1What this is — and what it isn't

SereneHelp is a calm self-help companion for hard moments — Tonight, Check a message, Know your rights, and the crisis lines. It does not diagnose, treat, or replace professional care. It's a self-help tool, not therapy or a diagnosis.

On the website, SereneHelp does not watch the phone. A message is checked only when you paste it or share it. SereneHelp only contacts someone if you set it up: a carer absence alert. Tell my carer opens your own messages app with a short text, and you choose whether to send it. It never contacts anyone else. If you may be in danger, contact emergency services or a crisis line — see the numbers at the bottom of every screen.

SereneHelp is operated by DanceOnVibes Limited (registered in England & Wales, company no. 17423769, registered office: 167–169 Great Portland Street, 5th Floor, London W1W 5PF).

We are a UK company and follow UK data protection law (UK GDPR and the Data Protection Act 2018). SereneHelp is offered in the UK only. Contact privacy@serenehelp.org.

We have assessed that we don't need a Data Protection Officer yet (UK GDPR Article 37). We will review this as we grow. Our data protection lead is our director. Contact: privacy@serenehelp.org.

SereneHelp is built on the Base44 platform. Base44 is our processor. Base44 stores account data in the UK, and runs our code and email from US servers. Base44 says that on plans below Enterprise, which includes ours, data submitted through an app can be used to train AI models. We are asking Base44 for a written agreement that SereneHelp data is never used this way. Until we have it, this risk is real, and we tell you so. We do not make decisions about you with legal or similarly significant effects by automated means.

2Our lawful basis for using your data

Under the UK GDPR, we need a lawful basis to process your data:

• •Consent (Article 6(1)(a)) for the things you choose to keep in your account (your urge log, relapse note and lockdown checklist), for Serene, and for reminders. Each has its own tick. Check a payment also uses your consent, asked before each check. Your crisis card, support contacts and your carer's mobile number stay on your phone, so we don't receive them.
• •Performance of a contract (Article 6(1)(b)) for creating and running your account and signing you in.
• •Legitimate interests (Article 6(1)(f)) for security, the audit log, and consent records; for a carer's email, so the alert the protected person set up can reach them; and for the request form.
• •Legal obligation (Article 6(1)(c)) for the data-subject request form.

Because your self-help data can reveal your mental health, it is special-category data under UK GDPR. We keep it in your account only with your explicit consent (Article 9(2)(a)), which you give with its own tick. You don't have to give it to use SereneHelp: without it, what you save stays on your phone. You can take it back in Settings at any time, and we delete the copy in your account (see Section 7).

A child check stays on the phone. It is not sent anywhere. The controller does not receive a child check, so it does not process those words.

3Where your data is stored

What we store (account, saved notes and flags) is kept in the United Kingdom. Words and pictures you send to Serene go to Amazon Web Services, our processor, and are processed in London, United Kingdom, where an AI model made by Anthropic replies.Amazon Bedrock does not store your request or response after processing. Under the AWS terms, Amazon does not use them to train AI models. We do not keep the chat. In a Serene chat, your last few messages go with each new one, so the reply makes sense. Links, phone numbers and email addresses you choose to check: we send only that one item, never your message, to IPQualityScore LLC in Las Vegas, USA, and show you its result. We ask you before each one is sent. IPQualityScore says it keeps lookups for about a year, may use them to improve its fraud-detection models, and may share identifiers with fraud-prevention partners. Its privacy policy: ipqualityscore.com/privacy-policy. Google, Apple, Facebook or Microsoft receive your sign-in if you choose them.

Speak uses your phone's or browser's own speech service (often Google) to turn your voice into words. If you'd rather not, type or paste instead.

Base44 stores account data in the UK, and runs our code and email from US servers. We are asking Base44 to confirm in writing the safeguard it uses for this transfer. Serene requests go to Amazon Web Services, which processes them in London. Amazon Web Services is part of a group outside the UK. When you use Check a payment, the email, phone or link goes to IPQualityScore, a company in the United States. If you sign in with Google, Apple, Facebook or Microsoft, that company receives your sign-in. Personal data sent to IPQualityScore in the United States is covered by the UK Addendum to the EU Standard Contractual Clauses.

A pasted message is not stored. A keyword hit is not sent. We do not keep the chat.

Words and pictures you send may include other people's details. Cover names and numbers you do not need to show.

If a carer is linked, they are told only "Please check on [Name]". They never see your message or picture.

Your data is encrypted while it travels (HTTPS). We are waiting for written confirmation of how it is encrypted when stored, so we don't claim that yet. It is not end-to-end encrypted — the platform provider can access it if needed, for example to fix a technical problem.

Every safety tool in SereneHelp is free for everyone, always. Serene and the Supporter plan are for adults 18+ only.

4Where your data is kept, and for how long

You can sign in with email and a password, or with Google, Apple, Facebook, or Microsoft. The password is not kept in the browser. The host keeps a protected form of it. Each social company receives the sign-in. A small set of data is synced to your private cloud account so it follows you across devices; the rest stays only on the device you're using.

