Privacy Policy
Last updated: 27 October 2026
This privacy policy explains what personal data we process, why, on what legal basis and for how long. It covers visitors to sebaagency.com, users of our Seba AI chatbot, people who contact us or book a call, our clients, and creators whose data we process on behalf of our clients.
1. Controller
The controller responsible for processing under the EU General Data Protection Regulation (GDPR) is:
Seba Agency UG (haftungsbeschränkt)
Mutschellestrasse 4
81673 München, Germany
Represented by the managing directors Joshua Omosebi and Ila Yaqub
Email: info@sebaagency.com
Phone: +49 176 70574768
We are not legally required to appoint a data protection officer. For all data protection questions, please contact us at the address above.
2. Hosting and server log files
This website is hosted on GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. Each time you open a page, your browser automatically sends information that GitHub records in server log files:
- IP address
- Date and time of the request
- Page or file requested
- Referrer URL (the page you came from)
- Browser type and version, operating system
This data is needed to deliver the website and to protect it against attacks. The legal basis is our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). We do not combine this data with other data. GitHub stores log data in accordance with its own retention policies; see the GitHub Privacy Statement. GitHub, Inc. is certified under the EU-US Data Privacy Framework, so transfers to the USA are covered by the European Commission's adequacy decision (Art. 45 GDPR).
To display the page layout, your browser loads the Tailwind CSS framework from cdn.tailwindcss.com (Tailwind Labs Inc., USA). The provider receives your IP address and browser information when the file is requested. The legal basis is our legitimate interest in displaying the website correctly (Art. 6(1)(f) GDPR). All fonts and other scripts are hosted on our own website; we do not load Google Fonts from Google's servers.
4. Web analytics (PostHog) and Google Tag Manager
If you click "Accept" in the cookie banner, we use PostHog to understand how visitors use our website and to improve it. The provider is PostHog Inc., USA. We use PostHog's EU cloud, which stores data on servers in Frankfurt, Germany. PostHog processes the data on our behalf under a data processing agreement (Art. 28 GDPR).
PostHog processes:
- Pages viewed, clicks on buttons and links, scroll depth and session duration
- Referrer (how you arrived at our website)
- Device and browser information (browser type, operating system, screen size)
- Your IP address, which PostHog uses to determine your approximate location (country, region, city)
- A random identifier stored in a first-party cookie (named
ph_…) that recognises your browser across page views and visits
This data is pseudonymised, not anonymous: it does not contain your name or email address, but it is linked to the identifier in your cookie. We do not combine it with other data about you and do not use it for advertising.
The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). If you reject or withdraw consent, PostHog is not loaded and its cookies are deleted. Analytics data is deleted after 12 months; the cookie expires after one year at the latest. PostHog Inc. is a US company. Where PostHog staff or sub-processors in the USA can access data, the transfer is safeguarded by the EU Standard Contractual Clauses included in PostHog's data processing agreement (Art. 46(2)(c) GDPR).
Google Tag Manager
If you click "Accept" in the cookie banner, we also load Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a tool for managing the tracking and marketing tags on our website; we use it to load tags that measure how well our ads work.
When Google Tag Manager loads, your browser connects to Google's servers, and Google receives your IP address, browser and device information and the page you visit. Google Tag Manager itself does not set cookies, but the tags it loads may do so.
The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). If you reject or withdraw consent, Google Tag Manager and the tags it loads are not loaded, and their cookies on our domain are deleted. Google may transfer data to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). For details, see Google's privacy policy.
5. YouTube video
Our homepage contains a video hosted on YouTube. To protect your privacy, the video is not loaded when you open the page. Only when you click play does your browser connect to YouTube, in its privacy-enhanced mode (youtube-nocookie.com). From that point on, Google receives your IP address, the page you are on and device information, and may store cookies or similar data on your device.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). The legal basis is your consent, given by clicking play (Art. 6(1)(a) GDPR, § 25(1) TDDDG). For details, see Google's privacy policy.
6. Contacting us and booking a call
Email and phone
When you contact us by email or phone, we process your name, contact details and the content of your message to answer your request. The legal basis is the performance of a contract or pre-contractual steps you request (Art. 6(1)(b) GDPR), and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete this data once your request has been dealt with, unless statutory retention obligations apply (see section 9).
Booking a call via Calendly
Our "Contact us" and booking buttons link to Calendly, a scheduling service of Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA. No data is sent to Calendly until you click one of these links. When you book a call, Calendly processes the details you enter (name, email address, chosen time and any answers you give) and passes them to us. Calendly acts as our processor under a data processing agreement. Calendly LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
We use booking data to schedule and prepare the call. The legal basis is pre-contractual steps at your request (Art. 6(1)(b) GDPR). If no business relationship follows, we delete booking data no later than 12 months after the call.
