Privacy Policy

1. Who we are

Seerian ("we", "us", or "our") is the data controller responsible for the personal data collected through our platform and website. If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at privacy@seerian.com.

2. What data we collect

Account data

When you register, we collect information you provide directly, including your name, email address, job title, and company name. Authentication is handled by a third-party identity provider. If you belong to an organisation on Seerian, we also store your organisation membership and role.

Product usage data

As you use Seerian, we store the data you create or configure, including watchlists, dashboards, projects, your address book, Seera AI conversation history, connected portfolio integrations, and bookmarks.

Automatically collected data

We automatically collect certain technical information when you use our platform, including your IP address, browser type and version, pages visited, and error logs. This information is used to operate and improve the service.

Data we do not collect

We do not collect, store, or have access to your private keys, seed phrases, withdrawal credentials, or banking details. All exchange and wallet connections are read-only.

3. How we use your data

We use the data we collect to:

• Provide and operate the Seerian service.
• Improve our product using usage analytics, which we report in aggregate and collect only where you have accepted analytics cookies.
• Communicate with you about your account, service updates, and support requests.
• Maintain the security and integrity of our platform.
• Comply with applicable laws and regulatory obligations.

We will never sell your personal data to third parties, use your portfolio data for proprietary trading, or share your information with other organisations on the platform.

4. Legal basis for processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data on the following legal bases:

5. Data sharing and subprocessors

We share your data only with subprocessors engaged to deliver the service. We do not sell your data, and we do not share it with other organisations on the platform.

• Authentication and identity management, to sign you in and manage organisation membership.
• Cloud hosting and database infrastructure, to run the platform and store the data you create in it.
• Error monitoring and product analytics, to keep the service working and understand how it is used.
• Communications and support tooling, to answer you and send service messages.

Our primary infrastructure is hosted in the EU. Authentication is processed in the United States; see international data transfers below. A current list of our subprocessors, naming each one with its purpose and location, is available on request at privacy@seerian.com.

We also integrate with third-party market data providers to power certain features. We send only the minimal data necessary (for example, a public wallet address) to retrieve on-chain information. No personal account data is shared with data providers.

6. International data transfers

Our primary infrastructure is located in the EU. Authentication data is processed by our identity provider in the United States, and Seerian itself is a United States entity, so data we hold as controller is also processed there. We ensure such transfers are covered by appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with GDPR Chapter V.

7. Data retention

We retain your personal data for as long as your account is active and your subscription is in effect. Following account termination:

• Account and usage data is deleted within 30 days of termination.
• Encrypted backups are purged within 90 days.

We may retain certain data for longer where required by law or to resolve disputes.

8. Data security

We maintain technical and organisational measures appropriate to the risk, to protect your data against unauthorised or unlawful processing and against accidental loss, alteration or disclosure. These include encryption in transit and at rest, role-based access control, multi-factor authentication, audit logging, and read-only connections to the exchanges and wallets you link.

No system is perfectly secure, so we do not claim that one is. What we commit to is proportionate controls, reviewed as the service changes. Our current posture, including the status of independent assessment, is set out in our Trust Center.

9. Data breach notification

If a personal data breach occurs and is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, as required by Article 33 of the GDPR.

Where the breach is likely to result in a high risk to you, we will also notify you directly and without undue delay, describing what happened, the likely consequences, and the steps we are taking, in line with Article 34. We will take immediate action to contain the breach and to reduce the chance of a repeat.

10. Your rights

Depending on your location, you have the following rights regarding your personal data:

All users

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data ("right to be forgotten").
• Export your data in a portable format.

EEA residents (GDPR)

• Restrict the processing of your data.
• Object to processing based on legitimate interests.
• Withdraw consent at any time where processing is consent-based.
• Lodge a complaint with your local supervisory authority.

Singapore residents (PDPA)

• Access the personal data we hold about you.
• Correct inaccurate personal data.
• Withdraw consent, subject to legal or contractual restrictions.

How to exercise any of these rights, and how we confirm a request came from you, is set out in the next section.

11. Exercising your rights

To exercise any of the rights above, contact us at privacy@seerian.com. We will respond without undue delay.

If you are in the EEA, we will respond in any event within one month of receiving your request. Where it is necessary, taking into account the complexity of a request or the number you have made, we may extend that by up to two further months; if we do, we will tell you within the first month and explain why.

If you are in Singapore, we will respond to an access request as soon as reasonably possible, and act on a correction request as soon as practicable. Where we cannot answer an access request, or complete a correction, within 30 days, Regulation 5 of the Personal Data Protection Regulations requires us to tell you in writing, within that period, the date by which we expect to do so.

Before we act on a request we need to be satisfied that it comes from you, so that no one else can exercise your rights on your behalf. For account holders we verify through the email address registered to the account. If we cannot identify you from that, we may ask for further information, limited to what is necessary to confirm who you are.

There is no charge for exercising your rights. If a request is manifestly unfounded or excessive we may charge a reasonable fee or decline to act, and we will explain why if we do.

12. Cookies and tracking

We use cookies and similar technologies to operate and improve our service. We use three categories of cookies:

• Essential cookies — required for the platform to function. These cannot be disabled.
• Analytics cookies — help us understand how the platform is used. These use pseudonymous identifiers, not anonymous ones, and are set only if you accept them in the consent banner.
• Marketing cookies — used for advertising. We do not currently set any.

For full details, including a list of specific cookies, please see our Cookie Policy.

13. Children's privacy

Seerian is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a minor has provided us with personal data, please contact us at privacy@seerian.com and we will promptly delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify the organisation administrator via email at least 30 days before the changes take effect. We encourage you to review this page periodically for the latest information.