Privacy Policy

1. Data Controller

The data controller within the meaning of the EU General Data Protection Regulation is Collision Technologies S.R.L.S — Società Benefit, Via Fabio Filzi 6, 34132 Trieste, Italy, operating the Collision platform at collitech.org. (Art. 4(7)) For any privacy-related request, you may contact us at contact@collitech.org or through our contact form. (Art. 13(1)(a))

This policy applies to all personal data processed when you visit or use the Service, regardless of the device or method used. If you are a resident of the European Union or European Economic Area, the GDPR governs our processing of your personal data in its entirety.

2. Information processed and purposes

Account information includes identity-provider identifiers, name, email address and profile information needed for sign-in and account administration. We process this to provide the account and requested services under Article 6(1)(b) GDPR. Billing and transaction records support purchases, credit balances and applicable accounting obligations under Articles 6(1)(b) and 6(1)(c). Payment credentials are entered through the payment provider.

Service records can include your user identifier, feature used, request time, input length, credits consumed, IP address and user agent. These are not exclusively anonymous counters. They support billing, service administration and abuse prevention under Articles 6(1)(b) and 6(1)(f), as applicable. Our legitimate interests are protecting accounts and service availability and investigating misuse.

Support and contact messages, attachments and related account information are processed to answer requests and resolve issues. Security and access records can include IP addresses, user agents, endpoints and event details. Their retention depends on the purpose and any incident or legal obligation; we do not promise that all such records disappear within a few hours.

3. AI prompts, documents and conversation history

When you use an AI feature, your prompt and the relevant conversation context are processed to generate a response. Uploaded files may be sent for extraction or indexing, and extracted text may be included in a model request. This processing is necessary to supply the feature you request under Article 6(1)(b) GDPR.

Signed-in SerenAI prompts, replies and uploaded file names are stored with your account to provide chat history. Clearing the chat removes that history from the application database. This does not establish immediate deletion from every provider system or backup. Other features and external providers may have different processing and retention arrangements.

This is not a zero-retention service. Do not upload secrets or unnecessary personal data, and make sure you are entitled to disclose information about other people. No blanket promise is made here that every external provider excludes training or retains no data. Provider use must be assessed for the feature and contractual settings concerned; contact us before submitting information that requires special handling.

4. Purpose Limitation

Personal data is collected for specified, explicit, and legitimate purposes and is not processed in any manner incompatible with those purposes. (Art. 5(1)(b)) We use the data we collect to: provide, maintain, and improve the Service; process transactions and manage your credit balance; respond to support requests; monitor and prevent security threats, fraud, and abuse; and comply with applicable legal obligations. (Art. 6(1)(c)) We do not sell, rent, trade, or otherwise disclose your personal data to third parties for marketing or advertising purposes.

5. Cookies and Tracking Technologies

We use cookies and similar technologies in accordance with the ePrivacy Directive 2002/58/EC as amended and the GDPR. Strictly necessary cookies do not require your consent and are placed automatically. All other categories require a freely given, specific, informed, and unambiguous affirmative action from you before being set. (Art. 4(11)) Consent obtained under pre-ticked boxes or inactivity is not valid under applicable law.

Essential cookies include session tokens required for authentication and short-lived anti-bot tokens used to enforce rate limits and protect login flows from automated abuse. These are exempt from the consent requirement as they are strictly necessary for the Service to function. (Art. 6(1)(f)) Analytics cookies, which collect aggregate usage data to help us understand how the Service is used, are only set after you grant explicit consent. (Art. 6(1)(a)) Marketing cookies, used for personalised content and promotional communications, are also only set after explicit consent. (Art. 6(1)(a)) Both analytics and marketing cookies default to OFF.

You may withdraw or modify your cookie consent at any time without any disadvantage. Withdrawing consent does not affect the lawfulness of processing that took place before withdrawal. (Art. 7(3)) To manage your preferences, use the button below. You may also clear or block cookies directly in your browser settings at any time, though blocking essential cookies will prevent sign-in and may cause our security systems to challenge your requests.

6. Recipients and service providers

Data is disclosed where necessary to providers supporting authentication, payments, hosting, databases, transactional email, AI inference and document processing. The application integrates sign-in providers, Stripe and Resend, and supports AI or document services including DeepSeek, Hugging Face-hosted services, Groq, Google, Anthropic and Winston AI. The providers involved depend on the feature and deployment; a request is not necessarily sent to every listed provider.

