Serkle Privacy Policy

Version of October 17, 2026 · Effective as of that date · Updated October 30, 2026 (the public profile link)

Protecting your privacy is at the heart of Serkle: your circle is private, we sell no data and we show no advertising. This policy explains what data we process, why, how, with whom it is shared, how long it is kept and what your rights are.

It applies to the Serkle service, available at serkle.me (the "Service"), and supplements the Terms of Use. It is drawn up in particular under the Israeli Protection of Privacy Law, 5741-1981, as amended (including by Amendment No. 13), and its regulations, in particular the Protection of Privacy (Data Security) Regulations, 5777-2017 and the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001, and of the EU General Data Protection Regulation (GDPR) for Members located in the European Union.

1. Controller

The controller ("database owner" under Israeli law) is Valguani ("Valguani", "we"), operated by Sacha Ghnassia.

Data protection officer (under Israeli law and the GDPR): Sacha Ghnassia, reachable at support@serkle.me.

For any question or request about your data: support@serkle.me.

2. The data we process

2.1. Data you provide

• Google sign-in: your name, email address and Google account identifier. We never receive your Google password.
• Phone number: verified with a code sent by text message; it ensures one person holds only one account.
• Public profile: display name, username (@), photo, description, public link (if you add one: your website, portfolio, Instagram…), city, age bracket (calculated from your date of birth) and your countries (shown by default, you can hide them).
• Date of birth: used to check your age, calculate your age bracket and apply the protections for minors. Your exact date is never shown to anyone.
• Sex: you may answer "I'd rather not say"; never shown, used only for aggregated statistics of your own circle.
• Countries that matter to you (optional): shown on your profile by default; you can hide them at any time in "Edit my profile".
• Interests: used for search and suggestions. They are not shown on your profile.
• Sensitive interests: some interests may reveal sensitive information (religion, beliefs, political opinions, health, sex life or orientation, origin). They are only recorded with your explicit consent, given when you choose them, are never shown, even in common, only serve to find people who also have them, are never used for suggestions or emails, and are reserved for adults.
• Your circle: the people you place in it, their circle of closeness, category, link and your notes.
• Messages exchanged with other Members, reports, blocks, interest suggestions.
• Preferences: language, email and notification settings.
• Where applicable, Pulses, events and payment data, when these features are offered.

2.2. Data about people you add (manual contacts)

When you add a person who is not on Serkle, you record their first name, last name, phone number and your own information about them (category, circle, link, note). For this data:

• it is visible only to you;
• the phone number is stored encrypted, together with a cryptographic fingerprint (HMAC, with a secret key kept server-side) that makes it possible to recognize the number without storing it in clear;
• Serkle never contacts this number and uses it for no other purpose;
• if this person creates a Serkle account with this number, they are told that Members recorded their number and they alone decide, one by one, whether to be linked to them. Without their consent, nothing is linked and nothing is revealed to anyone. What you noted about them (category, circle, note) is never shown to them.

The processing of this data is based on your legitimate interest in organizing your personal relationships and Valguani's legitimate interest in providing the Service, framed by these safeguards. A data subject may write to us at any time at support@serkle.me to exercise their rights, in particular to request the erasure of data about them.

2.3. Data collected automatically

• Technical data: IP address, device and browser type, language, sign-in dates and times, technical and security logs.
• Usage data: actions in the Service needed for it to work and for its limits (for example the number of messages or suggestions sent).
• Audience statistics: when we measure audience, we use a tool without cookies and without identifying personal data (Umami, hosted by us).
• Error reports: when we use an error monitoring tool (Sentry, hosted in the European Union), it receives technical information about errors, without the content of your messages or your notes.

2.4. Cookies and local storage

The Service uses no advertising or audience measurement cookies. It uses your browser's local storage only for what is strictly necessary: your sign-in session, your language, and temporarily the acceptance of the Terms or an invitation link during sign-in. These do not require consent.

3. Why we use your data, and on what basis

We do not use your data for advertising, we do not sell or rent it, and we do not build commercial profiles.

4. What others see

• Any signed-in Member can see your name, username, photo, description, public link, age bracket and city (the last two never for a minor Member), as well as your countries unless you hide them (never for a minor Member), your Serkle+ badge and, where applicable, the "Verified profile" mark.
• A Member viewing your profile can see the interests you have in common (never a sensitive interest, never for a minor) and the people you both know through mutual links.
• What remains strictly private: your circle, your manual contacts, their numbers, your notes, categories, circles of closeness, links, your interests (other than those in common), your exact date of birth, phone number, email, sex and hidden countries. The fact that you added someone is visible only to you and that person.
• Messages are visible only to the participants in the conversation.
• We never show who viewed your profile.

5. Protection of minors

The Service is reserved for people aged 15 and over. For Members aged 15 to 17: an adult cannot find them through search, and vice versa; they never appear in an adult's suggestions; messages between an adult and a minor are only possible if each has added the other; their city and age bracket are never shown; sensitive interests are not available to them; no automatic link is made between a minor and an adult who recorded their number. If we learn that an account belongs to a person under 15, we delete it.

