diff --git a/src/monitor_utils/sessions.py b/src/monitor_utils/sessions.py
index 13abbd8..a1b729d 100644
--- a/src/monitor_utils/sessions.py
+++ b/src/monitor_utils/sessions.py
@@ -13,12 +13,16 @@ from aioweb import Response
 from aioweb_tls import CurlCffi, TLSSession
 from fake_useragent import UserAgent
 
-from monitor_utils.constants import CLIENT_IDENTIFIERS, RETRY_LIMIT
+from monitor_utils.constants import CLIENT_IDENTIFIERS, RETRY_LIMIT, TIMEOUT_SECONDS
 
 UA = UserAgent()
 
 
-def get_default_session(proxies: AioProxies, headers: dict | None = None) -> TLSSession:
+def get_default_session(
+    proxies: AioProxies,
+    headers: dict | None = None,
+    timeout: int = TIMEOUT_SECONDS,
+) -> TLSSession:
     """Return a TLSSession impersonating a random client fingerprint.
 
     Fingerprint rotation lives here so every monitor rotates the same way; the
@@ -36,6 +40,9 @@ def get_default_session(proxies: AioProxies, headers: dict | None = None) -> TLS
             monitor-wide static headers; per-request headers still go through
             send_request. The curl_cffi impersonation already supplies a
             matching User-Agent, so one is not defaulted here.
+        timeout: Total request timeout in seconds, defaulting to TIMEOUT_SECONDS.
+            aioweb's own default is only 10s, so this restores the wider budget
+            the old sessions used and slow retailers depend on.
 
     Returns:
         A TLSSession over a curl_cffi backend with a random impersonation, with
@@ -45,7 +52,9 @@ def get_default_session(proxies: AioProxies, headers: dict | None = None) -> TLS
     headers = headers or {}
     headers.setdefault("User-Agent", UA.chrome)
     impersonate = random.choice(CLIENT_IDENTIFIERS)
-    session = TLSSession(backend=CurlCffi(impersonate=impersonate), headers=headers)
+    session = TLSSession(
+        backend=CurlCffi(impersonate=impersonate), headers=headers, timeout=timeout
+    )
     session.proxy_pool = proxies
     return session
 
@@ -75,10 +84,11 @@ async def send_request(
         url: Request URL.
         method: HTTP method.
         params: Query parameters.
-        json_data: JSON body. A dict here is sent as a JSON body.
-        data: Alternative body. Note aioweb routes any dict or list to a JSON
-            body, so true form-encoding requires a pre-encoded string; a form
-            dict passed here is sent as JSON.
+        json_data: JSON body. A dict here is sent as JSON with the
+            application/json content-type set by aioweb.
+        data: Raw request body, passed through unchanged (e.g. a url-encoded
+            form string). The caller owns the matching content-type via headers.
+            A dict is JSON-encoded by aioweb, so use json_data for JSON bodies.
         headers: Per-request headers merged over the session defaults.
 
     Returns: