Sera
Privacy Policy
Contents
Introduction
This Privacy Policy explains how Jitoma Solutions s.r.o. processes personal information in connection with Sera at https://sera.jitoma.cz. It takes effect on 2026-10-02. It is based on the service practices described by its operator and should be read together with notices shown when information is collected.
Who operates this service
Jitoma Solutions s.r.o. is the business responsible for this policy and is established in the Czech Republic, with a postal address at Děčínská 552/1, 180 00 Praha 8, Czech Republic.
Scope
This policy applies to the website and application offered under the Sera name. It does not govern independent third-party services that publish their own privacy terms.
Information we collect
Depending on use of the service, Jitoma Solutions s.r.o. collects these broad categories: identity and contact information; account information, submitted content, and communications; technical, usage, and device information; and payment, location, sensitive, or other information. Specific data depends on the features used and the practices described below.
Some information is required to provide requested features; if it is not supplied, those features may be unavailable.
Sources of information
Information comes from users directly, automatic collection from the devices used to access the service, and service providers or partners. Information received from another source is handled for the purposes described in this policy and subject to applicable restrictions.
How we use information
Information is used for providing and securing the service; managing accounts, support, payments, and communications; analytics and product improvement; and marketing, advertising, and personalization. It may also be used to prevent misuse, establish or defend legal claims, meet legal obligations, and enforce service terms where those activities are relevant and permitted.
Messages and email
The service sends transactional service messages using Brevo for website contact messages and confirmations; Firebase Cloud Messaging for app and partner notifications. Contact details are used for delivery, service administration, and the purposes described when the details are collected.
Transactional messages are sent only as needed to provide, secure, or administer the service. The operator does not measure message opens or link interactions.
EU legal bases for processing
For processing governed by the EU GDPR, the relied-on legal bases are performance of a contract or steps requested before a contract and legitimate interests. The operator's purpose-to-basis mapping is: Contract: delivering requested app features and processing purchases or subscriptions. Legitimate interests: responding to support and contact messages, operating and securing the service, preventing fraud and diagnosing technical problems. Stored cycle and intimacy records are anonymized from the operator's perspective, with no account identity or other means to connect a room's data to a real-world user unless the user explicitly supplies identifying information with their room ID. Legitimate interests include Operating a reliable and secure service, responding to user requests, preventing abuse and fraud, and diagnosing technical problems, balanced against affected rights and expectations. Consent can be withdrawn for future processing at any time without affecting processing that was lawful before withdrawal.
Cookies and tracking technologies
The service uses essential storage and cookies, analytics technologies, and advertising and social tracking technologies. The operator states that non-essential technologies are handled as follows: non-essential technologies start before consent and can be disabled through the stated opt-out. Preferences can be reviewed or changed through The Android app initializes Firebase Analytics and Google AdMob (Google Mobile Ads SDK) without an app consent gate. Device advertising privacy settings can limit or reset advertising identifiers; an ad-free entitlement suppresses ad display. App settings manage partner sharing, notifications, export and room deletion, but no app analytics opt-out or ad consent preference tool is present. This website has no advertising SDK or cross-site analytics. Browser controls may also limit storage, but blocking essential storage can prevent features from working.
Analytics
The service uses standard product analytics with Firebase to understand service operation, usage, errors, and improvements. Analytics data may include technical, device, interaction, approximate-location, and identifier information according to the selected configuration and provider controls.
Advertising
The service uses personalized advertising through advertising identifiers and other advertising partners identified at collection. Depending on configuration, advertising data can include device identifiers, interactions, conversions, and inferred interests. Available consent and opt-out controls are described in the rights section.
Payments
Payments are processed using Google Play Billing for Android; Apple App Store payments supported by the backend for one-time purchases and recurring subscriptions. The operator does not directly store full payment-card information; the payment provider handles card details under its own privacy terms. The operator retains Purchase tokens, order or transaction identifiers, product identifiers, purchase and expiration dates, platform and subscription or donation status; card details are handled by the app store. for accounting, support, fraud prevention, and legal obligations. Some purchases are also handled by an app store or marketplace, which independently processes the purchase account and payment method.
