Privacy Policy

This Privacy Policy describes how Sellium ("we", "us", "our") collects, uses, and shares personal information when you use the Sellium platform, website, and related services (the "Service"). We are committed to protecting your privacy and complying with applicable data protection laws including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

1. Who We Are

Sellium is a software-as-a-service (SaaS) platform providing e-commerce, marketing, and AI tools to direct-to-consumer brands. For the purposes of data protection law, Sellium acts as:

• Data Controller for personal data of our direct customers (e.g., business owners who sign up for Sellium).
• Data Processor for personal data of our customers' end users (e.g., shoppers on tenants' storefronts), processed on behalf of our customers.

2. Information We Collect

Information you provide directly

• Account information: name, business name, email, password (hashed), subscription plan.
• Billing information: payment card details (processed and stored by Stripe, not by us), billing address.
• Content: products, images, ad copy, customer data you upload, messages you send via our platform.
• Support requests: correspondence with our support team.

Information collected automatically

• Usage data: pages visited, features used, timestamps, clickstream data.
• Device and browser data: IP address, browser type, operating system, device identifiers.
• Cookies and similar technologies: session cookies, authentication tokens, analytics cookies.
• AI usage logs: prompts submitted, tokens consumed, costs, model used (retained for billing and abuse-prevention purposes).

Information from third parties

• Authentication providers (if you sign in with a third-party identity).
• Payment processors confirming successful charges.
• Ad platforms (Meta, Google, TikTok) when you connect your accounts, for purposes of campaign management and attribution.

3. How We Use Information

• Provide, maintain, and improve the Service.
• Process payments and manage subscriptions.
• Generate AI content (ad copy, videos, landing pages) at your request.
• Send transactional emails (welcome, password reset, invoices, trial expiry).
• Send product updates and marketing emails (opt-out available at any time).
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations (tax, accounting, law enforcement requests).
• Aggregate usage data for analytics, research, and improving the Service (in anonymized form where possible).

4. Legal Bases for Processing (GDPR)

• Contract: to provide the Service you have subscribed to.
• Legitimate interest: to protect our business, prevent fraud, and improve our offering.
• Consent: for marketing emails, optional cookies, and certain data processing you have opted into.
• Legal obligation: to comply with tax, regulatory, and law-enforcement requirements.

5. Subprocessors (Who We Share Data With)

We use the following third-party service providers ("subprocessors") to operate the Service. They are contractually bound to protect your data:

We do not sell your personal information to third parties.

6. International Data Transfers

Some of our subprocessors are located outside the European Economic Area (EEA) or the United Kingdom. When we transfer personal data outside of these regions, we rely on Standard Contractual Clauses (SCCs), adequacy decisions, or other legal transfer mechanisms as required by GDPR.

7. Data Retention

• Account data: retained while your account is active and for 90 days after cancellation.
• Billing records: retained for 7 years for tax and legal compliance.
• AI usage logs: retained for 12 months for billing reconciliation and abuse detection.
• Marketing data: retained until you opt out or request deletion.
• Customer data uploaded by you: retained while you use the Service, exportable for 30 days after cancellation, then deleted.

8. Your Rights

Subject to applicable law, you have the following rights regarding your personal information:

• Access: request a copy of the data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion of your data, subject to legal retention requirements.
• Portability: receive your data in a machine-readable format for transfer to another service.
• Restriction: limit how we process your data in certain circumstances.
• Objection: object to processing based on legitimate interest, including direct marketing.
• Withdraw consent: where processing is based on consent, withdraw it at any time.
• Complain: file a complaint with your local data protection authority.

California residents (CCPA/CPRA): You have the right to know what personal information we collect; the right to delete personal information; the right to correct inaccurate personal information; the right to limit the use of sensitive personal information; and the right to opt out of the sale or sharing of your personal information. Sellium does not sell or share your personal information as those terms are defined under CCPA/CPRA. We do not process your data for cross-context behavioral advertising purposes without your explicit consent.

To exercise any of these rights, email us at [email protected] with the subject line "Data Subject Request" and include enough information for us to verify your identity. We will respond within 30 days (GDPR) or 45 days (CCPA, with possible 45-day extension). You also have the right to not be retaliated against for exercising your privacy rights.

Business customers: if you need a signed Data Processing Addendum (DPA), see our DPA page or email [email protected].

9. Cookies

We use cookies and similar technologies for:

• Essential cookies: authentication, session management, security. Required for the Service to function.
• Functional cookies: remember your preferences (theme, plan selection).
• Analytics cookies: understand how the Service is used (aggregated and anonymized where possible).
• Marketing cookies: used by our ad platform integrations with your consent.

You can manage cookie preferences anytime using the Cookie preferences link in our footer, or via your browser settings. Essential cookies cannot be disabled because they are required for the Service to function. Optional analytics and marketing cookies are off by default until you explicitly consent.

10. Security

We implement reasonable technical and organizational measures to protect your data, including:

• Encryption in transit (TLS 1.2+) and at rest;
• Strong authentication (SHA-256 password hashing, rate limiting);
• Network security (Cloudflare DDoS protection, WAF);
• Access controls (role-based access, least-privilege principle);
• Regular security audits and vulnerability scanning.

No system is 100% secure. We will notify you of data breaches affecting your personal information without undue delay as required by applicable law.

11. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we learn we have collected such data, we will delete it.

12. AI and Automated Processing

The Service uses AI (Anthropic Claude, Creatify, and similar providers) to generate content at your request. AI-generated outputs may contain errors or reflect biases in training data. We do not use your private data to train third-party AI models. Your prompts and generated content are processed by our AI subprocessors subject to their privacy terms.