6. Automated decisions and artificial intelligence

• Suggestions and order of results: calculated automatically from mutual links, non-sensitive interests, age bracket and distance between cities. They have no legal effect on you.
• Interest suggestions: the text you suggest, and only that text (never your identity or other data), is sent to an artificial intelligence model (OpenAI) that evaluates it. A clearly illegal suggestion results in an automatic warning, and a second warning results in the Account being banned. You have the right to obtain human intervention, to express your point of view and to contest the decision by writing to support@serkle.me.
• OpenAI does not keep these texts to train its models as part of our use.
• AI assistants you connect yourself (Claude or ChatGPT, the only ones allowed, through Serkle's MCP server): only if you decide to, for adults only. You choose what the assistant may do (read your serkle, read your notes, search people, add someone, write a message); what it reads is sent to it, and so to the company running it, which processes it under its own terms. Your notes are sent to it only if the “Read my notes” box stays ticked. The assistant can do nothing more than the app allows, under the same rules (minors, blocks, sensitive interests never shown), and it must ask you before adding someone or sending a message. You can cut its access at any time in Settings → Connected AIs.

7. Who we share your data with

We only share your data with technical providers acting on our behalf, on our instructions, under contracts requiring them to protect it (processors):

• Supabase: hosting of the database, authentication and files (European Union region, Frankfurt);
• Cloudflare: website hosting, content delivery, protection against attacks, domain name and routing of support emails;
• Google: sign-in with your Google account;
• Twilio: sending and verifying the text message code;
• Resend: sending the Service's emails (European Union region, Ireland);
• OpenAI: analysis of the text of suggested interests, without any identifying data;
• OVH: hosting of our internal anonymous statistics tools, without Members' personal data;
• Sentry: monitoring of technical errors (European Union), when enabled;
• Stripe: payments, when paid features are offered.

We may also disclose data: to authorities when required by law or in response to a lawful request; to protect the rights, safety or property of Valguani, Members or third parties; to a successor in the event of a reorganization, merger, acquisition or transfer of Valguani's business, including to a company established in another country, which will be bound by this policy, after informing Members.

8. International data transfers

Your data is mainly hosted in the European Union. Israel and the European Union mutually recognize an adequate level of protection. Some providers (in particular Google, Twilio, Cloudflare and OpenAI) may process data in the United States or other countries. These transfers are framed, as the case may be, by an adequacy decision (including the EU–US Data Privacy Framework), by the European Commission's standard contractual clauses and by the commitments required by the Israeli regulations on the transfer of data abroad. You can obtain information about these safeguards by writing to us.

9. Retention

• Account and profile: as long as your Account exists. When it is deleted, your profile, circle, contacts, interests, notes and preferences are erased.
• Messages: deleted with your Account, including in the conversations of the people you wrote to.
• Manual contacts: as long as the Member who created them keeps them; deleted with the contact or with their Account.
• Invitations: links expire after 30 days and are revoked when the contact is deleted.
• Unfinished account (interrupted sign-up or insufficient age): deleted, without keeping the data entered.
• Reports, sanctions and security records: kept as long as necessary for the Service's security and the defense of our rights, at most three years after the closure of the Account concerned, unless a longer legal obligation applies.
• Technical logs: in principle at most twelve months.
• Emails sent (sending history, without the content of messages): at most twelve months.
• Backups: erased data may remain in security backups for at most 30 days, before being overwritten.

10. Security

We implement appropriate technical and organizational measures, in accordance with the Israeli Data Security Regulations, in particular: encryption of communications (HTTPS), strict access rules at the database level (each Member can only read what they are allowed to), encryption of manual contacts' numbers, secret keys kept outside the code, abuse limits, access restricted to those who need it, and logging. As no measure is infallible, we cannot guarantee absolute security. In the event of a data breach presenting a risk, we notify the competent authority and, where required by law, the people concerned.

11. Your rights

Depending on the law that applies to you, you have in particular the following rights:

• access to your data (Israeli law, section 13; GDPR, Article 15); you can also export it at any time from Settings;
• rectification of inaccurate or incomplete data (Israeli law, section 14; GDPR, Article 16); most of it can be changed directly in "Edit my profile";
• erasure: you can delete your Account at any time from Settings;
• withdrawal of consent, in particular for sensitive interests, by removing them from your profile, without affecting past processing;
• objection to processing based on legitimate interest and to any non-essential sending (one-click unsubscribe in every email);
• restriction of processing and portability of your data (GDPR);
• contesting an automated decision and human intervention (section 6);
• complaint to a supervisory authority: in Israel, the Privacy Protection Authority; in the European Union, the authority of your country (in France, the CNIL).

To exercise your rights, write to support@serkle.me from the address linked to your Account. We may ask you to prove your identity. We respond within the time limits set by law (in principle 30 days).

12. People who are not on Serkle

If you are not on Serkle and believe a Member recorded your number or information about you, you can write to us at support@serkle.me. We will never contact you on our own initiative. Upon a justified request, we erase the data about you that we can identify, in particular from your phone number.

13. Changes to this policy

We may change this policy to reflect changes in the Service or the law. In case of a significant change, we will inform you before it takes effect, in the Service or by email. The date of the latest version appears at the top of this document.

14. Contact

Valguani — Serkle
support@serkle.me