Privacy Policy
Last updated: March 2026
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Sebastian Brenner
Liebherrstraße 2
87509 Immenstadt i. Allgäu, Bavaria, Germany
Email: contact@sebb.pro
Website: https://sebb.pro
2. General
When visiting sebb.pro, certain personal data (in particular IP addresses) are processed for technical reasons. This privacy policy informs you about which data are collected, for what purpose, on which legal basis, and what rights you have.
Personal data are processed exclusively in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
3. Hosting — Vercel
This website is hosted by:
Vercel Inc.
440 N Barranca Avenue #4133
Covina, CA 91723, USA
When you access this website, your browser automatically transmits technical connection data to the hosting provider. These server logs contain:
- IP address of the requesting device
- Date and time of the request
- URL accessed
- HTTP status code and data volume transmitted
- Browser type and operating system (User-Agent)
This data is technically necessary to deliver the website and is automatically deleted after a short period. It is not merged with other data sources.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and uninterrupted operation of the website).
Vercel processes data in the USA and is certified under the EU-US Data Privacy Framework (DPF). A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Vercel.
Further information: Vercel Privacy Policy · Vercel DPA
4. DNS Management — Cloudflare
DNS resolution for the domain sebb.pro is handled by Cloudflare:
Cloudflare, Inc.
101 Townsend St.
San Francisco, CA 94107, USA
Cloudflare is used exclusively for DNS resolution. Traffic to this website is not routed through the Cloudflare network (no proxy mode). Cloudflare therefore does not process visitor data such as IP addresses. Only DNS queries technically necessary for domain name resolution are processed.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a reachable domain).
Cloudflare is certified under the EU-US Data Privacy Framework (DPF). A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Cloudflare.
Further information: Cloudflare Privacy Policy · Cloudflare DPA
5. Error Monitoring — Sentry
To detect and resolve technical errors, Sentry is used:
Functional Software, Inc. (Sentry)
45 Fremont Street, 8th Floor
San Francisco, CA 94105, USA
Sentry automatically captures error messages that occur in the browser. The following data may be processed:
- Browser type and version, and operating system
- URL path accessed at the time of the error (query parameters are stripped before the event is sent)
- Error message and technical stack trace
Sentry is configured for data minimisation: sendDefaultPii is disabled, so IP address and approximate geographic location are not collected, Session Replay is not used, and URL query parameters are removed before any event is transmitted.
This data is used exclusively for error diagnosis and resolution.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technical quality assurance of the website).
A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Sentry.
Further information: Sentry Privacy Policy · Sentry DPA
6. Contact by Email
If you contact us by email (contact@sebb.pro), your email address and any personal data contained in the message will be processed to handle your enquiry.
Emails are received and stored via Zoho Mail (Zoho Corporation Pvt. Ltd.). The EU data centre location is configured in our Zoho account; a data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Zoho.
Your data will be used solely to handle your enquiry and will be deleted once the matter is resolved, unless statutory retention obligations (e.g. under commercial or tax law) apply.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in processing incoming enquiries); Art. 6(1)(b) GDPR where the enquiry relates to the conclusion of a contract.
7. Contact Form
You can get in touch via a form on the /contact page. The following details are processed:
- Name
- Email address
- Phone number (optional)
- Message (optional)
- Preferred contact channel (email or phone)
- The area your enquiry relates to (e.g. which offering), for easier routing
These details are not stored in a database. They are transmitted solely as a notification email to our inbox so that we can respond to your enquiry. The subsequent handling of that email is governed by Section 6 (Contact by Email).
Optional signup for product updates: In the contact form you can additionally — voluntarily and independently of your enquiry — consent to receive occasional news from sebb.pro by email ("Keep me posted"). Only if you actively tick this box is your email address added to our general updates list; the processing of that signup is governed by Section 8 (Waitlist and Product Updates). Without this consent, we use your details solely to respond to your enquiry.
To prevent abuse (rate limiting), your IP address is additionally processed — solely as a non-traceable SHA-256 hash, never in plain text. The hash is stored for a maximum of 1 hour and is used solely to detect and block an excessive number of form submissions from the same address.
The technical implementation of rate limiting uses the service Upstash (Upstash, Inc., a Delaware corporation, USA). The hashed value of your IP address is stored exclusively in a Redis database at the data-center location Frankfurt am Main (region eu-central-1, Germany). A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Upstash; as Upstash is a US company, any third-country element is additionally safeguarded by the European Commission's Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR.
Legal basis: Art. 6(1)(b) GDPR where your enquiry is directed at initiating or concluding a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in handling incoming enquiries). Processing the hashed IP address for abuse prevention is also based on Art. 6(1)(f) GDPR. The privacy policy is linked and your consent to processing for the purpose of handling the enquiry is obtained before submission.
