Privacy, Data and Cookie Policy

Serenity Decoded

Effective: October 18, 2026 | Version 8.3

1. INTRODUCTION

Yellow Tail Investment Enterprise, LLC and its affiliated entities (collectively, "Company") are committed to protecting your personal data. This Policy explains what we collect, why, how we use and share it, and your rights. It applies to all users of the Serenity Decoded website (serenitydecoded.com), the Serenity Aligned™ application, and the Aarav The Serenity Genie™ AI System, regardless of location.

2. DATA CONTROLLER

Yellow Tail Investment Enterprise, LLC 30 N Gould St, Ste R, Sheridan, WY 82801, United States of America Website: serenitydecoded.com EU/EEA and UK representative: contact through serenitydecoded.com.

3. PERSONAL DATA WE COLLECT

3.1 Data You Provide

• Identity: first name, last name, and your confirmation that you are 18 or older (age confirmation);
• Contact: email address, telephone number;
• Account: credentials, subscription details, preferences;
• Payment: billing name, billing address and limited transaction confirmation data received from the payment processor. Full card details are handled by the processor through checkout; do not include payment credentials in other submission fields.
• AI Interaction: all Inputs submitted to Aarav The Serenity Genie™ and all Outputs generated;
• SMS and push notification consent records;
• Communications: messages, feedback, support requests, complaints.
• Direct messages: the content of direct messages you send to other members, including any photos you attach;

3.2 Data Collected Automatically

• Technical: IP address, browser, operating system, app-generated device identifiers, and mobile advertising identifiers only where used and subject to required permissions. The random app-generated identifier sent with chat is distinct from an advertising identifier and may be collected even when a device-limit feature is disabled.
• Usage: pages viewed, session duration, navigation paths, feature interactions;
• Geolocation: approximate location from IP address;
• App: device model, app version, crash reports, performance data.

3.3 Sensitive Data

Your chats, journal entries, Community content, feedback or voluntary stories may reveal sensitive information, including information about emotional wellbeing or finances. We process the information actually needed for the requested feature and relevant safety functions as described in this Policy. Do not submit payment credentials, medical records, passwords or another person's private information. Where applicable law requires explicit consent or a separate consumer-health-data notice or authorization, we must provide it and obtain the required permission before the relevant collection, sharing or use. General Terms acceptance and a publicity license do not replace those requirements.

4. PURPOSES AND LEGAL BASES

5. AI SYSTEM – DATA TRANSPARENCY

• Inputs sent to Aarav The Serenity Genie™ are transmitted to OpenAI’s infrastructure. OpenAI’s API terms prohibit training on API inputs without opt-in.
• AI Inputs and Outputs and structured account context support session continuity. Structured context may include facts you shared, the four introductory answers, focus, Reveal, an agreed step, your six-answer outcome report and the reviewed activity offered. These records are linked to your account and kept on our servers subject to §8. Genuinely anonymized data may be used for Platform improvement.
• We do not use identifiable personal AI Inputs to train publicly available AI models.
• AI Interaction data may be reviewed by Company personnel for safety, compliance, or dispute resolution under confidentiality obligations.
• The AI System uses automated processing to personalise responses. Contact us through serenitydecoded.com to request human review of any automated processing.
• With your permission, Aarav may read Journal entries to personalize support. You may withdraw permission in Account, which stops future journal access under that permission. We retain a limited record of permission and withdrawal to administer your choice and demonstrate compliance. Withdrawal does not itself close your account. To ask about information previously derived from a Journal entry or to exercise deletion rights, use the contact route in §14; we will explain the applicable handling rather than treating withdrawal as a promise that every earlier record has been erased.

5.1 Trial eligibility and signup restrictions

We keep a record of email addresses and phone numbers associated with accounts that have used a free trial. These identifiers are standardized for matching, such as lowercasing an email address or retaining phone digits; they are not made anonymous by that formatting. The record survives account deletion so that deletion does not provide a second trial. It is used for trial eligibility, not public display or marketing. Authorized staff may also record email addresses or phone numbers that are restricted from signup or account changes, together with a reason, the staff member responsible and related action records. These records may concern applicants, former members or people who have never opened an account. Staff enter the identifiers in administering access restrictions. You may contact us through the refusal notice or serenitydecoded.com to challenge a mistake. Retention and rights are addressed in §§8 and 14.

