Privacy Policy
Last updated: 20 October 2026
This policy explains what personal data asksebastian.ai ("Sebastian", "the Service") collects, why, who we share it with and the rights you have over it.
1. Who we are
The Service is operated by Web Extreme Ltd., Ivan Peichev St. 10, Sofia, Bulgaria ("we", "us"). For your account, billing and website data we are the controller. For the Amazon seller data you connect and process with the Service, you are the controller and we act as your processor under our Data Processing Agreement.
Privacy questions and requests: support@webextreme.bg, +359 898 607 800.
2. Data we collect
- Account data — name, email address, password hash, role and permissions, two-factor authentication settings, and the team members you invite.
- Amazon connection data — authorization tokens issued by Amazon when you connect Selling Partner API (Seller Central or Vendor Central) and Amazon Ads accounts, plus the marketplace and profile identifiers of those accounts. We never see or store your Amazon password.
- Seller business data — data we sync from Amazon for you, such as sales, orders, inventory, listings, catalog content, advertising campaigns, search terms and reports.
- Content you create — chat questions you ask Sebastian, the answers, reports, report templates, notes, monitoring rules and listing edits.
- Integration and access tokens — personal access tokens and connector credentials you create to use Sebastian from AI clients through the Model Context Protocol (MCP), and optional notification destinations such as Slack.
- Technical data — IP address, browser and device information, request and error logs, and security events such as sign-ins.
- Support communications — messages you send us and our replies.
3. How we use it
- To provide the Service: sync and store your Amazon data, answer questions, generate reports, monitor listings and send the notifications you configure.
- To secure the Service: authenticate users, enforce permissions, detect abuse and investigate incidents.
- To support you and send service and security notices about your account.
- To maintain and improve reliability and performance of the Service.
- To meet legal, accounting and tax obligations.
We do not sell your data, we do not use your seller data for advertising, and we do not allow our AI providers to train their models on your data.
4. Legal bases (GDPR)
- Contract — processing needed to provide the Service you signed up for.
- Legitimate interests — keeping the Service secure, preventing fraud and improving the product, balanced against your rights.
- Legal obligation — records we must keep under applicable law.
- Consent — where we ask for it; you can withdraw consent at any time.
5. AI processing
Sebastian uses large language models to understand your questions and produce answers, reports and listing suggestions. To do that, the relevant parts of your question and your seller data are sent to the AI providers listed below through their business APIs. Those providers process the data on our behalf, may keep it only for a limited time for abuse monitoring, and do not use API data to train their models. AI output can be wrong; review it before acting on it.
6. Amazon account access
You connect Amazon accounts through Amazon's own authorization pages. Amazon issues tokens that let us call the official Selling Partner API and Amazon Ads API on your behalf. Tokens are stored encrypted and used only by our backend services. You can revoke access at any time in Seller Central, Vendor Central or Amazon Ads, or by removing the store in Sebastian; syncing stops immediately.
7. Subprocessors and recipients
We share data only with providers that help us run the Service, under contracts that require them to protect it:
| Provider | Purpose | Data |
|---|---|---|
| Cloud hosting and database providers | Hosting the application, MongoDB databases and backups | All Service data |
| Akamai (Linode) and Bunny.net | File storage and delivery | Uploaded files and generated files |
| OpenAI | AI language models and embeddings | Questions, relevant seller data |
| Anthropic | AI language models | Questions, relevant seller data |
| Google (Gemini API) | AI language models | Questions, relevant seller data |
| Mailjet | Sending account, security and notification emails | Name, email address, message content |
| Slack (only if you connect it) | Delivering notifications you configure | Notification content |
Amazon receives the requests we send to its APIs on your behalf. We may also disclose data when required by law or to protect our rights, or to a successor in a merger or acquisition, subject to this policy. An up-to-date list of subprocessors is available on request.
8. International transfers
Some of our providers process data outside the European Economic Area, including in the United States. Where data leaves the EEA we rely on an adequacy decision of the European Commission or the Standard Contractual Clauses, together with supplementary measures where needed.
9. Cookies and local storage
We use only cookies that are strictly necessary to run the Service: a session cookie that keeps you signed in and a security cookie that protects forms against cross-site request forgery. The app also keeps preferences such as the last page you visited in each section in your browser's local storage. We do not use advertising or analytics cookies, so no consent banner is needed.
10. Retention
- Account and seller data is kept while your account is active.
- When you close your account or disconnect a store, we delete the related data within 30 days, and from backups within 90 days.
- Security logs are kept for up to 12 months; invoices and accounting records for the period required by the laws of the Republic of Bulgaria.
11. Security
We encrypt data in transit with TLS, encrypt Amazon tokens and other secrets at rest, isolate each customer account at the database layer, support two-factor authentication and restrict production access to the people who need it. See our Security page for details.
12. Your rights
Under the GDPR you may request access to, correction, deletion or a portable copy of your personal data, and you may object to or ask us to restrict processing. Email support@webextreme.bg; we answer within one month. If your data is in a customer's account (for example, you are a team member), we may forward your request to that customer.
You can also lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg) or the supervisory authority where you live.
13. Children
The Service is for businesses and is not directed to anyone under 18.
14. Changes
We may update this policy. For material changes we will notify account owners by email at least 30 days before they take effect, unless a faster change is required by law or for security.