PRIVACY NOTICE · VERSION 1.0 · 5 AUGUST 2026
Privacy Notice
The controller is Merecida Narrativa, Lda, trading as SerialLabs, Portuguese company number 517143542, with registered office at Rua do Visconde de Bóbeda, 70, 4000-108 Porto, Portugal. Privacy and data-rights contact: vitor.magalhaes@seriallabs.com.
This notice covers the SerialLabs enquiry form and its delivery, security, retention and data-rights records. It does not cover a later client project, newsletter or materially different purpose.
Data we process
The form asks for your name, work email and the process or business problem you choose to describe. Please do not include passwords, financial credentials, health information, government identifiers, criminal-offence data or other special-category or highly confidential personal data.
The application also creates random transaction identifiers, HMAC-derived anti-abuse and duplicate-detection values, timestamps, expiry date, delivery state and retry records. For a verified rights request it records a controlled reference, authorised operator, timestamps and outcome. The application does not persist the raw network address in the lead store.
Why we process it
For an inbound business enquiry, we rely on our legitimate interests under Article 6(1)(f) GDPR to receive and answer the request, assess whether an AI Opportunity Sprint may be relevant and keep a reliable record of the exchange. The form does not enrol you in marketing.
For security and reliable delivery, we rely on Article 6(1)(f) GDPR to prevent abuse and duplicates, diagnose failures and avoid silently losing an enquiry, using pseudonymous values and short retention where possible.
For data-rights requests and accountability records, we rely on Article 6(1)(c) GDPR to comply with legal obligations, including Articles 5(2), 12–22 and 24 GDPR.
No AI model is called in the form submission path, and the form data is not used for solely automated decisions producing legal or similarly significant effects.
Who receives the data
Access inside Merecida Narrativa, Lda is limited to the authorised SerialLabs operator. Vercel provides hosting, Functions, security infrastructure and private Blob storage configured in Paris; Resend provides transactional email delivery to info@seriallabs.com. We do not sell the form data.
International transfers
Vercel and Resend are US providers and may process data outside the European Economic Area. Where Chapter V GDPR applies, transfers use the applicable provider DPA and safeguards such as Standard Contractual Clauses and, where applicable, an adequacy mechanism. A Paris storage region is not represented as complete EU-only residency.
Retention
Lead and delivery records are kept for no more than 12 calendar months; HMAC-derived rate-limit events for no more than 24 hours; and deletion-request audit records for no more than 12 months unless longer retention is necessary for a live legal or supervisory matter. Verified earlier-deletion requests are applied to active copies under our control, subject to limited provider backup and security retention.
Security
The design uses private storage, project-scoped credentials, same-origin controls, strict field and payload limits, pseudonymous anti-abuse values, idempotent delivery and a protected maintenance route. These controls reduce risk but are not an absolute-security guarantee or certification.
Your rights
Subject to the GDPR and applicable exceptions, you may request access, rectification, erasure, restriction or portability where applicable, and may object on grounds relating to your situation to processing based on legitimate interests. Contact vitor.magalhaes@seriallabs.com; proportionate identity verification may be required, and we normally respond within one month.
You may lodge a complaint with the Comissão Nacional de Proteção de Dados, or another competent supervisory authority in the EEA country where you live or work or where the alleged infringement occurred.
Your choice
Providing the form information is voluntary, but we need a means of contact and enough process context to respond usefully. Do not submit another person's information unless you are authorised and it is necessary for the enquiry.
Changes
We will update this notice when the form, providers, purposes or legal requirements materially change. The current version and effective date remain published here, and a materially new purpose requires an appropriate legal basis and notice.