Privacy Policy – Stock AI (WhatsApp Order Desk)
Last updated: 13 October 2026
This privacy policy explains how Seba Agency UG (haftungsbeschränkt) processes personal data through Stock AI, our WhatsApp-based order management service for wholesale businesses. It covers only Stock AI. For our website, see our general privacy policy.
1. Who we are
Seba Agency UG (haftungsbeschränkt)
Mutschellestr. 4
81673 München, Germany
Commercial register: HRB 293039 (Amtsgericht München)
Email: info@sebaagency.com
2. What Stock AI does
Stock AI connects to a business's WhatsApp Business Account through the official WhatsApp Business Platform (Cloud API), provided by Meta. It reads incoming order messages (text, images, voice memos and catalog orders) and turns them into structured orders. It then supports the wider order process: order confirmations, stock reservation, delivery notes, delivery confirmation and invoice drafts in the business's accounting software.
3. Our role: controller and processor
- Businesses that use Stock AI (our clients): For their account data, we are the controller.
- Our clients' customers (people who send orders via WhatsApp): Our client, the wholesale business, is the controller for this data. We process it on their behalf as a processor under a data processing agreement (Art. 28 GDPR). If you are a customer of a business that uses Stock AI, that business is your main contact for privacy questions. You can also contact us, and we will forward your request.
4. Data we process
4.1 Data from Meta / WhatsApp (via Embedded Signup)
When a business connects its WhatsApp account, Meta provides us with:
- Business portfolio ID, WhatsApp Business Account ID, phone number ID and display name
- An access token that lets Stock AI send and receive messages for that number
- Basic profile information of the person who completes the connection (name, and email if granted)
We use the permissions whatsapp_business_messaging and whatsapp_business_management only to operate Stock AI for the connected business.
4.2 Message and order data
- Sender phone number and WhatsApp profile name
- Message content: text, images and screenshots, voice memos, catalog order payloads
- Timestamps and message status (sent, delivered, read)
- Text derived from messages: transcripts of voice memos and text extracted from images
- Order data: products, quantities, delivery dates, confirmations and corrections
4.3 Business and delivery data
- Customer records: customer number, business name, contact numbers, opening hours, invoicing preferences
- Customer-specific prices and order history
- Delivery notes, delivery confirmations, and photos taken as proof of delivery
- Invoice data passed to the business's accounting software
We do not knowingly process special categories of personal data (Art. 9 GDPR).
5. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing Stock AI to our clients (account, connection, operation) | Art. 6(1)(b) GDPR – contract |
| Processing orders, confirmations, deliveries and invoices on behalf of our clients | Art. 28 GDPR – on the client's documented instructions; the client's own legal basis is usually Art. 6(1)(b) (contract with its customer) |
| Keeping raw messages and logs to ensure no order is lost and to resolve disputes | Art. 6(1)(f) GDPR – legitimate interest in reliable, traceable order handling |
| Improving order recognition for the same client (e.g. learning that a customer's wording refers to a specific product) | Art. 6(1)(f) GDPR / on the client's instructions. Learned data is used only for that client's account. |
| Meeting legal retention duties (e.g. commercial and tax records) | Art. 6(1)(c) GDPR – legal obligation |
We do not:
- sell personal data
- use message content for advertising or profiling
- use one client's data to serve another client
- use client data to train general-purpose AI models
6. Automated processing
Stock AI uses AI models to read and interpret messages. Orders are suggested automatically. Uncertain items are flagged to the business for review, and the business can correct or cancel any order. Stock AI makes no decisions with legal or similarly significant effects on individuals within the meaning of Art. 22 GDPR.
7. Service providers (processors and recipients)
We use the following categories of service providers to run Stock AI. Each is bound by a data processing agreement (Art. 28 GDPR) or equivalent terms and may use the data only to provide its service to us.
| Recipient | Purpose |
|---|---|
| Meta Platforms Ireland Ltd. (WhatsApp Business Platform) | Sending and receiving WhatsApp messages |
| Hosting and database providers | Running the application and storing data |
| AI and language model providers | Interpreting message content and extracting order details |
| Speech-to-text providers | Transcribing voice memos |
| Email delivery providers | Sending delivery notes to customers |
| The client's accounting software (e.g. sevDesk) | Receiving delivery notes and invoice drafts on the client's instruction |
Clients can request a current list of named providers at any time at info@sebaagency.com. We inform clients before adding or replacing a provider that processes their data.
8. Transfers outside the EU
Some providers may process data outside the EU/EEA, in particular in the USA. Where this happens, we rely on an adequacy decision (e.g. the EU-U.S. Data Privacy Framework for certified providers) or on EU Standard Contractual Clauses (Art. 46 GDPR).
9. How long we keep data
We keep personal data only as long as needed for the purposes in section 5. We use these criteria:
| Data | How long we keep it |
|---|---|
| Raw messages, voice memos and images | Until the related order is delivered and invoiced and any dispute period has passed. They are then deleted or the client can choose a shorter period. |
| Transcripts, order and delivery records | As long as the client's account is active, plus any statutory retention period that applies (up to 10 years for accounting-relevant records under German commercial and tax law) |
| Delivery photos | Until the related delivery can no longer reasonably be disputed |
| Access tokens and connection data | Until the business disconnects WhatsApp or ends the service |
Clients can set shorter retention periods for their own data. When a client ends the service, we delete or return their data within 30 days, unless the law requires us to keep it.
10. Disconnecting and deleting data
Businesses can disconnect Stock AI at any time:
- in Meta Business Settings, under Accounts → WhatsApp accounts, by removing our app's access, or
- by emailing info@sebaagency.com.
To request deletion of all data, email info@sebaagency.com with the subject "Stock AI data deletion" and the connected WhatsApp number. We confirm deletion within 30 days.
Customers of a business using Stock AI can ask that business to delete their data, or contact us directly. We will coordinate with the business.
11. Your rights
Under the GDPR you have the right to:
- access your data (Art. 15)
- correct your data (Art. 16)
- have your data deleted (Art. 17)
- restrict processing (Art. 18)
- receive your data in a portable format (Art. 20)
- object to processing based on legitimate interest (Art. 21)
Send requests to info@sebaagency.com.
You also have the right to lodge a complaint with a supervisory authority. Ours is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany – www.lda.bayern.de
12. Security
We protect data with encryption in transit (TLS), access controls, separation of each client's data at database level, and logging of automated actions. Access tokens are stored encrypted.
13. Changes
We may update this policy when Stock AI changes. The date at the top shows the latest version. We notify clients of material changes in advance.
14. Contact
Questions about this policy: info@sebaagency.com