5.2 Community participation and visibility

Other members see a member label by default. You may choose a display name, which need not be your real name, and an optional photo, and return to the default label at any time. Automated name checks and staff review help enforce name rules; staff may reset abusive or impersonating names. Your posts, comments and uploaded photos are visible within the Community, and photos are stored using our cloud services. Content may be visible before staff review. Shared content or photos may identify you; returning to a member label cannot undo copies others have made. Members may like posts and comments and follow members and circles. We store those relationships and related counts. Like counts, follower counts, Daily Sessions streaks and weekly rankings by likes received are visible to other members. Blocking a member stores a block record on your account, hides that person's posts and comments from your view, and ends follows between you. We do not send the other person a notification of the block. Blocking does not promise mutual invisibility or prevention of contact through other channels.

5.3 Automated checks and human moderation

Posts and comments are scanned automatically for patterns such as card or account numbers, phone numbers, requests for money, possible schemes, crisis language and attempts to move contact off the Platform. A match flags content for staff review; a keyword flag does not automatically remove the post. Authorized moderators may view the content and its associated account email, remove content, reset names or restrict accounts. We record moderation actions. Our statement that account names and emails are not displayed to other members does not mean they are hidden from authorized staff. Automated checks can miss concerns or flag harmless content. Community moderation is not continuously monitored emergency assistance, clinical assessment or a guarantee of a response within a particular time. Do not rely on a post or flag to obtain emergency help. If someone is in immediate danger, contact local emergency services. Crisis support resources are available in the AI, Content and Platform Disclaimer.

5.4 Feedback and internal reports

We use your rating and written feedback to review and improve the app. Feedback may be copied to our support inbox. Authorized staff may export feedback or testimonial records to spreadsheets; those internal records may include account email addresses. Staff also use internal counts and financial totals to administer the service. These copies remain subject to access controls and retention requirements. Optional permission to contact you about feedback does not enroll you in marketing. Administrative email addresses are not part of public testimonial attribution.

5.5 Invitations and store links

Invite links contain the inviting member's code. We may read Google Play install-referrer information once to credit that invitation automatically, or a new member may enter a friend's code manually. We link the accounts for invite counts only; the current invitation feature does not provide rewards. Our store link uses device information from the request to direct visitors to a store. The redirect itself does not set cookies. Invite attribution is retained separately from the redirect; technical request logs are subject to the relevant website retention provisions.

5.6 Voluntary member stories

We review submitted text, photos or video and record the permission given. Only approved stories may appear publicly on our website or in Serenity Aligned marketing under the Testimonial Release. Attribution uses the chosen Community display name or "a member," not the account name or email. A face, voice or story may still identify the contributor. Permission is optional and may be withdrawn through Account > Share your story or the website contact form. The release explains removal, further use and retention. Changing a Community display name or removing a profile photo is not itself withdrawal of a testimonial release.

5.7 Direct messages

Members may send private messages to other members, one to one or in small groups, including photos and links where that feature is enabled. Messages are stored on our servers so that both parties can read them, and they are visible only to the participants and, where a message is reported or flagged by our safety keywords, to our staff for review. Messages are not used to train any public AI model and are not sold or shared with advertisers. You can send a message only to a member who follows you back or who has replied to you, you can block any member at any time, and a blocked member cannot see you or contact you. You may delete your copy of a message or thread at any time; the other participant keeps theirs. When you delete your account, your messages are removed from every thread. Messages are retained for as long as the thread exists, and photos shared in messages are stored in our own storage under the same terms as Community photos.

6. DATA SHARING

We do not sell personal data. We share data with service providers acting on our behalf, including AI infrastructure, hosting, payment, communications, analytics and support providers, under appropriate contractual safeguards; where required by law; in a business transfer with applicable notice; and for lawful safety purposes. Community material is displayed to its intended member audience. Approved testimonial material is shared publicly with the permission required for that use. Publication on a website or in marketing is public disclosure, not merely internal processing. Sensitive information receives the additional safeguards and permissions required by applicable law.

6.1 Third-Party Payment Processing

Subscription purchases made directly through the Platform are processed by a third-party payment processor engaged by the Company ("Payment Processor"). The following disclosures apply specifically to your payment data:

7. INTERNATIONAL DATA TRANSFERS

Data may be processed in the US and other countries. We use Standard Contractual Clauses for EU/EEA transfers, the UK IDTA for UK transfers, and equivalent mechanisms for other jurisdictions. Our Payment Processor may process payment data in jurisdictions outside your country of residence; their privacy policy describes the safeguards they apply to international transfers.

8. DATA RETENTION

Direct messages: for the life of the thread, or until you delete your copy or your account.

Account deletion ends ordinary account access and deletes account content as described above, but does not erase the limited trial-eligibility, restriction, payment, consent, complaint or security records lawfully retained for their stated purposes. Only necessary records are retained, and they are restricted to authorized use. We review continuing need and remove information when the applicable purpose or lawful retention requirement ends. Applicable rights and legal exceptions take precedence. Backups are kept for recovery and security and expire through the documented backup rotation. They are not retained for new marketing uses of a withdrawn story. If a backup is restored, applicable deletion and withdrawal restrictions must be reapplied before restored material is returned to ordinary use. Contact us through serenitydecoded.com for information about the applicable retention period or criteria and to exercise your rights.

