Effective from 21 October 2026 · bugivugi (MB eDelfinas)
This is an English translation. If the versions differ, the Lithuanian version prevails: Privatumo politika.
1. Who we are
bugivugi (bugivugi.com) is a brand of MB eDelfinas. The controller of your data is MB eDelfinas, company code 306945862, registered office Taikos pr. 24, 91222 Klaipėda, Lithuania, email info@edelfinas.lt. For privacy questions, write to info@edelfinas.lt.
When we process your buyers' data on your behalf – AI responder chats, email lists or orders – we act as a processor and your company is the controller. That processing is governed by the Data processing agreement.
2. What data we collect
| Data | When we receive it |
|---|---|
| Account data: name, surname, email, phone (if provided), Telegram chat ID (if you turn on Telegram notifications), login codes and sessions (stored only as hashes) | When you sign up and change settings |
| Business data for invoices: company or full name, company or sole-trader number, VAT code (if any), address | When you sign up and buy |
| Payment data: plan, invoices, payment history. Card details are processed and stored by Stripe – we never see or store them, only Stripe customer and subscription IDs | When you pay |
| Usage data: products, photos, voice messages, files (CSV, XML, Word, PDF, TXT), chats with Bugi, settings, credit and sales counters | When you use the service |
| Access data of connected accounts: API keys you create yourself (WooCommerce, Shopify, Kaufland, bol.com, Base.com, ad accounts, Meta) and OAuth tokens the platform issues after you sign in (eBay, Allegro); account name or ID and granted permissions | When you connect an account; stored encrypted |
| Order data from connected marketplaces and stores: number, items, quantity, price, status | When orders are synced |
| Technical data: IP address, browser, login times, activity log | When you visit and use the service |
| Website visitor data for analytics and advertising | Only with your consent (see Cookie policy) |
| Enquiries and support: Plan 4 requests, emails, call bookings, ratings and suggestions | When you contact us |
| Referral programme: who referred a customer, payout details | When you take part |
We collect only what we need to provide the service. We do not collect special categories of data (such as health data) and ask you not to upload them.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Account, providing the service, AI agent's work | Contract (b) |
| Payments, invoices, accounting | Legal obligation (c) and contract |
| System notifications: suspension, reminders, limits | Contract |
| Security: login codes, request limits, logs, fraud prevention | Legitimate interest (f) |
| Customer support and call bookings | Contract |
| Improving the service based on ratings and suggestions | Legitimate interest |
| bugivugi news and offers by email | Consent (a), which you can withdraw at any time |
| Website analytics and advertising – not used at the moment; if introduced, only with your consent | Consent |
| Referral payouts | Contract and legal obligation |
4. How long we keep data
| Data | Period |
|---|---|
| Account and business data | While the account is active; a suspended or closed account – 14 more days for recovery, then deleted |
| Chats with AI agents | 60 days |
| Preferences Bugi remembers | While the account is active |
| Products you delete | A copy for 5 days for recovery |
| Invoices and payment records | 10 years, as required by accounting law |
| Security logs | 7 months |
| Backups | Deleted data disappears from backups within 30 days |
| Marketing consents | Until you withdraw them |
Your marketplace and web store accounts and listings stay in your accounts – we do not delete them when you close your bugivugi account. We delete access keys and tokens as soon as you disconnect an integration, and when eBay notifies us that an eBay account has been deleted, we delete the related data as well.
5. Who we share data with
- Suppliers that help us provide the service: hosting, AI models, payments, notifications. All of them are listed in the Subprocessors list, and data processing agreements are in place.
- Platforms you connect – marketplaces (e.g. eBay, Allegro, Kaufland, bol.com), your web store (WooCommerce, Shopify), Base.com and Meta – only when needed for your task and only within the permissions you granted. These platforms process data under their own terms and privacy policies.
- Public authorities – only where the law requires it.
We do not sell your data.
6. Transfers outside the EEA
Some suppliers, such as AI model providers, process data outside the European Economic Area. In that case we rely on the European Commission's standard contractual clauses or the EU–US Data Privacy Framework if the supplier is certified. The basis for each supplier is shown in the Subprocessors list.
7. AI and automated actions
- Your messages, photos, voice recordings and files are sent to AI model providers through paid API services so that Bugi can carry out your tasks.
- We use commercial AI API services whose terms do not allow this data to be used to train models.
- According to your settings, Bugi lists, updates and deletes products. It does not change the prices of imported products on its own – only on your instruction or with your separate permission; the minimum margin you set is used only to assess advertising profitability. In the settings you can require approval before every price or SEO change.
- The chat always makes clear that you are talking to AI.
8. Your rights
You can:
- access your data and get a copy;
- correct inaccurate data;
- ask us to delete data when it is no longer needed or you withdraw consent; you can also delete your account yourself in the dashboard (Settings → Data) – it is deleted with all its data after 14 days, during which you can cancel the deletion;
- restrict processing or object to processing based on legitimate interest;
- receive your data in a portable format (JSON, and CSV for products) – yourself in the dashboard (Settings → Data) or by writing to us;
- withdraw consent at any time, e.g. via the unsubscribe link in an email.
Send requests to info@edelfinas.lt; we reply within one month. You can lodge a complaint with the State Data Protection Inspectorate of Lithuania: L. Sapiegos g. 17, 10312 Vilnius, vdai.lrv.lt.
9. How we protect data
- You log in with a one-time code sent by email: the code is valid for 10 minutes, attempts are limited, and we do not use passwords.
- Keys and tokens of connected accounts are stored encrypted (AES-256), bound to your account and decrypted only at run time; they are never shown in the interface. Keys pasted into the chat are hidden before the message reaches the AI model, and system execution data containing keys is not stored.
- Servers are located in Lithuania (Hostinger, Vilnius) and the database in Sweden (Supabase, Stockholm); only the system accesses the data, and backups are made regularly and stored in the EU.
- If a personal data breach poses a risk, we notify the State Data Protection Inspectorate within 72 hours and you without undue delay.
10. Children
The service is for businesses only, so we do not collect children's data.
11. Changes
We announce material changes to this policy by email and on the website 30 days in advance.
12. Contact
MB eDelfinas, company code 306945862, Taikos pr. 24, 91222 Klaipėda, Lithuania, info@edelfinas.lt.