Privacy Policy
Last updated: March 2026 — This privacy policy informs you about the nature, scope, and purpose of the processing of personal data on ebai.ninja, in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
Courtesy translation. This English version is provided for convenience only. The German version available at /datenschutz.html is the legally binding text. In case of any discrepancy between the two, the German version prevails.
Table of Contents
- Controller
- Data Protection Officer
- Legal Bases for Processing
- Account and Registration Data
- Local Storage (localStorage / Tokens)
- eBay OAuth Connection
- Payment Processing (Stripe)
- AI Analysis (AWS Bedrock / Claude)
- Price Research (SerpAPI)
- Email Communication (AWS SES)
- Cloud Infrastructure (AWS)
- Storage Duration and Deletion
- Your Rights as a Data Subject
- Data Transfers to Third Countries
- Changes to this Privacy Policy
- Right to Lodge a Complaint with the Supervisory Authority
1. Controller
The controller within the meaning of the DSGVO (GDPR) responsible for the processing of your personal data is:
Cedric F. Jacob und Piet Jacob GbR
Markt 35
53721 Siegburg
Germany
Email: contact@ebai.ninja
Phone: to follow
2. Data Protection Officer
A data protection officer is not required by law. If you have any questions about data protection, please contact us directly at contact@ebai.ninja.
3. Legal Bases for Processing
We process your personal data on the basis of the following legal grounds:
- Art. 6 (1) (a) DSGVO — Consent
- Art. 6 (1) (b) DSGVO — Performance of a contract and pre-contractual measures
- Art. 6 (1) (c) DSGVO — Compliance with a legal obligation
- Art. 6 (1) (f) DSGVO — Legitimate interests of the controller or a third party
4. Account and Registration Data
When you register and use ebai.ninja, we collect the following personal data:
- First name and last name
- Email address
- Address (optional)
- Country
- VAT ID (optional, for commercial users)
- Subscription plan and billing history
- Configured search terms and settings (so-called "robots")
- eBay listings found and calculated profit margins
Legal basis: Art. 6 (1) (b) DSGVO (performance of a contract). The provision of first name, last name, email address, and country is required for the use of the service. All other information is voluntary.
Storage location: AWS DynamoDB (eu-central-1 region, Frankfurt).
5. Local Storage (localStorage / Tokens)
To maintain your login session, we store an authentication token
exclusively in your browser's localStorage. This token is used to identify you
as a logged-in user and to maintain your session.
- Stored value: Session token (opaque string)
- Purpose: Authentication and session management
- Storage location: Exclusively local in the browser (no tracking cookie)
- Deletion: Upon logout or manually via browser settings
We do not use any cookies for tracking or analytics purposes. No third-party tracking scripts are embedded.
Legal basis: Art. 6 (1) (b) DSGVO (performance of a contract, technically necessary session management).
6. eBay OAuth Connection
Upon request, you can connect your eBay account with ebai.ninja. In doing so, a standardized OAuth 2.0 procedure is used. We store the following:
- eBay OAuth Access Token (encrypted)
- eBay OAuth Refresh Token (encrypted)
- Validity period of the tokens
- eBay user identifier (for assignment to your account)
We do not store your eBay password at any time. The tokens are used exclusively to retrieve eBay marketplace data (listings, prices, categories) within the scope of the service. Purchases, bids, or other transactional actions are not carried out unless you explicitly activate them.
You can revoke the eBay connection at any time in your ebai.ninja settings or directly in your eBay account settings.
Legal basis: Art. 6 (1) (b) DSGVO (performance of a contract).
eBay's privacy policy: ebay.de/help/policies/datenschutzhinweis
7. Payment Processing (Stripe)
Payment processing for subscriptions is handled by the payment service provider Stripe, Inc. (354 Oyster Point Blvd, South San Francisco, CA 94080, USA). Stripe acts as an independent controller for payment processing.
We transmit the following data to Stripe:
- Name and email address
- Billing address
- Subscription plan and amount
- VAT ID (if provided)
Credit card data are not stored by ebai.ninja at any time. This data is processed exclusively via Stripe's secure infrastructure.
On our side, we store:
- Stripe Customer ID (for assignment of the subscription)
- Stripe Subscription ID
- Payment status and billing periods
Legal basis: Art. 6 (1) (b) DSGVO (performance of a contract). For tax-law retention obligations: Art. 6 (1) (c) DSGVO.
Stripe's privacy policy: stripe.com/de/privacy
8. AI Analysis (AWS Bedrock / Claude)
For the analysis of eBay listings and the extraction of individual parts, we use the AI service AWS Bedrock (Amazon Web Services, Anthropic Claude models), operated in the AWS region eu-central-1 (Frankfurt).
Data transmitted to AWS Bedrock includes:
- Title, description, and category information of eBay listings
- URLs of product photos of the respective eBay listings
No personal data of you (name, email, address, etc.) is transmitted to AWS Bedrock. The content processed consists exclusively of publicly accessible eBay marketplace data.