9. SECURITY

• Encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent);
• Need-to-know access controls for administrative access, with every high-risk administrative change confirmed and recorded in an audit log;
• Payment credentials submitted through the authorized checkout are handled by the payment processor. The Company remains responsible for its own systems, including any sensitive information submitted outside checkout, and for its applicable security obligations.

10. DATA BREACH NOTIFICATION

• Regulatory authority notification within applicable timeframes: 72 hours under GDPR; 30 days under Florida FIPA; as required under other applicable laws;
• Affected user notification without undue delay where high risk to their rights exists;
• Notification will include: breach description; affected data categories; consequences; and remediation measures. If a breach involves a payment processor or other service provider, responsibilities depend on the facts and applicable law. The Company will cooperate and meet any notification or remediation duties that apply to it; outsourcing processing does not transfer away those duties.

11. COOKIES AND TRACKING

We request consent before placing non-essential cookies. We honour GPC opt-out signals as Do Not Sell or Share requests under CPRA. On iOS, we request ATT permission before accessing IDFA. Manage preferences through the cookie banner or Cookie Settings in the footer at any time.

12. SMS AND PUSH NOTIFICATIONS

• Marketing SMS: sent only with express written TCPA-compliant consent, documented separately.
• Verification SMS: a one-time code sent when you register or change a phone number. No other SMS (reminders, account or billing notices) is sent at this time; if introduced, it will be sent only with the consent applicable law requires and with a way to opt out.
• Opt-out: reply STOP to any marketing message, processed within 10 business days.
• Push and in-app notifications may include comments, likes, new followers and circle posts. Individual Community notification categories can be changed in Account. App preferences may start on, but sending push notifications also depends on device permission where required. Device settings provide additional control. These Community notices do not use SMS and do not enroll you in marketing.

13. CHILDREN’S PRIVACY

The Platform is for users 18 and older. We do not knowingly collect data from anyone under 18. If discovered: access is restricted immediately; data is deleted within 30 days; parent/guardian notified where feasible.

14. YOUR RIGHTS

Depending on your location: access; rectification; erasure; restriction; portability; objection; withdrawal of consent; human review of automated decisions; and complaint to a supervisory authority. Exercise rights through serenitydecoded.com. We do not discriminate for exercising rights. Some information may be retained after account deletion under the specific purposes and limits in §8 where lawful, including trial-eligibility and restriction records. We assess deletion and objection requests under applicable law and explain any exception relied on. Retained records remain subject to this Policy; deletion is not refused merely because a record is useful to us.

15. JURISDICTION-SPECIFIC PROVISIONS

15.1 EU / EEA (GDPR)

Legal bases per §4. Complaints to your local DPA (edpb.europa.eu). DPIAs conducted for high-risk processing.

15.2 UK (UK GDPR / DPA 2018)

Equivalent rights. Complaints to the ICO (ico.org.uk).

15.3 Canada (PIPEDA / Quebec Law 25)

Canadian rights under PIPEDA. Quebec users: additional rights including portability and opt-out from automated profiling under Law 25. Breach notification as required.

15.4 California (CCPA / CPRA)

Know, delete, correct, opt-out of sale/sharing, limit sensitive data use, no discrimination. We do not sell data. GPC signals honoured.

15.5 Florida (Digital Bill of Rights / FIPA)

Access, correction, deletion, portability, opt-out rights. Breach notification within 30 days under FIPA.

15.6 Other US States

Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with privacy laws: rights consistent with §14.

15.7 India (DPDPA 2023)

Access, correction, erasure, grievance redressal. Lawful basis: consent.

15.8 Singapore, Malaysia, Philippines, Japan, South Korea, Hong Kong, Thailand, Australia

We comply with: Singapore PDPA; Malaysia PDPA 2010; Philippines DPA 2012; Japan APPI (2022); South Korea PIPA; Hong Kong PDPO; Thailand PDPA; Australia Privacy Act 1988 (APPs). Contact us through serenitydecoded.com to exercise jurisdiction-specific rights.

16. CHANGES AND CONTACT

Material changes will be communicated in advance where required, and fresh consent will be obtained when the applicable law requires it. Notices and choices must also reach members using older app versions when the changed processing applies to them. A policy update alone does not substitute for required permission. Prior versions are available on request. Yellow Tail Investment Enterprise, LLC 30 N Gould St, Ste R, Sheridan, WY 82801, United States of America Website: serenitydecoded.com

Effective: October 18, 2026 | Version 8.3