Privacy Policy

Sebastian (“Sebastian”, “we”, “us”, “our”) respects your privacy. This policy explains what personal data we collect, how we use and share it, and the choices and rights you have. It is written for the people who visit our website, ask us for a demo, correspond with us, or use Sebastian through their employer.

Sebastian is financial intelligence software for finance teams. It connects to a company’s accounting, planning and operating systems to maintain a current financial outlook, draft accounting work for review, and keep every figure tied to its source. Sebastian is headquartered in the United States.

1. Who this policy covers

This policy applies where Sebastian decides why and how personal data is processed, which the law calls being a “controller”. That includes our website at getsebastian.ai, demo requests and other enquiries, marketing, events, recruiting, and the account and usage information we hold about the people who use our services.

It does not apply to the financial records, documents, transactions and other content that our customers connect to or upload into Sebastian (“Customer Data”). Customer Data can include personal data about a customer’s employees, suppliers and customers. We process Customer Data only on our customer’s instructions and under the agreement we have with that customer, including its data processing terms. For Customer Data, our customer is the controller. If you have a question about personal data held in a customer’s Sebastian workspace, please contact that customer.

2. Personal data we collect

Information you give us

• Contact and enquiry information. When you request a demo, email us, or sign up for an event or newsletter, we collect your name, work email address, company, role, and anything you tell us in your message, such as the systems you run or what you want to see.
• Account information. When your employer sets up Sebastian and gives you access, we hold your name, work email address, role, workspace membership and permissions, and your sign-in details or the identity provider you sign in with.
• Support and correspondence. The content of support requests, feedback, survey responses and other messages you send us.
• Recruiting information. If you apply to work with us, your CV, application and interview notes.

Information we collect automatically

• Log data. IP address, browser and device type, operating system, the pages you open and the time you open them, and the page that referred you.
• Service usage data. When you use Sebastian, we record which features you use, the actions you take (for example, reviewing a proposed entry or approving a forecast revision), and performance information such as error reports. Approvals and reviews are recorded by name because an audit trail of who approved what is part of what Sebastian does.
• Cookies and similar technologies. We use cookies that are needed for the website and service to work, such as keeping you signed in. With your consent where the law requires it, we also use Google tags to measure how the website is used and how our advertising performs, which may set Google cookies. We do not sell data to advertising networks. You can accept or reject these cookies when you first visit, change your choice at any time using “Cookie settings” in the footer, and control cookies through your browser settings.

Information from other sources

• Business contact data from publicly available professional profiles and from data providers, limited to work contact details and role, used to understand and contact companies that may be a fit for Sebastian.
• Identity and security providers, for example the single sign-on provider your employer uses, which may share your name, email address and group membership so that we can give you access.

3. How we use personal data

We use personal data to:

• respond to demo requests and other enquiries, and arrange and prepare demos;
• provide, secure and support the Sebastian service, including authenticating users and keeping records of reviews and approvals;
• send service communications, such as notices about changes to the service, security, or this policy;
• send marketing about Sebastian’s products and events where you have agreed to it or where the law otherwise allows, with an unsubscribe link in every message;
• understand how our website and service are used so that we can improve them;
• detect, investigate and prevent fraud, abuse and security incidents;
• bill customers and manage our relationships with customers, suppliers and partners;
• consider job applications; and
• comply with the law and protect our rights and the rights of others.

We do not use Customer Data to train models that are shared across customers, and we do not use personal data for automated decisions that have legal or similarly significant effects on you.

We may aggregate or de-identify data so that it no longer identifies anyone, and use that data to study and improve the service, for research, and in published statistics. We do not try to re-identify such data.

4. Who we share personal data with

• Service providers who process data on our behalf and under contract, such as cloud hosting, email delivery, customer relationship and support tools, analytics, payment processing, and professional advisers. They may use the data only to provide their services to us.
• Your employer, where you use Sebastian through a customer workspace. The customer can see account and usage information about the people in its workspace, including the audit trail of reviews and approvals.
• Connected systems you choose. When a customer connects Sebastian to another system, such as an ERP, planning tool, CRM, document store or bank, data flows between Sebastian and that system as the customer configures. The other system’s own terms and privacy policy apply to it.
• Authorities and others where required. We may disclose personal data to comply with the law, a court order or a lawful request, to enforce our agreements, or to protect the rights, property or safety of Sebastian, our customers or others.
• A successor business. If Sebastian is involved in a merger, acquisition, financing or sale of assets, personal data may be shared in due diligence and transferred as part of that transaction. We will tell you if this changes who is responsible for your personal data.

We do not sell personal data.

5. How we keep personal data secure

We protect personal data with technical and organisational measures designed to match the sensitivity of the data, including encryption in transit and at rest, access controls and least-privilege access for our staff, logging and monitoring, and regular review of our suppliers. No system is perfectly secure, so we also maintain incident response procedures and will notify affected customers and individuals where the law requires it.

6. International data transfers

We are based in the United States and our service providers operate in the United States and other countries. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK Addendum, together with additional measures where needed. You can ask us for more information about these safeguards using the contact details below.

7. How long we keep personal data

We keep personal data only as long as we need it for the purposes in this policy. In general: demo requests and enquiries for up to two years after our last contact; account and usage information for the life of the customer relationship and a limited period after it ends, as set out in the customer agreement; records we must keep for tax, accounting, audit or legal reasons for as long as those obligations last; and recruiting information for up to one year after a decision unless you ask us to keep it longer. When data is no longer needed we delete or anonymise it, or, where that is not immediately possible, isolate it until deletion is possible.

8. Region-specific terms

European Economic Area, United Kingdom and Switzerland

We process personal data on these legal bases:

• Performance of a contract, to provide the service to the customer you work for and to respond to requests you make of us.
• Legitimate interests, to operate, secure and improve our business and service, to contact business prospects, and to protect our rights, where those interests are not overridden by yours.
• Consent, for marketing where consent is required and for non-essential cookies. You can withdraw consent at any time without affecting processing that happened before.
• Legal obligation, where we must process data to comply with the law.

You have the right to lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first.

United States

If you are a resident of California or another US state with a comprehensive privacy law, the categories of personal data we collect are identifiers, professional information, commercial information, internet activity information and inferences drawn from them, for the purposes and with the recipients described above. We do not sell personal data and we do not share it for cross-context behavioural advertising. We do not use or disclose sensitive personal information other than as permitted by law. You can exercise the rights described in section 10, and we will not discriminate against you for doing so. If we deny a request, you may appeal by contacting us.

9. Children

Our website and service are for businesses and professionals. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.

10. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• have your data deleted;
• restrict or object to certain processing, including direct marketing, which you can also stop with the unsubscribe link in any marketing email;
• receive your data in a portable format; and
• withdraw consent where processing is based on consent.

To exercise these rights, contact us using the details below. We may need to verify your identity before responding. If your request concerns Customer Data held in an employer’s workspace, we will refer it to that customer and support them in responding.

11. Changes to this policy

We will update this policy when our practices or the law change. The date at the top shows when it was last revised. For material changes we will give notice on our website or, where appropriate, by email.

12. How to contact us

Questions, requests and complaints about privacy can be sent to privacy@getsebastian.ai. For anything else, write to gtm@getsebastian.ai.