Privacy Policy

Cleera is a trading name of Seringa Ltd (“we”, “us”, or “our”). We are committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect information when you use our platform at cleera.co.uk and related services. It is written in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Seringa Ltd (trading as Cleera) is the data controller for personal data processed through our platform. If you have questions about how we handle your data, you can contact us here.

2. Data We Collect

Information you provide directly

• Name, email address, and password when you register an account
• Company name and role when setting up your organisation
• Case and client information you enter into the platform
• Documents and files you upload
• Messages sent via our contact form
• Payment information processed via Stripe (we do not store card numbers)

Information collected automatically

• Log data (IP address, browser type, pages visited, timestamps)
• Usage data collected via Vercel Analytics (anonymised, no cross-site tracking)
• Performance data via Vercel Speed Insights (anonymised)
• Authentication tokens stored as secure, HTTP-only cookies

3. How We Use Your Data

We use your personal data for the following purposes, relying on the legal bases indicated:

• To provide and manage the service — performance of a contract
• To process payments and manage subscriptions — performance of a contract
• To send transactional emails (account notifications, form reminders, document alerts) — performance of a contract
• To respond to enquiries submitted via the contact form — legitimate interests
• To improve and maintain the platform — legitimate interests
• To comply with legal obligations — legal obligation
• To send marketing communications (if you have opted in) — consent

4. Sharing Your Data

We do not sell your personal data. We may share it with the following categories of third parties:

• Vercel — cloud hosting and analytics (EU/UK data residency available)
• Stripe — payment processing (PCI-DSS compliant)
• Brevo (Sendinblue) — transactional email delivery
• BoldSign — electronic signature services
• OpenAI — AI-powered features (data is not used to train models per our agreement)
• Neon / PostgreSQL hosting — database infrastructure

All third-party processors are bound by data processing agreements and may only process your data on our instructions.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. When you close your account, we will delete or anonymise your personal data within 90 days, except where we are required to retain it by law (for example, financial records which must be retained for 6 years under UK tax law).

6. International Transfers

Some of our third-party providers operate outside the UK. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or adequacy decisions.

7. Your Rights

Under UK GDPR, you have the following rights:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to ask us to correct inaccurate or incomplete data
• Right to erasure — to ask us to delete your personal data in certain circumstances
• Right to restriction — to ask us to restrict processing of your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests
• Right to withdraw consent — where we rely on consent, you may withdraw it at any time

To exercise any of these rights, please email our contact page. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These include encryption in transit (TLS), hashed passwords (bcrypt), and regular security reviews. However, no method of transmission over the internet is 100% secure.

9. Cookies

We use cookies and similar technologies. For full details, please see our Cookie Policy.

10. Children

Our platform is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a prominent notice on our platform. Continued use after changes take effect constitutes acceptance.

12. Contact

For any privacy-related questions or to exercise your rights, please contact:
Cleera (trading name of Seringa Ltd)
Email: our contact page