AI providers receive the prompt, relevant history and any document content needed for the request. Hosting and infrastructure providers can process technical and account data. Providers may act as processors or as independent controllers for some activities, depending on the service and contractual relationship. Where a provider acts as our processor, an appropriate processing agreement is required.

We may disclose information where required by law or necessary to establish, exercise or defend legal claims. Contact contact@collitech.org for information about the recipients relevant to your use.

7. Processing locations and international transfers

Data processing is not guaranteed to remain exclusively in the EU/EEA. AI and infrastructure services may involve recipients or access outside the EU/EEA. A provider being available in Europe does not by itself establish where every operation takes place.

Transfers of personal data outside the EU/EEA must have a valid basis under Chapter V GDPR, such as an applicable adequacy decision or appropriate safeguards, together with any supplementary measures required. This policy is not a substitute for those safeguards and does not itself authorise a transfer. Contact contact@collitech.org for the destinations and safeguards relevant to your use and how to obtain a copy.

8. Security and incident notifications

The application includes access controls, rate limiting and other security measures. Appropriate technical and organisational protections must be maintained for the deployment and risk involved. No system can guarantee absolute security. Please report suspected incidents to contact@collitech.org without including passwords or payment credentials.

Where GDPR applies, a personal-data breach must be notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless it is unlikely to create a risk to people’s rights and freedoms. Individuals must be informed without undue delay where a breach is likely to create a high risk, subject to the statutory exceptions. These are separate notification thresholds.

9. Retention and deletion

Account and chat information is retained to provide the account and enabled history, until deletion or until it is no longer needed, subject to applicable legal requirements. You can clear SerenAI history or request erasure through contact@collitech.org. Billing and accounting records may need to be kept for statutory periods, and relevant records may be retained for an unresolved dispute or legal hold.

Usage, support and security retention is determined by the need to administer purchases, resolve the request, investigate incidents and meet applicable legal or claims obligations. The application includes a cleanup routine for support tickets closed for at least 24 hours; its operation does not guarantee that all copies and backups are erased at exactly that point. Retention and deletion in provider systems and backups must also be taken into account.

Cookie preferences are stored in your browser until changed or cleared; we do not claim that this browser setting alone is a three-year server-side consent record. You can request information about retention applicable to your records. We must review records and erase or anonymise data that no longer has a justified retention purpose.

10. Your Rights Under GDPR

If you are located in the EU or EEA, you have the following rights under Chapter III GDPR. The exercise of these rights is free of charge (Art. 12(5)), and we are required to respond within one calendar month, extendable to three months for complex or multiple requests with written notification of the extension. (Art. 12(3))

You have the right of access to the personal data we hold about you and to receive a copy of it. (Art. 15) You have the right to rectification of inaccurate or incomplete personal data. (Art. 16) You have the right to erasure — the right to be forgotten — where personal data is no longer necessary for the purposes for which it was collected, where consent is withdrawn, or where the data has been unlawfully processed, subject to legal retention obligations. (Art. 17) You have the right to restriction of processing in certain circumstances, such as where you contest the accuracy of the data or where processing is unlawful but you oppose erasure. (Art. 18) You have the right to data portability, to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller. (Art. 20) You have the right to object to processing based on legitimate interests or for direct marketing purposes. (Art. 21) Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing. (Art. 7(3)) We do not use automated individual decision-making or profiling that produces legal or similarly significant effects. (Art. 22)

To exercise any of these rights, please contact us at contact@collitech.org or through our contact form. We may request verification of your identity before processing your request. (Art. 12(6))

11. Right to Lodge a Complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority — in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement — if you consider that the processing of your personal data infringes the GDPR. (Art. 77(1)) We encourage you to contact us first so that we may address your concern directly, but you are under no obligation to do so before contacting a supervisory authority. A complete list of EU and EEA data protection authorities is maintained by the European Data Protection Board at edpb.europa.eu.

12. Children's Privacy

The Service is not directed to, and is not intended for use by, children under the age of 16. We do not knowingly collect personal data from children under 16. (Art. 8) If we become aware that we have inadvertently collected personal data from a child under the age of 16 without verifiable parental or guardian consent, we will take immediate steps to delete such data.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable law. We will post the revised policy on this page and update the effective date. For material changes that affect your rights or the way we process your data, we will provide additional notice by email or by a prominent notice on the Service, as required by Article 13(3) GDPR. (Art. 13(3)) We encourage you to review this page periodically.