Sharing and disclosures
Information may be disclosed to service providers; business or advertising partners; and other users, buyers, the public, or other recipients for the purposes described in this policy, subject to contracts and legal limits where required. It may also be disclosed to authorities, courts, advisers, or transaction counterparties when reasonably necessary for law, safety, claims, or a business reorganization. Selected service providers include Firebase, Google Cloud, Google, Sentry, and Apple.
International transfers
Information may be processed outside the Czech Republic. The stated location and safeguard approach is: Android Firebase functions run in us-east1 (United States); the backend also deploys functions in europe-central2. Google states that Google LLC and covered US subsidiaries are certified under the EU-US Data Privacy Framework (https://firebase.google.com/support/privacy). The operator's applicable transfer arrangements and safeguards for all other providers have not been confirmed. For EU information, the transfer mechanism is: Android Firebase functions run in us-east1 (United States); the backend also deploys functions in europe-central2. Google states that Google LLC and covered US subsidiaries are certified under the EU-US Data Privacy Framework (https://firebase.google.com/support/privacy). The operator's applicable transfer arrangements and safeguards for all other providers have not been confirmed. Users may request information about the mechanism used.
Data retention
The retention model is: different record categories follow the periods stated below. Records may be kept longer when reasonably necessary for security, disputes, tax, accounting, fraud prevention, legal obligations, or enforcement. Deletion or de-identification follows the stated model and applicable law. Additional detail: Local app records remain on the device until cleared. The room owner can delete the main shared-room document through app settings. Suggestions are stored separately with text, role, room or client identifier and timestamps. Birthday media and purchase-verification records use separate storage. No automatic purge or fixed retention period for separate records was identified in the supplied backend; complete deletion of these records requires assistance through the privacy contact. Provider retention periods for analytics, diagnostics, messaging and website contact messages have not been confirmed. The operator states that stored app data is anonymized from its perspective: it has no account identity or other means to connect room data to a real-world user unless that user explicitly provides identifying information together with the room ID. A user seeking help locating their records must explicitly provide their room ID with the request.
Security
The operator uses access restrictions and backups and monitoring, selected according to the nature and risk of the information. No transmission or storage method is completely secure, so absolute security cannot be guaranteed.
Children's privacy
The service is intended for teenagers. The operator will apply age-specific consent, notice, parental-request, and deletion duties where applicable.
Your choices and privacy rights
Depending on location and processing, users may ask to access, correct, delete, restrict, or receive information; withdraw consent; unsubscribe; object; or opt out of sale, sharing, or targeted advertising. Requests are supported through the account settings, the web request form, or by email to 9hly2ztp1@mozmail.com. The operator may verify identity and authority, apply legal exceptions, and explain a denial and available appeal where required.
European Economic Area privacy rights
The EU GDPR has applied since May 25, 2018. Where it applies, people may request access, rectification, erasure, restriction, and portability; object to processing; withdraw consent for future processing; and complain to the competent supervisory authority. Rights depend on the processing, lawful basis, and statutory exceptions. Requests may be made through the account settings, the web request form, or at 9hly2ztp1@mozmail.com.
Third-party links and services
The service integrates or links to Firebase, Google Cloud, Google, Sentry, and Apple. Those providers may act independently and publish separate privacy terms. The operator is not responsible for an independent service's practices, and users should review its notice before supplying information.
Changes to this policy
This policy may be updated to reflect service, legal, or operational changes. The current version will be posted at https://sera.jitoma.cz with a revised effective date. Additional notice or consent will be provided only when required by applicable law.
Contact us
Privacy questions and requests may be sent to Jitoma Solutions s.r.o. at 9hly2ztp1@mozmail.com or by mail to Děčínská 552/1, 180 00 Praha 8, Czech Republic.