SB Commerce · United States. Version 1.0. Last updated October 19, 2026.
The short version.
We keep what your company needs to run on SB Commerce. Your data is yours. We don't sell it, we don't use it for advertising, and we don't share it with anyone who isn't needed to provide the service. If you connect a mailbox to your AI agents, only the emails that match the filters you set come into SB, and you can disconnect it at any time.
SB Commerce (the "Platform") is operated in the United States by LEZAG INC, a Delaware corporation, located at 22105 Corbett Road, Bayside, New York, 11361, United States ("we" or "us"). This policy explains what information we collect, what we use it for, and the control you have over it. It complements our Terms and Conditions.
About your company. Legal name, tax ID, address, business contact details, the plan you subscribe to, and its billing.
About the people who use the account. Name, email, role, language, and time zone. Passwords are stored with a one-way hash, so no one, including us, can read them.
Your business information. Products, inventory, warehouses, orders, purchases, invoices, receivables, customers and vendors, and everything you upload or generate while operating. For this information we act as a service provider, on your company's behalf and following its instructions.
Your integration credentials. The keys and permissions you use to connect your accounting system, sales channels, carriers, payment processors, and mailboxes. They are stored encrypted.
Technical data. Access and security logs (IP address, browser, the time of each relevant action) and, when you sign up, the campaign or link that brought you. We only use the cookies needed to keep you signed in, protect forms, and remember the language you chose. We don't use advertising or third-party tracking cookies.
Payments. Payments are handled by the payment processor. We never see or store card numbers.
To provide the service and its features, support you, bill your plan, send you operational and security notices, prevent fraud, and meet legal and accounting obligations. We may also send you product news, which you can stop at any time. We don't use your information for third-party advertising, we don't sell it, and we don't build profiles of people for third parties.
Your company can connect an Outlook, Microsoft 365, Hotmail, Gmail, or Google Workspace mailbox to its AI agents. You connect it by signing in directly with Microsoft or Google (OAuth), and we use their official interfaces, Microsoft Graph and the Gmail API. We never see or store the mailbox password.
Permissions we request. Only those for the use you choose for that mailbox. For a reading mailbox, we ask to read mail and view the calendar. For a sending mailbox, we ask to send mail and create calendar events. We also ask for the account's email address so we know which mailbox you connected.
What we read and what we keep. We check new emails in the folders or labels your company assigns to each agent and compare them with the filters your company sets (senders, subject, whether they have attachments). An email that matches no filter is discarded and is not stored in SB. Emails that match are stored, with their attachments, so the agent can do its task and your team can see what came in and what was done.
What we send. Only the emails and events the agent drafts as part of its task and that are approved according to the level of autonomy your company gave it, or those a person on your team sends. They go out from the same connected mailbox.
Calendar. The agent checks availability to propose or confirm meetings, and creates events only if the mailbox has sending permission.
What we don't do. We don't sell or share mailbox content, and we don't use it for advertising. No one on our team reads those emails unless your company asks us to for support, it is needed to investigate a security issue or abuse, or the law requires it.
Tokens and disconnecting. The permissions Microsoft or Google grant (tokens) are stored encrypted. You can revoke them at any time by disconnecting the mailbox in SB, which deletes the tokens immediately, or by removing SB Commerce's access from your Microsoft account (My Account, Apps and services) or your Google account (Google Account, Security, Third-party apps). Emails that already came in remain in the task history until your company asks us to delete them or closes its account.
SB Commerce's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We apply the same rules to the data we receive from Microsoft Graph.
Use of artificial intelligence. The emails, attachments, and calendar events your company connects are processed by AI agents, using models from Anthropic and xAI, only to carry out the tasks your company set up.
No model training. This data is not used to train or improve general AI models, neither SB Commerce's nor the providers', which by contract do not train on the data they receive through their API.
No transfers to third parties. It is not transferred to third parties, except to those AI providers to process the task. The only exceptions are those Google's policy allows: complying with the law, and a merger or acquisition with prior notice.
This data is used only for the features your company sees and sets up in SB (its agents reading, replying, and scheduling). It is not used for advertising, not sold, and is excluded from the aggregated data use described in the Terms.
The assistant and the AI agents use models from Anthropic (Claude) and xAI (Grok). For each task we send them only the information that task needs, for example the email that arrived, its attachments, or the details of the order being looked up. We use their business services, which process that information to return a response and do not use it to train their models.
Only with the service providers we need to run the Platform, and only what is necessary.
We also disclose information when a competent authority requires it under the law. Beyond that, we don't sell or share it.
Data is hosted on Railway's infrastructure and on Cloudflare R2, located mainly in the United States. Connections are encrypted and sensitive credentials are stored encrypted. No security measure is absolute, but we act diligently and notify incidents as the law requires.
We keep data while the account is active. If your company closes its account or asks us to delete its information, we delete it within 30 days, except for what the law requires us to keep (for example, accounting and tax records), which we keep only for the legal period. Backups are replaced in cycles, and deleted data disappears from them when the cycle ends. A mailbox's tokens are deleted the moment it is disconnected. You can export your information before closing the account.
You can ask us to access, correct, or delete your personal data at any time by writing to sbcommerce.cloud@gmail.com, and you can stop product emails with the link in each email. If you are a customer or vendor of a company that uses SB, that company controls your data. Contact it first; we help it handle your request.
If you are a California resident and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), applies to us, this section applies to you.
Categories we collected in the last 12 months. Identifiers (name, email, IP address); professional information (company, role); commercial information (plan and billing); internet activity (access and security logs); and account log-in credentials. We collect them from you, from your company, and from the integrations your company connects, for the purposes in section 3, and we disclose them only to the service providers in section 7.
No sale or sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16. We use sensitive personal information (account log-in credentials) only to provide the service, so the right to limit its use does not apply. We honor Global Privacy Control signals as an opt-out request.
Your rights. You have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to opt out of its sale or sharing; and not to be discriminated against for exercising these rights.
How to exercise them. Write to sbcommerce.cloud@gmail.com. We will verify your identity by confirming the email associated with your account, and we respond within 45 days, which may be extended once by another 45 days when reasonably necessary. You may use an authorized agent, who must show your written permission.
The Platform is for businesses and is not directed at children. We do not knowingly collect personal information from children under 13.
If we make a material change, we'll let you know in the Platform or by email before it takes effect, and we'll post the new version here with its date.
For any question or request about your data, write to us at sbcommerce.cloud@gmail.com.