Privacy Policy

Sebastian Alliance Group LLC ("SAG", "we", "us") is a Florida limited liability company headquartered at 101 N.E. 3rd Avenue, Suite 1500, Fort Lauderdale, FL 33301. This policy covers information handled by SAG as the operator of our corporate websites, Payment Center, Investor Portal, Admin portal and related digital products.

This is not the privacy policy of any merchant, client, or portfolio company you may transact with through our platforms — those parties publish their own policies.

• Contact and identity data you provide through forms — name, business name, email address, phone number, postal address, and any message or file you attach.
• Transaction data — amount, currency, date, time, reference/invoice ID, approval code and result of each payment.
• Limited payment method data returned by the processor — card brand and the last four digits of the card. We never receive or store full card numbers, CVV codes, expiry dates or online banking credentials.
• KYC/AML data where required — legal name, date of birth, government ID reference, business registration documents and beneficial-ownership information collected in accordance with our KYC/AML Policy.
• Technical data — IP address, device and browser information, referring page, server logs and error reports, used for security, fraud prevention and reliability.
• Account data — for administrators and authenticated users, hashed credentials, role, session tokens and audit-log entries of privileged actions.

We use the information to: process and confirm payments; issue invoices and receipts; deliver services you requested; prevent and investigate fraud, chargebacks and abuse; comply with tax, accounting, KYC, AML, sanctions and other legal obligations; respond to enquiries and provide support; and improve the security and reliability of our platforms.

We share information with: our payment processors and banking partners (Stripe, Fiserv and their sub-processors) as required to complete transactions; service providers acting on our written instructions (for example hosting, email delivery, analytics, error monitoring); professional advisers (accountants, lawyers, auditors); and regulators, law enforcement or courts where legally required or to protect our rights.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising.

SAG is based in the United States and our service providers may process data in the United States, the European Union, the United Kingdom and other jurisdictions. Where personal data is transferred out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Transaction and KYC records are retained for the period required by US federal and Florida state tax, accounting, banking and anti-money-laundering law — typically at least five (5) years from the end of the business relationship, and longer where a specific legal or regulatory obligation applies. Other personal data is kept only as long as needed for the purpose it was collected.

Data is transmitted over HTTPS/TLS. Sensitive configuration such as processor API keys is encrypted at rest with authenticated encryption. Access is role-based, logged and restricted to authorised personnel.

Depending on where you are located, you may have the right to access, correct, delete, port or restrict processing of your personal information, and to object to certain processing. To exercise any of these rights, contact us at ecommerce@sebasalliance.net. We will respond within the timeframe required by applicable law. We may need to keep records that we are required to retain by law (for example transaction and KYC records).

California residents (CCPA/CPRA): you have the right to know what personal information we collect, to request deletion or correction, and to opt out of any "sale" or "sharing" for cross-context behavioural advertising. We do not sell or share your personal information as those terms are defined by the CCPA.

EEA/UK residents (GDPR/UK GDPR): our lawful bases for processing include performance of a contract, compliance with a legal obligation, our legitimate interests in operating and securing the platform, and where appropriate, consent. You have the right to lodge a complaint with your local data protection authority.

We use cookies and local storage that are necessary to operate the platform (for example maintaining your admin session or preventing cross-site request forgery), and limited product analytics to understand aggregated usage and diagnose issues. Analytics are disabled on sensitive routes such as the Admin portal and Payment Center so that credentials and card entry are never captured or replayed.

Our platforms are not directed to children under 16 and we do not knowingly collect personal information from them. If you believe a child has provided us information, please contact us and we will delete it.

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent version. Material changes will be highlighted on our website.