Privacy policy

Who we are

Seratify is run by Serat Media, Titaniumweg 498, 2401 ML Alphen aan den Rijn, registered with the Netherlands Chamber of Commerce under number 97857327. In this policy, "we" means Serat Media.

Questions about privacy go to info@seratmedia.com. We answer within one month.

Two roles: your account, and the forms you fill in

For people with a Seratify account, we decide what happens with account data, so we are the controller under the General Data Protection Regulation (GDPR).

When you fill in a form, the organisation that published it decides what it asks and what it does with your answers. That organisation is the controller. We store and process the answers on its behalf, as its processor, under a data processing agreement. Questions about your answers are best sent to the organisation first; we will help it respond.

What we store for account holders

• Your name, email address, and preferred interface language.
• Your password, stored only as a one-way hash (scrypt). We cannot read it.
• Sign-in sessions: when they started and expire, the internet address, and the browser that signed in. We use these to keep your account secure.
• Your workspace, its members and their roles, your forms, and images you upload. Images are stripped of location and camera data when you upload them.
• The date you accepted our terms, so we can show that you did.

What we store when you fill in a form

• Your answers, exactly as you submitted them, and the time you sent them.
• If the form allows one response per device, a random identifier in a cookie on your device. We store only a one-way hash of it, combined with the form, so it cannot be traced back to you or used across forms.
• If the form allows one response per email address, a one-way hash of that address, again combined with the form.

We do not store your internet address with your answers. We use it briefly, in memory, to stop automated mass submissions.

Why we use it, and on what legal basis

• To provide your account and the service you signed up for: performance of a contract (GDPR article 6(1)(b)).
• To keep Seratify secure and prevent abuse, such as session records, rate limits, and suspending accounts that break our terms: our legitimate interest in a safe service (article 6(1)(f)).
• To send email you asked for: notifications of new responses to form owners, and copies of answers to respondents when the form offers them. For account holders this is part of the contract; for respondents it is processing on behalf of the organisation.
• To meet legal obligations, such as answering lawful requests from authorities (article 6(1)(c)).

We do not use your data for advertising, we do not sell it, we do not build profiles, and we make no automated decisions about you.

Who else handles the data

We use a small number of suppliers. Each is bound by a processing agreement and stores data in the European Union.

• Hetzner Online GmbH (Gunzenhausen, Germany): servers, storage, and backups.
• Mailjet SAS (Paris, France): delivers the email Seratify sends.

We never transfer data outside the European Economic Area. Web fonts are served from our own servers, so your browser does not contact Google or other font services. Seratify contains no analytics, advertising, or social media trackers.

How long we keep it

• Account data: until you delete your account. You can do that yourself in your account settings.
• Sign-in sessions: they expire after 7 days without use.
• Forms and responses: until the form owner deletes them, or deletes the account.
• Server logs: limited in size and overwritten in rotation. They record technical errors, such as an email address that could not be reached, never your answers.
• Backups: daily, kept for 30 days. Data you delete disappears from backups within 30 days.

How we protect it

All traffic is encrypted with HTTPS. Passwords are hashed. Servers are protected by a firewall, receive security updates automatically, and are reachable for maintenance only with keys, not passwords. Access to production data is limited to the people who run the service.

Your rights

You may ask to see, correct, or delete your personal data, to restrict or object to its use, and to receive it in a portable format. Account holders can download their data and delete their account themselves in their account settings.

For everything else, write to info@seratmedia.com. We may ask you to confirm who you are. If you are unhappy with our answer, you may complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority where you live.

Cookies

Seratify uses only the cookies it needs to work. They are listed in our cookie policy.

Children

You must be at least 16 to create an account. Forms may be filled in by anyone the organisation invites; organisations that ask children for information are responsible for obtaining parental consent where the law requires it.

Changes to this policy

When we change this policy in a way that matters, we show the new version to account holders when they next sign in, and we change the date at the top.