The notification email is sent via the service provider Resend:
Resend (Plus Five Five, Inc.)
2261 Market Street #5039
San Francisco, CA 94114, USA
On our behalf, Resend sends the notification email containing the details you provided (in particular name, email address, and message content) along with technical sending and delivery information. Resend processes data in the USA. The data transfer is safeguarded by the EU-US Data Privacy Framework (DPF) and/or the European Commission's Standard Contractual Clauses (SCC). A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Resend.
Further information: Resend Privacy Policy · Resend DPA
8. Waitlist and Product Updates (AI Business OS and general sebb.pro updates)
You can join interest or update lists — on the /services/ai-business-os page for updates about the AI Business OS product, or optionally via the contact form (Section 7) for general news from sebb.pro. The following applies equally to all of these lists.
Scope of Data Processing
When you sign up, we process the following data:
- Email address — to send you the confirmation email and any subsequent communications
- Classification attribute — a value from a fixed list: either your self-classification (e.g. "Freelancer / consultant") or the area your signup came from (e.g. the offering on the originating page), to better categorize interested parties
- Consent text — the exact wording you agreed to at signup
- Timestamp of consent — when you gave your consent
- IP address (hashed only) — for abuse prevention (rate limiting). Your IP address is never stored in plain text; only a non-reversible SHA-256 hash is stored. This hash is deleted within 2 hours.
Legal Basis
Processing is based on your consent pursuant to Art. 6(1)(a) GDPR. Consent is verified through a double opt-in process:
- You enter your email address and agree to the displayed consent text.
- You receive a confirmation email with a verification link.
- Your signup only becomes effective after you click the verification link.
You will only receive updates about other sebb.pro products if you additionally activated the corresponding optional consent.
Withdrawal of Consent
You may withdraw your consent at any time by using the unsubscribe link included in every email (Art. 7(3) GDPR). The unsubscribe link never expires.
Upon withdrawal, your email address is immediately deleted. To prevent accidental re-registration, a non-reversible hash of your email address is retained. Your email address cannot be recovered from this hash (Art. 17 GDPR).
Retention Periods
| Data | Retention |
|---|---|
| Unconfirmed signups | Automatically deleted after 7 days |
| Confirmed signups | Until consent is withdrawn (unsubscribe) |
| IP hash (rate limiting) | Automatically deleted after 2 hours |
| Email hash (after unsubscribe) | Indefinite (non-personal data) |
Data Processors
The following third-party processors are used to operate the list:
| Provider | Purpose | Location | Legal Basis for Transfer |
|---|---|---|---|
| Resend, Inc. | Email delivery (confirmation and informational emails) | USA | Standard Contractual Clauses (SCCs) per Art. 46(2)(c) GDPR, EU-U.S. Data Privacy Framework |
| Supabase, Inc. | Database storage of signup data | USA | Standard Contractual Clauses (SCCs) per Art. 46(2)(c) GDPR, EU-U.S. Data Privacy Framework |
Data Processing Agreements (DPAs) are in place with both providers. Your data is transferred to and processed in the United States (Art. 44 et seq. GDPR); transfers are safeguarded by EU Commission Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.
9. Web Analytics (planned — not yet active)
The use of web analytics tools is planned. Once a service is activated, this privacy policy will be updated accordingly.
10. Cookies
This website does not use tracking, marketing, or analytics cookies.
Hosting services (Vercel, Cloudflare) may set short-lived session cookies or similar mechanisms as part of their technical infrastructure that are technically necessary for the secure and functional operation of the website. These do not contain personal data and are not used for advertising purposes.
As only technically necessary cookies are used, a cookie consent banner is currently not required.
11. Your Rights as a Data Subject
As a data subject, you have the following rights against the controller:
- Right of access (Art. 15 GDPR): You may request information about the personal data we process.
- Right to rectification (Art. 16 GDPR): You may request correction of inaccurate or incomplete data.
- Right to erasure (Art. 17 GDPR): You may request deletion of your data, provided no statutory retention obligations apply.
- Right to restriction of processing (Art. 18 GDPR): You may request restriction of processing under certain conditions.
- Right to data portability (Art. 20 GDPR): You may request your data in a structured, machine-readable format.
- Right to object (Art. 21 GDPR): You may object to processing where it is based on Art. 6(1)(f) GDPR (legitimate interest).
To exercise your rights, please contact us by email: contact@sebb.pro
12. Right to Lodge a Complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the competent data protection supervisory authority:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27
91522 Ansbach, Germany
Tel.: +49 (0) 981 53 1300
Email: poststelle@lda.bayern.de
Website: https://www.lda.bayern.de
13. Currency and Changes
This privacy policy is current as of March 2026. As this website develops or legal requirements change, updates may be necessary. The current version is always available at https://sebb.pro/privacy.