privacy policy

Serendipity AI Limited ("we", "us") cares about your privacy. This page describes what data we collect when you use serendipity.ai, the contact endpoint, and our email addresses. Short version: very little, no profiling, and the only analytics — Google Analytics — runs only if you opt in.

What we collect

Server logs

Our CDN (AWS CloudFront) and origin (AWS Lambda) record each request: source IP address, user agent, requested URL, timestamp, response status. We use these logs only to investigate operational issues, abuse, and security incidents. Logs are retained for 30 days, then deleted.

Contact endpoint (POST /api/contact)

If you POST to /api/contact, we receive the email address, subject, and body you submit, plus your source IP and user agent (used for spam attribution only). This payload is forwarded to our internal mailbox at agents@serendipity.ai via AWS SES and logged in CloudWatch for 30 days.

Email

If you email hello@serendipity.ai or agents@serendipity.ai, we receive what you send. We keep the message in our mailbox as long as needed to respond, and then according to ordinary email retention.

Google Analytics — only if you accept the cookie notice

If (and only if) you click "accept" on the cookie notice, we load Google Analytics 4. It then records which pages you view, how long you stay, your approximate country/region (derived from your IP — Google does not pass the raw IP back to us), device type, browser, screen size, language, and referrer. It sets a couple of cookies; the names are listed on the cookie policy. We use this purely to understand which pages people find useful and to plan content. If you reject, the GA script is never loaded.

What we don't collect

• No tracking if you decline the cookie notice.
• No advertising, no remarketing, no ad networks.
• No fingerprinting, no cross-site behavioural profiling.
• No tracking pixels in our emails.
• No personal data sold or shared with anyone other than the third parties listed below, who process it on our instructions.

Third parties

• Google Analytics 4 — only if you accept the cookie notice. Receives the events listed above. Acts as a processor on our behalf. Data retention in GA4 is set to 2 months. Google privacy policy.
• Amazon Web Services — our infrastructure (S3, CloudFront, Lambda, SES). AWS processes data on our instructions under their Customer Agreement and DPA.

We do not sell, share, or licence personal data to anyone else.

Your rights (UK GDPR)

You can ask us to:

• Confirm what data we hold about you, and send you a copy.
• Correct it if it's wrong.
• Delete it (subject to legal exceptions).
• Restrict how we process it.
• Hand it over in a portable, machine-readable format.
• Object to processing on legitimate-interest grounds.

Email hello@serendipity.ai and we'll respond within 30 days. You can also complain to the UK Information Commissioner's Office: ico.org.uk/make-a-complaint.

Children

This site isn't directed at children under 13 and we don't knowingly collect data from them.

Changes

If we change this policy materially, we'll update the date at the top. Continued use of the site means you're OK with the current version.

Contact