Synced to your cloud account: your accessibility settings (UserSetting), your consent record (ConsentRecord), your Debt & Money action-plan progress (DebtActionPlan), your urge log entries (UrgeLogEntry), your relapse note (RelapseNote), your lockdown checklist (LockdownChecklist), your letter reminders (LetterReminder), your carer connection and check-in times (CarerConnection), your quiet-time arrangements (QuietTime, QuietTimeShare), your fraud flags (FraudFlag), your incident flags (IncidentFlag), and your audit log entries (AuditLog). Row-level security means only you can read them, with one exception: a carer you link can read your carer connection and the Quiet Time arrangements you share with them. The urge log, relapse note and lockdown checklist are kept in your account only if you ticked the health information box.

Retention: account data is kept until you delete it or ask us to. "Delete all my data" deletes it. Device-only data remains until you clear your browser storage or use "Delete all my data". Payment records for the Supporter plan are kept for 6 years because UK tax law requires it.

Supporter plan: if you have a Supporter plan, we store your plan type, Stripe customer and subscription IDs, billing period dates, payment and refund status, and when you ticked the cooling-off box. Card details never reach us — they are entered on Stripe's page. Stripe is our processor for payments, and also a controller for its own fraud-prevention and legal duties; see our processor register.

On this device only: your crisis card details, support contacts, bad-day ladder, circle members, the Shutdown tools, sound anchors, any text you type into the validation-letter generator, and your Emergency contacts. Emergency contacts are other people's details (names, phone numbers, emails) — we never upload them and never contact anyone automatically. Because we do not receive them, we do not process them; an Article 14 notice template is available on request.

On a shared device, your data stays in this browser after you sign out unless you use Delete all my data (in Settings or below) to erase it.

5What we don't collect

• •No camera. If you tap Speak, the phone's own speech tool hears you. SereneHelp does not keep the recording. The phone maker may. Location is read only if you tap Send where I am now on I'm not safe. It is put into a text message on your phone for you to send. It is not sent to us or stored.
• •No heart rate, wearable, or sleep sensor data.
• •We do not read your saved notes. The words of a tap are read by Amazon Web Services in London so it can answer. Amazon Bedrock does not store your request or response after processing.
• •No ads and no advertising trackers.
• •We count how often safety screens and Money Mentor lessons are used, as totals only, so we can improve them. We can't see who used them or what anyone wrote.
• •No automatic outreach — SereneHelp only contacts someone if you set it up: a carer absence alert. Tell my carer opens your own messages app; you choose whether to send. It never contacts anyone else.

6Language detection and helpline signposting

SereneHelp shows its content in your preferred language. We detect it in this order:

• •Saved preference — the language you last chose in Settings.
• •Browser language — read from your device's browser setting. This is not personal data and needs no consent.

We guess your country from your phone's time zone and language, never your location or IP address. You can change it.

Helpline numbers shown in the app (emergency, mental health, and money/debt lines) are provided for signposting only and are localised to the selected country. The helpline numbers are signposts for the country the person chose. SereneHelp does not replace 999 or 112, and it does not contact anyone for you.

7Your data rights

Under the UK GDPR you have the right to:

• •Access your data (use "Export all my data" below).
• •Rectify your data — edit any saved detail in the app, or email us to correct a record.
• •Erase your data ("Delete all my data" below; account deletion on request).
• •Restrict processing of your data.
• •Data portability — receive your data in a machine-readable file.
• •Object to processing.
• •Withdraw consent at any time — in Settings or by deleting your data. Withdrawing consent won't affect processing already carried out.

To exercise any right, email privacy@serenehelp.org or use the request form in Section 9. You can withdraw consent in Settings. You can complain to us at privacy@serenehelp.org, or to the Information Commission (the ICO) at ico.org.uk.

Age: accounts start at 13. Serene and the Supporter plan are for adults 18 and over. A parent may install SereneHelp on a child's phone and use the safety tools without an account. Your age is what you tell us. We do not check it.

8Export or delete your data

You can download everything you've saved, or permanently erase all of it, at any time. These are one-action controls — no waiting, no email request needed for your saved data.

9Make a data subject request

To exercise any data subject right (access, correction, deletion, or other), fill in this form or email privacy@serenehelp.org.

We will respond within one calendar month. This period may be extended by up to two months where necessary, and we will tell you if so.

10Serene advice, Speak, and keyword hits

11What works where

Features marked "not available yet" collect no data. When a feature launches, we will explain what it uses and ask you first. See what works where.

App access (pending feature). App access works only in the Android app. When it is released, it will ask for your permission first, check messages on your phone, and send nothing to us.

12What Serene is

Serene is not a person. Serene advice is not legal advice. Serene is a wellbeing and signposting tool. It does not assess, diagnose, monitor or treat any condition.

13Translations of this policy

This policy may be shown in translated form. Translations are provided for convenience and some are machine-generated. If a translation differs from the English (en-GB) version, the English version applies. Questions about this policy: privacy@serenehelp.org.

14Data protection complaints

If you are unhappy with how we have used your personal data, email privacy@serenehelp.org with 'Complaint' in the subject. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome. You can also complain to the Information Commission (the ICO): ico.org.uk/make-a-complaint or 0303 123 1113.

15Serene AI processor

When you use Serene, your words or picture pass through our app platform, Base44, which runs our code on servers in the United States. They then go to Amazon Web Services, our processor, in London, where an AI model made by Anthropic replies. In a Serene chat, your last few messages go too, so the reply makes sense. We don't keep them, Amazon Bedrock doesn't store them, and Amazon doesn't use them to train AI models.