Privacy Policy

1. Who We Are

Seraphina Oracle is operated by Esna Ltd, a company registered in England and Wales (Companies House number: 17052978). Our registered address is 31 Wells Avenue, Lostock Gralam, Northwich, Cheshire, CW9 7XR.

For the purposes of UK data protection law, Esna Ltd is the data controller for personal data collected through this service.

If you have any questions about this policy or how we handle your data, contact us at privacy@seraphina-oracle.co.uk

2. What Data We Collect

We collect the following personal data when you sign up and use Seraphina:

• Name — provided by you during signup
• Email address — provided by you during signup, used for billing and account communications
• Mobile phone number — provided by you during signup, used to deliver the service via SMS or WhatsApp
• Subscription plan and status — which plan you are on and whether your subscription is active
• Message history — the content of messages exchanged with Seraphina, stored to enable conversation continuity
• Payment information — processed and stored securely by Stripe; we do not store your card details
• Stripe customer ID — a reference used to manage your subscription

3. How We Use Your Data

We use your personal data only for the following purposes:

• To deliver the Seraphina messaging service to you
• To maintain conversation history so Seraphina can provide contextual responses
• To manage your subscription, billing, and account
• To send you service-related communications (e.g. payment receipts, subscription updates)
• To respond to your support enquiries
• To comply with our legal obligations

We do not use your data for advertising, profiling, or any purpose beyond delivering this service.

4. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:

• Contract performance — processing your name, phone number, email, and message history is necessary to deliver the service you have subscribed to
• Legal obligation — retaining billing records as required by law
• Legitimate interests — improving the reliability and quality of the service

5. Who We Share Your Data With

We share your data only with the third-party services necessary to operate Seraphina:

• Anthropic — your messages are processed by Anthropic's Claude AI to generate responses.
• Twilio — your phone number and message content are transmitted via Twilio to deliver SMS and WhatsApp messages.
• Stripe — your email address and billing information are processed by Stripe to manage subscriptions and payments.
• Supabase — your account data and message history are stored in a Supabase database hosted in the European Union.

We do not sell, rent, or share your personal data with any other third parties.

6. Data Retention

We retain your personal data for as long as your subscription is active and for a period of 12 months after cancellation, after which it is deleted.

Message history is retained for the duration of your subscription to enable conversation continuity. You may request deletion of your message history at any time without cancelling your subscription.

Billing records are retained for 7 years as required by HMRC regulations.

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your personal data
• Right to restriction — request that we limit how we use your data
• Right to portability — request your data in a machine-readable format
• Right to object — object to processing based on legitimate interests

To exercise any of these rights, contact us at privacy@seraphina-oracle.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Data Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• Encrypted transmission of all data via HTTPS and TLS
• Database access controls and row-level security
• Limited staff access to personal data on a need-to-know basis
• Regular review of our security practices

No system is completely secure. If you believe your data has been compromised, please contact us immediately at privacy@seraphina-oracle.co.uk

9. International Transfers

Some of our third-party service providers (including Anthropic and Twilio) are based in the United States. Where your data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR, including reliance on the UK-US data bridge or standard contractual clauses.

10. Cookies

Our website uses only essential and payment-related cookies. We do not use tracking or advertising cookies. Full details are in our Cookie Policy.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by sending a message via the service. The date at the top of this page indicates when it was last updated.

12. Contact Us

For any privacy-related questions or to exercise your rights:

• Email: privacy@seraphina-oracle.co.uk
• Post: Esna Ltd t/a Seraphina Oracle, 31 Wells Avenue, Lostock Gralam, Northwich, Cheshire, CW9 7XR