7. Seba AI chatbot
Seba AI (sebaagency.com/bot) is a free chatbot that answers ecommerce questions. To use it, you sign up with your email address and receive a personal access link.
What we process
- Sign-up data: first name, business name, whether you are a brand or an agency, revenue range, main bottleneck or service offered, what you would like help with, email address, and your consent choice
- Usage data: the questions you ask, the answers, your chat history, chat IDs, and any feedback you give on answers (rating and optional comment)
- Access token: a personal token stored in your browser's local storage that keeps you logged in
Please do not enter sensitive personal data (for example health data or other people's personal data) into the chat.
Purposes and legal basis
- Providing Seba AI, sending your access and login links, enforcing the daily question limit and keeping your chat history available: performance of the service you signed up for (Art. 6(1)(b) GDPR).
- Improving the quality of answers using your feedback: our legitimate interest in a useful service (Art. 6(1)(f) GDPR).
- Occasional emails from us about ecommerce growth: your consent, given with the checkbox at sign-up (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email or by writing to info@sebaagency.com.
Service providers
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: hosts our automation server (n8n.apps.sebaagency.com), which receives your sign-up data, questions and feedback.
- Anthropic, PBC, USA: generates the answers. We send your question and the most recent messages of the chat to Anthropic's API. Transfers to the USA are safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
- Notion Labs, Inc., USA: stores sign-ups and chat history. Notion Labs, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
These providers process the data on our behalf under data processing agreements (Art. 28 GDPR).
Retention
We keep your sign-up data and chat history for as long as you use Seba AI. If you ask us to delete your account, or withdraw your consent to emails, we delete the data concerned (or, for emails, add you to our unsubscribe list) within 30 days. The answers are generated automatically; no decision with legal or similarly significant effects is made about you (Art. 22 GDPR).
8. Processing for clients and business partners
TikTok Shop creator and affiliate integration
On behalf of the e-commerce sellers we work for, we operate an integration that receives data from TikTok Shop to track creator (affiliate) performance and commissions. It processes creator usernames and creator IDs, order IDs, SKU quantities and commission amounts. It does not process buyers' names, addresses, phone numbers or email addresses.
For this processing, the respective seller is the controller and Seba Agency UG (haftungsbeschränkt) acts as its processor under a data processing agreement (Art. 28 GDPR). Creators can exercise their rights with the seller or with us at info@sebaagency.com; we will forward the request and support the seller in fulfilling it.
The data is processed on our server hosted by Hetzner Online GmbH in Germany and stored in Notion (Notion Labs, Inc., USA). Transfers to the USA are based on the EU-US Data Privacy Framework (Art. 45 GDPR). The data is deleted no later than 30 days after our contract with the seller ends, unless statutory retention obligations apply.
Clients and prospects
When you contact us or become a client, we process your name, business contact details and the content of our communication to answer your request and to perform our contract (Art. 6(1)(b) GDPR), and to meet statutory retention obligations under German commercial and tax law (Art. 6(1)(c) GDPR).
9. Statutory retention periods
Where we are legally required to keep data, we keep it for the statutory period and restrict its use to that purpose. Under German commercial and tax law (§ 257 HGB, § 147 AO), business letters are kept for six years and accounting records, such as invoices, for up to ten years. The legal basis is Art. 6(1)(c) GDPR.
10. Recipients
We only share personal data where this policy describes it: with the service providers named above, who act as processors bound by our instructions, with Google as described in section 4 if you consent to Google Tag Manager, and where required by law with public authorities or professional advisers who are bound to confidentiality, such as our tax adviser. We do not sell personal data.
11. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Withdraw any consent you have given at any time, with effect for the future (Art. 7(3)). Withdrawal does not affect the lawfulness of processing before it.
Right to object (Art. 21 GDPR)
Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. You can object to the use of your data for direct marketing at any time, without giving reasons.
To exercise your rights, contact us at info@sebaagency.com.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You can also contact the authority in the EU country where you live or work.
12. Do you have to provide your data?
You are not legally or contractually required to provide personal data. Without an email address, however, we cannot give you access to Seba AI, and without contact details we cannot answer your enquiry or book a call.
13. Changes to this policy
We update this policy when our services or the law change. The current version is always available on this page, and the date at the top shows when it was last updated.
14. Information for US residents
Where we process personal information about US residents on behalf of our clients, such as US TikTok Shop creators, we act as a service provider under the California Consumer Privacy Act and similar US state laws. We use this information only to provide our services to the client, and we do not sell it or share it for cross-context behavioral advertising. US residents can send requests to access, correct or delete their information to info@sebaagency.com. We will forward the request to the relevant client and help them respond.