Privacy Policy

• Organisation profile details you enter in the setup wizard: what you do, who you help, where you work, your governance and finances, and the contact details of the people using Serin.
• Documents you upload, such as governing documents, accounts, policies and previous funding applications. These are stored in our private document storage and are only readable by your own organisation.
• Voice recordings for dictation. Raw audio is not kept. When you dictate, the recording is sent straight to transcription, held only in memory while that happens, and never written to storage. Only the resulting text is saved, and only where you choose to keep it.
• The content of your application answers, including drafts, edits and notes made while you work on a funding application.
• Information read from your own website, but only when you ask Serin to look at it. We show you what we found and nothing is added to your profile until you confirm it.

• Matching your organisation to funders and funding opportunities that genuinely fit.
• Pre-filling funder questions with facts you have already given us.
• Helping you draft application answers, and tidying up dictated text.
• The funding readiness feature, which shows what you still need in place.

Previous applications you upload are stored for your own reference and to keep everything in one place. The funder's own questions from an uploaded application may be used to help build Serin's shared question library for that fund, so other organisations applying to it benefit too. Your own answers always remain private to your organisation and are never shared.

Serin never invents facts about your organisation. Everything used in drafting comes from what you have told us or uploaded. Where something is missing, Serin leaves a gap for you to fill rather than making something up.

You can read how all of this is protected in practice on our How we protect your data page.

• Your own team. People you invite to your organisation, according to their role. Nobody from another organisation can see your data; this is enforced by the database itself, not by hiding things in the interface.
• Serin's platform team, for support and for keeping the fund library accurate. We do not go looking at an organisation's application content without a reason, such as a support request you have raised.
• A paid reviewer, only if you explicitly ask for the bid review service on a specific application. That reviewer sees only that application, and their access closes automatically once the review is delivered or after five working days, whichever comes first.

• Hosting, database, authentication and file storage are provided by Lovable Cloud, which runs on Supabase (Postgres) infrastructure.
• AI drafting and voice transcription run through the Lovable AI Gateway, which passes requests to the underlying model provider (currently OpenAI models). Audio and text are sent for processing and the result is returned to Serin; no audio is retained by us.
• Payment processing, for subscriptions and the paid review service, uses Stripe. Card details are entered directly with Stripe and never reach Serin's servers.
• Email notifications (invites, support replies, funding alerts) are sent through Lovable's managed email sending. Optional marketing email is intended to be sent through Mailchimp; that connection is not live yet, and no marketing preference is currently shared anywhere outside Serin. We'll update this the day it is.

You can turn on two-factor authentication (an authenticator app, plus one-time recovery codes) in Settings, and we'd encourage it. Your two-factor secret is stored encrypted, not in plain text, so it can't simply be read out of our systems by anyone with database access.

Our own team's accounts require two-factor authentication. If we ever need to reset it for someone, that's a deliberate, logged action with a written reason, never something that happens silently.

Account emails are part of using Serin: confirming your email address, resetting your password, team invitations, support replies, and trial, payment or subscription notices. We send these because you have an account with us, so they are not something you opt out of. If you no longer want them, the answer is to close your account and we will remove your data.

Alert emails are also account emails: owners and admins get an email when something about their own applications, saved funds, documents or policies needs attention (at most one a day), and a short weekly summary of new funding that fits. They are on by default, and you can turn either off at any time under Alerts in Serin, or with the one click unsubscribe link in every email.

Marketing emails are occasional funding tips and product updates. They are genuinely optional. We only send them if you tick the marketing box when you create your account (it is never ticked for you) and ticking it means you agree to receive those occasional emails from Serin until you say otherwise.

You can turn marketing email on or off at any time from the preferences link at the bottom of any Serin email, without signing in. Turning marketing off has no effect on your account emails. We record whether you opted in, the exact wording you were shown, and when you made the choice.

Individual uploaded documents can be deleted by an owner or admin at any time from the Documents page. That deletion is real: the file is removed from storage as well as the record.

Your organisation's profile, applications and answers are kept for as long as your account exists, so you never have to start from scratch. If your subscription lapses, your data is preserved and your account becomes read-only rather than being deleted.

If a whole organisation account is deleted, its data isn't erased immediately: it moves to a 90-day recycle bin, after which it's permanently removed. This exists so a genuine mistake can be undone; if you'd like your data removed sooner than that, tell us and we will.

If you arrived at Serin through a partner's link (for example, one shared by a referral partner), we remember that with your consent, and record it against your organisation so we know a referral genuinely happened. It's used only for that, never for advertising or shared with anyone beyond confirming the referral.

There is no self-service button to delete an entire account or organisation yet. If you want everything removed, ask us and we will do it: use the Talk to the Serin team form inside the app, or email info@serin.uk.

Serin's public website can use Google Analytics, to count visits and see which pages are useful, and a small amount of local storage to remember a partner referral link. Neither of these is necessary to show you the page you asked for, so neither runs until you say yes on the cookie banner. Choosing "Decline" means neither loads, and you can still use the whole public site normally. We do not use advertising or cross-site tracking cookies, and we do not sell any data.

Inside the signed-in app, we use the cookies and local browser storage needed to keep you signed in and to remember small things like whether you have already seen a particular introduction screen. These are necessary for the service to work, so there's no separate choice to make about them.

For any question about your data, including access, correction or deletion, email info@serin.uk or use the Talk to the Serin team form. We reply within one working day.

This policy was last reviewed on 22 September 2026.