economic Area, transfers are covered by Standard Contractual Clauses or an equivalent safeguard.
We may also disclose data where we are legally required to do so.
6. Anonymised sample audits
We may publish anonymised sample audits. Anonymising means removing the brand name, domain, account and dataset identifiers, campaign and asset names, product names and any other identifying detail, and rounding currency figures.
You may opt out at onboarding or at any time afterwards by emailing support@serafinity.com. Where a sample has already been published, we will remove it within 30 days.
7. How long we keep things
| What | How long |
|---|---|
| Invoices and accounting records | For as long as Croatian accounting law requires |
| Onboarding form submissions and delivered audits | 3 years after delivery, so we can answer questions about our own work and handle guarantee claims |
| Advertising account data pulled during an audit | Until the guarantee claim window for that engagement has closed, and in any case no longer than 12 months after delivery, except where an ongoing subscription requires it |
| Email correspondence | 3 years |
| Waitlist email addresses | Until you unsubscribe, or 2 years of inactivity |
| Usage data in Google Analytics | 14 months |
| Usage data in PostHog | 1 year |
| Session recordings | 30 days |
You can ask us to delete your data sooner, and we will, except where the law requires us to keep it.
8. Your rights
Under the GDPR you have the right to access your data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent at any time where consent is the basis for processing.
Email support@serafinity.com to exercise any of these. We respond within 30 days, and we don't charge for it.
If you believe we have handled your data unlawfully, you can complain to the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or to the supervisory authority in your own country.
9. Cookies and fonts
The fonts used on this site are served from our own domain. Nothing on this site loads from Google, and your IP address is not shared with Google, unless you accept analytics cookies.
Our hosting provider's network sets a cookie named __cf_bm, which expires after 30 minutes and exists to distinguish human visitors from automated traffic. It is strictly necessary for the site to work securely.
Our hosting platform also sets a cookie named __dpl, which tells it which version of the site to serve you. It expires after 24 hours and is strictly necessary for the site to work.
When you choose Accept or Reject in the cookie banner, we set a cookie named serafinity_consent to remember your choice. It expires after 6 months and is strictly necessary.
If you accept analytics cookies, Google Analytics sets cookies named _ga and _ga_ followed by our property ID. They expire after 13 months and let us count visits and see which pages and links are used. Google signals and advertising features are switched off. If you reject, nothing loads from Google and no analytics cookies are set.
If you accept analytics cookies, PostHog sets a cookie named ph_ followed by our project key, which expires after 1 year, and keeps a few entries starting with ph_ in your browser's local storage. It records how pages are used, with anything you type hidden, so we can see where the site is confusing or broken.
You can change your choice at any time with the Cookie settings link at the bottom of every page. If you withdraw consent, the analytics cookies and PostHog's stored entries are deleted.
Where a Trustpilot review widget is displayed, Trustpilot may set its own cookies, governed by Trustpilot's privacy policy.
We do not use advertising cookies and we do not track visitors across other websites.
10. Security
Access to systems holding personal data is restricted, protected by strong authentication, and limited to what is needed to do the work. Payment card details never reach our systems.
No system is perfectly secure. If a breach occurs that is likely to risk your rights and freedoms, we will notify the supervisory authority within 72 hours and tell you without undue delay.
11. Children
Our services are sold to businesses. We do not knowingly collect data from anyone under 16.
12. Changes to this policy
We may update this policy. The current version is always the one on this page, with the date it was last updated shown at the top. We will tell you by email about material changes affecting how we use data we already hold.