Privacy Policy

Last updated: July 31, 2026

This Privacy Policy explains how Zarruk Serrano, operating as a sole proprietorship (enkeltpersonforetak) in Norway under organization number 934370651 ("we", "us", "our"), collects, uses, and protects personal data when you use Synthetic Time Series at tseriz.com (the "Service").

We act as the data controller for the personal data described below, as defined under the EU/UK General Data Protection Regulation (GDPR) and Norway's Personal Data Act (personopplysningsloven).

1. What Data We Collect

We collect the following categories of personal data:

Account data: your email address, password (stored hashed), and optionally your name, profile picture, language and timezone. If you sign in with Google or GitHub, we receive basic profile information from that provider instead of a password. If you enable two-factor authentication, we store the associated authenticator device data.
Payment data: billing name, billing address, and transaction history. Full card details are collected and processed directly by our payment processor, Stripe — we do not store your card number.
Content you create in the Service: your generator configurations and project names, the prompts and descriptions you write, and your conversations with the AI assistant. Note that we do not store the generated series values themselves — see Section 5.
Credentials you entrust to us: if you connect your own InfluxDB instance, we store its address, organization and bucket names, and its API token. The token is encrypted at rest and is used only to perform exports you request.
API keys: keys you create for programmatic access, stored hashed. We cannot recover a key after it is shown to you once.
Usage and metering data: records of your generations and AI-assistant calls, including timestamps, sizes, token counts and computed credit cost. We need these to enforce plan allowances and to bill usage-based charges accurately.
Technical log data: IP address, browser/device type, pages visited, and actions taken within the Service, collected automatically to operate and secure the Service.
Support communications: any information you provide when you contact us for support.

The Service generates synthetic data; it does not require you to upload your own datasets, and there is no facility to do so. The only file you can upload is an optional profile picture. We do not knowingly collect special categories of data (for example health, biometric, or racial/ethnic data). Please do not include personal data in your prompts or project names — nothing in the Service requires it.

2. How We Use Your Data

We use your data to:

Provide, maintain, and improve the Service;
Create and manage your account;
Process payments, enforce plan allowances, and meter usage-based charges;
Communicate with you about your account, transactions, or support requests;
Send service-related notices, such as security notices, changes to these documents, or a warning that you are approaching a usage limit;
Monitor usage for security, fraud prevention, and abuse detection;
Comply with legal obligations, such as tax and accounting records.

We do not currently send marketing email and we do not operate a mailing list. Every email we send you is transactional: account verification, password resets, sign-in codes, and billing or usage notices. If we introduce marketing email in future, it will be opt-in and you will be able to unsubscribe at any time.

We do not use your prompts, conversations or configurations to train our own models, and we do not sell your personal data.

3. Legal Basis for Processing (GDPR)

Contract: processing necessary to provide the Service you have signed up for — account, billing, metering, and delivery of features.
Legitimate interests: security, abuse and fraud prevention, and service improvement, balanced against your rights.
Legal obligation: retaining records required for tax, accounting, or regulatory compliance.
Consent: we do not currently rely on consent for any processing, because we use only essential cookies and send no marketing email. If that changes, we will ask for your consent first and you will be able to withdraw it at any time.

4. Who We Share Data With

We share personal data only with the service providers we need to operate the Service, under appropriate data processing agreements. As of the date of this policy, these are:

Render — application and database hosting.
Stripe — payment processing, subscription and invoice management.
Anthropic — the AI provider behind our assistant. When you use the assistant, the content of your request is sent to Anthropic so it can respond. Your name and email address are included in the context supplied to the model so it can address you and act on your account. We may add or change AI providers and will update this list when we do.
Zoho (ZeptoMail) — delivery of transactional email. We use their EU infrastructure.
Cloudflare — bot protection on our signup form, which receives your IP address and browser characteristics when you sign up.
Google and GitHub — only if you choose to sign in with one of them.
Gravatar (Automattic) — if you have not uploaded a profile picture, your browser requests a default avatar from Gravatar using a hashed version of your email address. Upload a picture to avoid this.

If you configure an export to your own InfluxDB instance, data is sent to the address you specify. That destination is under your control, not ours.

We do not sell your personal data. We may disclose data if required by law, to protect our legal rights, or in connection with a business transfer such as a merger or acquisition, in which case we will notify you.

4.1 International transfers

Our application and database are hosted in the United States, and several of the providers above process data in the United States. This means your personal data is transferred outside the EU/EEA as a normal part of using the Service. Where that happens, we rely on appropriate safeguards such as Standard Contractual Clauses or the provider's participation in an approved data transfer framework.

5. Data Retention

We retain personal data for as long as your account is active and as needed to provide the Service. Account data, project and generation records, AI-assistant conversations, and usage/metering records are kept until you ask us to delete them or your account is closed.

Two things are worth knowing because they reduce what we hold about you. First, we do not store the values of the series you generate: we keep the configuration, the random seed, and a small preview, and regenerate the series on demand. Second, data held for live previews is discarded automatically about 30 minutes after it is created.

After account closure, we retain data only as long as necessary to comply with legal obligations — Norwegian bookkeeping law generally requires financial records to be kept for five years — to resolve disputes, and to enforce our agreements, after which it is deleted or anonymized.

6. Your Rights

If you are located in the EU/EEA, or another jurisdiction with similar protections, you have the right to:

Access the personal data we hold about you;
Correct inaccurate or incomplete data;
Request deletion of your data (the "right to be forgotten"), subject to legal exceptions;
Restrict or object to certain processing;
Request a portable copy of your data;
Withdraw consent at any time, where processing is based on consent;
Lodge a complaint with your local data protection authority — in Norway, the Norwegian Data Protection Authority (Datatilsynet), datatilsynet.no.

You can edit most of your account details yourself from your profile page. For anything else — including account deletion and requesting a copy of your data, which we do not yet offer as a self-service feature — email us at [email protected] and we will handle it manually. We will respond within the timeframes required by applicable law, generally one month under GDPR.

7. Cookies

We use only cookies that are necessary for the Service to work. We do not use advertising cookies, and we do not currently run any third-party analytics, so there is no consent banner to click through. The cookies we set are:

a session cookie, which keeps you logged in;
a security cookie, which protects forms against cross-site request forgery;
a language cookie and a theme cookie, which remember your language and light/dark mode preference.

Cloudflare's bot protection may also set a cookie when you visit the signup page. You can control cookies through your browser settings; blocking the essential ones will stop you from signing in. If we introduce analytics in future, we will update this section and ask for your consent where required before setting any non-essential cookie.

8. Security

We take reasonable technical and organizational measures to protect your data. Traffic is encrypted in transit with HTTPS, passwords are stored hashed, API keys are stored hashed and shown only once, third-party credentials such as your InfluxDB token are encrypted at rest, email verification is required for new accounts, and two-factor authentication is available.

For the sake of transparency: our administrators have the technical ability to sign in to an account in order to diagnose a problem. We use this sparingly, and it is recorded.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Children's Privacy

The Service is not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at [email protected] and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time, including when we add or change a service provider. We will notify you of material changes, for example by email or an in-app notice, before they take effect. The "Last updated" date at the top reflects the most recent revision.

11. Contact

For any questions about this Privacy Policy or to exercise your data rights, contact Zarruk Serrano at [email protected].
Lillogata 5p, 0484 Oslo, Norway