13. Third-Party Platform Connections

Sellium lets you connect third-party platforms (Meta/Facebook/Instagram, Google Ads, TikTok, Cloudflare, Stripe, and similar) to the Service so we can manage campaigns and infrastructure on your behalf from your Sellium dashboard.

What we access when you connect Meta (Facebook & Instagram)

When you authorize Sellium to connect your Meta account, we request the following permissions and use them strictly to provide the Service:

• ads_management — to create, update, pause, and resume advertising campaigns, ad sets, and ads that you explicitly configure in Sellium's Ad Manager module. We only act on campaigns you have created or selected in our dashboard.
• ads_read — to read campaign insights (spend, impressions, clicks, conversions, reach) and populate the performance dashboards and daily digest email you subscribed to. Strictly read-only.
• pages_manage_ads — to associate your ads with the Facebook Page you selected as the placement. We never post content to your Page feed without your explicit action.
• business_management — to identify the Business Manager account you connected so we scope ad operations to the correct ad accounts. We never modify business-level settings.

Data retrieved from Meta is stored in our database only as long as your subscription is active and strictly to power features you use in the Service. It is never sold, shared with data brokers, or used for purposes beyond what you authorized. You can revoke Sellium's access at any time from your Facebook account at Settings → Business Integrations, or by disconnecting the integration in your Sellium dashboard. Revoking access causes Sellium to stop pulling new data; previously-retrieved data is deleted as described in the "Data Deletion" section below.

Comparable handling applies to Google Ads, TikTok, Cloudflare, and Stripe connections — see the subprocessor table in Section 5 for a full list.

14. Data Deletion

You can request deletion of your personal data — including data Sellium has obtained from connected third-party platforms (Meta/Facebook/Instagram, Google, TikTok, etc.) — at any time.

How to request deletion: email [email protected] with the subject line "Data Deletion Request". Include the email address associated with your Sellium account and, if applicable, the tenant or store name. We will verify your identity and complete the deletion within 14 days, then send you a confirmation email.

What gets deleted:

• Your Sellium account, authentication records, and all personal information we hold about you.
• All data obtained from any connected Meta / Facebook / Instagram accounts (campaigns, insights, ad account metadata) as stored in our systems.
• Comparable data from any other connected third-party platform.
• Uploaded content, AI-generated assets, and messaging history associated with your account.

Retention exceptions: We retain billing records for 7 years as required by tax and financial regulations. Anonymized aggregate analytics may be retained indefinitely as they no longer identify you. Security logs may be retained for up to 90 days for abuse-prevention purposes.

Automatic deletion on account closure: If you cancel your Sellium subscription, your uploaded content and third-party platform data are exportable for 30 days, then automatically deleted within 90 days.

15. Sellium Cookie Sync browser extension

Sellium offers an optional browser extension named "Sellium Cookie Sync" that synchronises your Outbrain dashboard session to your Sellium account so that Sellium's Ad Manager can publish and manage your Outbrain advertising campaigns on your behalf without requiring you to manually copy and paste cookies from your browser's developer tools every 12 hours.

Data the extension handles. When you have paired the extension to your Sellium account and you are logged in to my.outbrain.com in your browser, the extension reads only two cookies from my.outbrain.com — ob-session-token and ob-ajax-csrf-token — and transmits their values to your Sellium account over HTTPS to sellium.app. These cookies authenticate your existing Outbrain dashboard session; the extension does not read passwords, payment details, or any other credentials, and does not read cookies from any host other than my.outbrain.com. The cookies are stored encrypted at rest in Sellium's database (AES-256-GCM, scoped to your tenant and Outbrain marketer) and are only used to make authenticated calls to my.outbrain.com on your behalf as part of Sellium's Ad Manager features.

Data stored locally by the extension. The extension stores in chrome.storage.local on your device only: your Sellium pairing token (a random, account-specific bearer issued by Sellium when you redeem a pairing code), a stable install identifier, and sync metadata (timestamps and success/error status used to render the extension's popup). The extension does not store your browsing history, personal data, or any third-party data.

Telemetry, analytics, advertising. The extension contains no third-party analytics, no telemetry, and no advertising. It makes network requests only to Sellium's pairing and sync endpoints — no other hosts.

Your controls.

• Unpair — open the extension popup and click "Unpair". This removes the pairing token from local storage and revokes the token server-side; the extension will no longer sync anything until you pair again.
• Revoke from Sellium — open your Sellium account → Ad Manager → 🍪 Session → find the device in the "Browser Extension" section → click "Revoke". This invalidates the pairing token server-side so it can no longer authenticate, even if a copy still exists in local storage.
• Uninstall — remove the extension from your browser. All local-storage data is wiped automatically.

Limited Use disclosure. The Sellium Cookie Sync extension's use of information received from Google APIs (where applicable for Chrome Web Store distribution) adheres to the Chrome Web Store Limited Use Policy. The data described above is used only to provide the user-facing feature of cookie syncing; it is not transferred to third parties (other than to provide or improve the feature), not used or transferred for serving advertisements, and not read by humans except as required for support, legal compliance, or to perform privileged operations in aggregate with the user's consent.

Source code and security disclosures. Sellium Cookie Sync is built and maintained by Sellium. For security disclosures regarding the extension, contact [email protected].

16. Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated by email or in-product notice at least 30 days before taking effect. The "Last updated" date at the top reflects the most recent version.

17. Contact Us

Questions or requests regarding your privacy:

• Privacy email: [email protected]
• General support: [email protected]
• Data Protection Officer: [email protected] (for GDPR inquiries)