Legal
Privacy Policy
Last updated: 22 July 2026
Sena ("Sena", "we", "us", "our") provides an AI-powered chat assistant. This Privacy Policy explains what personal data we collect, how we use it, where it is stored, and the rights you have. We are committed to handling your data transparently and in line with the UK GDPR and the Data Protection Act 2018.
If you have any questions, contact us at hello@senabot.ai.
01Who this policy covers
- Customers: businesses and individuals who create a Sena account and use the dashboard.
- End visitors: people who interact with a Sena chat widget on a customer's website.
02What data we collect
Account data: name, email address, password (stored hashed), billing details, and organisation information.
Customer content (your knowledge base): website content you ask us to crawl, documents (PDFs) you upload, and text you add to train your AI assistant.
End-visitor conversation data: the messages exchanged with the chat widget, and any details a visitor voluntarily submits through a form (e.g. name, email, enquiry).
Usage & technical data: analytics events, IP address, browser type, and pages viewed, used to operate and improve the service.
03Where your data is stored: data residency
Your database and uploaded files are hosted on Supabase, running on Amazon Web Services (AWS) in the United Kingdom (London region, eu-west-2). Your core data does not leave the UK for storage. The one exception is AI processing (see Section 4): when the assistant generates a reply, the relevant content is sent to OpenAI's API, which may occur outside the UK/EU under appropriate legal safeguards.
04How we use AI (OpenAI)
Sena's AI assistant is powered by the OpenAI API. To generate answers and process your training content, we send the relevant text to OpenAI.
- OpenAI does not use data submitted through its API to train or improve its models. This has been OpenAI's default policy since 1 March 2023.
- OpenAI retains API data for a maximum of 30 days (for abuse monitoring) and then deletes it, unless legally required to retain it.
OpenAI is US-based, so this processing may take place outside the UK/EU, covered by Standard Contractual Clauses and OpenAI's Data Processing Addendum:
05We do not sell your data
We do not sell, rent, or trade your personal data or your customers' data to any third party, and we never use it for third-party advertising. We share data only with the sub-processors below, strictly to operate the service.
06Sub-processors
| Provider | Purpose | Region |
|---|---|---|
| Supabase (on AWS) | Database, authentication, file storage | UK (London, eu-west-2) |
| OpenAI | AI model responses & training your assistant | US (under SCCs / DPA) |
| n8n Cloud | Workflow automation | EU |
| Stripe | Payment processing | EU / US (PCI-DSS) |
| Resend | Transactional email | EU (Ireland, eu-west-1) |
| Cloudflare | Hosting, CDN, security | Global edge |
07Data retention
- Account & customer content: retained while your account is active, deleted within 30 days of account closure (unless required by law).
- End-visitor conversations: retained as long as needed to provide the service, deletable on request.
- OpenAI API data: deleted by OpenAI within 30 days.
08Your rights (UK GDPR)
You have the right to access, correct, delete, restrict, or object to processing, and to data portability. Email hello@senabot.ai. You may also complain to the Information Commissioner's Office (ICO) at ico.org.uk.
09Security
Data is encrypted in transit (TLS) and at rest. Access is protected by authentication and row-level security so each customer can only access their own data. We support DPIAs and can provide a Data Processing Agreement on request. See our Security & Data Processing page for full details.
10Cookies
We use essential cookies to keep you signed in and operate the dashboard. We do not use advertising or tracking cookies.
11Changes to this policy
We may update this policy from time to time. Material changes will be notified in the dashboard or by email.
12Contact
Sena - hello@senabot.ai