Legal basis: Art. 6 (1) (b) DSGVO (performance of a contract) as well as Art. 6 (1) (f) DSGVO (legitimate interest in providing the core service).
AWS data protection information: aws.amazon.com/de/compliance/gdpr-center
9. Price Research (SerpAPI)
To determine market prices for extracted individual parts, we use the service SerpAPI (SerpApi LLC, 16192 Coastal Highway, Lewes, Delaware, USA).
Data transmitted to SerpAPI:
- Search terms (product designations and part names from the AI analysis)
No personal data is transmitted to SerpAPI.
Legal basis: Art. 6 (1) (b) DSGVO (performance of a contract).
SerpAPI's privacy policy: serpapi.com/privacy
10. Email Communication (AWS SES)
The sending of transactional emails (e.g., login codes, notifications about found listings, billing information) is carried out via Amazon Simple Email Service (SES), operated in the AWS region eu-central-1 (Frankfurt).
Processed data:
- Your email address (recipient address)
- Content of the respective transactional email
- Time of dispatch and delivery status
We do not send promotional emails without your express consent.
Legal basis: Art. 6 (1) (b) DSGVO (performance of a contract, e.g., for login codes and billing notifications). For optional notifications about new listings: Art. 6 (1) (a) DSGVO (consent, which you grant in the settings and can revoke at any time).
11. Cloud Infrastructure (AWS)
ebai.ninja is operated entirely on the infrastructure of Amazon Web Services (AWS). All core services (database, backend logic, file storage, API gateway) are located in the AWS region eu-central-1 (Frankfurt, Germany).
We have concluded a data processing agreement (Data Processing Addendum) with AWS pursuant to Art. 28 DSGVO.
AWS DSGVO information: aws.amazon.com/de/compliance/gdpr-center
12. Storage Duration and Deletion
We store your personal data only for as long as is necessary for the respective purpose or as long as statutory retention obligations exist:
- Account data: For the duration of your use of ebai.ninja. After termination or deletion of your account, your data will be deleted within 30 days, unless statutory retention obligations preclude this.
- Billing data: In accordance with the tax-law retention obligation (§ 147 of the German Fiscal Code (AO)) for 10 years from the end of the financial year.
- Session tokens (localStorage): Until logout or manual deletion by you.
- eBay OAuth tokens: Until the eBay connection is disconnected in the settings or until revoked at eBay.
- eBay listing data and AI analysis results: For the duration of your subscription. After account deletion, within 30 days.
- Email logs: Dispatch logs are retained for up to 90 days for diagnostic purposes.
13. Your Rights as a Data Subject
Under the DSGVO, you have the following rights with regard to your personal data:
Right of access (Art. 15 DSGVO)
You have the right to request confirmation as to whether we process personal data relating to you, and to obtain information about that data.
Right to rectification (Art. 16 DSGVO)
You may request the rectification of inaccurate personal data, or the completion of incomplete personal data. You can edit much of your data directly in your account settings.
Right to erasure (Art. 17 DSGVO)
You have the right to request the erasure of your personal data, provided that no statutory retention obligations preclude this. You can delete your account at any time in the settings.
Right to restriction of processing (Art. 18 DSGVO)
Under certain conditions, you can request the restriction of the processing of your data.
Right to data portability (Art. 20 DSGVO)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON/CSV) and to transmit it to another controller. To request a data export, please contact contact@ebai.ninja.
Right to object (Art. 21 DSGVO)
Insofar as we process your data on the basis of legitimate interests (Art. 6 (1) (f) DSGVO), you have the right to object.
Right to withdraw consent
Insofar as a data processing is based on your consent (Art. 6 (1) (a) DSGVO), you may withdraw it at any time with effect for the future, without affecting the lawfulness of processing carried out up to the time of withdrawal.
To exercise your rights, please contact: contact@ebai.ninja. We will process your request within 30 days.
14. Data Transfers to Third Countries
Some of the service providers we use (in particular Stripe and SerpAPI) are located in the USA. The transfer of data to the USA takes place on the basis of:
- Adequacy decision of the EU Commission (EU-U.S. Data Privacy Framework), insofar as the respective provider is certified, or
- Standard Contractual Clauses (SCCs) pursuant to Art. 46 (2) (c) DSGVO.
All other data processing operations (AWS core services, SES, Bedrock) take place exclusively in the EU region Frankfurt (eu-central-1) and are not subject to any transfer to a third country.
15. Changes to this Privacy Policy
We reserve the right to amend this privacy policy as necessary, in order to adapt it to changes in the legal situation or to changes in our service. In the event of material changes, we will inform you by email and/or by means of a prominent notice in the dashboard. The date of the last update is indicated above.
16. Right to Lodge a Complaint with the Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, your place of work, or the place of the alleged infringement, if you consider that the processing of your personal data infringes the DSGVO.
Competent supervisory authority for the controller:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestr. 2-4, 40213 Düsseldorf
www.ldi.nrw.de
A list of all German data protection supervisory authorities can be found at: bfdi.bund.de