Privacy Policy

This Privacy Policy explains how Autopilot Ventures, LLC, a Delaware limited liability company operating Sidekick, collects, uses, stores, shares, protects, and otherwise processes information when you visit getasidekick.ai, create an account, start a trial, subscribe, connect apps, interact with a Sidekick, use dashboards, communicate with support, or otherwise use our websites, products, services, integrations, automations, and related features.

This Policy applies to personal information, account information, business information, usage information, device information, billing-related information, support information, connected-app information, prompts, files, messages, outputs, workflow data, and other information processed through the Services. It does not replace any separate data processing agreement, enterprise agreement, or written contract signed by us.

By using the Services, you acknowledge this Privacy Policy. If you do not want us to process information as described here, do not use the Services, do not connect third-party apps, and do not submit information to Sidekick.

We collect information you provide directly, including your name, email address, password or authentication information, phone number, company details, website, social links, role, team information, business descriptions, onboarding answers, preferences, messages, prompts, files, documents, screenshots, links, instructions, feedback, support requests, and other information you submit.

We collect account and billing information, including plan selection, subscription status, trial status, payment processor identifiers, invoice details, tax information, billing address where required, payment status, renewal history, cancellation information, credits, usage limits, and payment-related events. Full payment card data is generally processed by our payment processor and not stored directly by us.

We collect usage and technical information, including log data, IP address, browser type, device identifiers, pages visited, referring pages, timestamps, session events, clicks, feature use, error reports, performance data, diagnostics, cookies, local storage, authentication state, integration status, API calls, model usage, task metadata, and security events.

If you connect third-party services, we may collect and process information from those services according to your permissions and instructions. This may include emails, calendar events, contacts, files, folders, document content, messages, channel names, workspace identifiers, repository data, CRM records, task data, Notion pages, Drive files, Slack messages, Telegram messages, metadata, and other information made available through the connection.

Sidekick is an AI agent tool. To provide the Services, we may process prompts, instructions, messages, files, screenshots, browser context, website content, business context, connected-app data, tool results, generated outputs, task history, preferences, and memory. This processing may be necessary for Sidekick to understand your business, respond to requests, perform tasks, maintain context, improve repeat workflows, troubleshoot issues, and provide support.

Your Sidekick may store business context, preferences, decisions, reusable workflows, task patterns, documents, outputs, and other information in memory or workspace files so it can provide more useful assistance over time. You are responsible for deciding what information to submit, what tools to connect, what permissions to grant, and what outputs to use.

Sidekick may also use ambient signal capture on inbound human messages from the dashboard and connected messaging channels to identify durable business context for memory. Operational commands, short messages, disabled sources, and excluded profiles are skipped where those controls are configured. Queued, processed, and failed signal artifacts may exist on your Sidekick VPS; extracted memory may be written to local GBrain/Honcho memory systems. Extraction requests may be sent to model providers such as OpenRouter after local redaction of common secrets and contact identifiers.

AI systems and third-party model providers may process prompts, context, files, and outputs as part of providing responses. We take reasonable steps to use providers and configurations appropriate for the Services, but we do not control every third-party system and cannot guarantee that AI processing will be error-free, confidential in every circumstance, or suitable for regulated data unless expressly covered by a separate written agreement.

We use information to provide, operate, maintain, secure, personalize, troubleshoot, and improve the Services. This includes account creation, authentication, onboarding, provisioning, workspace setup, task execution, AI processing, connected-app actions, support, billing, fraud prevention, abuse detection, service monitoring, analytics, product development, quality control, and communications.

We may use information to generate outputs, summarize information, draft content, perform research, automate workflows, edit files, connect tools, route tasks to models or providers, remember user preferences, enforce plan limits, prevent misuse, detect security issues, investigate bugs, comply with legal obligations, and protect our rights, users, systems, and third-party providers.

We may use aggregated, de-identified, or anonymized information to analyze usage, improve performance, develop features, measure product adoption, understand demand, benchmark reliability, and operate the business. We will not attempt to re-identify information that has been properly de-identified except as permitted by law for validation, security, or compliance.

Where laws such as the GDPR or UK GDPR apply, our legal bases may include performance of a contract, legitimate interests, consent, compliance with legal obligations, and protection of rights and security. Legitimate interests may include providing and improving the Services, securing accounts, preventing abuse, supporting customers, billing, analytics, product development, and business operations.

Where we rely on consent, you may withdraw consent where applicable, but withdrawal may not affect prior processing or processing required to provide the Services. If you connect third-party apps or submit information about others, you are responsible for having the necessary notices, permissions, and lawful bases.

We may share information with service providers, subprocessors, contractors, affiliates, infrastructure providers, hosting providers, database providers, analytics providers, payment processors, fraud prevention providers, communications providers, customer support tools, AI model providers, integration providers, security tools, and professional advisors who help us operate the Services.

We may share information with third-party services you connect or direct us to use. For example, if you connect Gmail, Slack, Notion, Drive, Calendar, GitHub, Telegram, or another app, information may flow between Sidekick and that service according to your settings, permissions, instructions, and the third-party service’s own terms and privacy practices.

We may disclose information if required by law, subpoena, court order, legal process, regulator request, government request, or to protect rights, safety, security, property, users, third parties, or the public. We may also disclose information in connection with a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, due diligence, or change of control.

We do not sell personal information in the traditional sense. We do not share personal information with third parties for their independent cross-context behavioral advertising unless disclosed in a separate cookie or advertising notice or required by applicable law.

We and our service providers may use cookies, pixels, local storage, session storage, SDKs, analytics tools, and similar technologies to keep you signed in, remember preferences, secure accounts, measure traffic, understand product use, improve performance, debug issues, prevent abuse, and support marketing or attribution where permitted.

You can control cookies through browser settings, but disabling cookies may break authentication, dashboard features, checkout, connected apps, or other parts of the Services. Some browsers provide Do Not Track or similar signals; we respond to legally required signals where applicable and otherwise handle privacy preferences according to available controls and applicable law.

We retain information for as long as reasonably necessary to provide the Services, maintain accounts, operate workspaces, comply with legal obligations, resolve disputes, enforce agreements, collect fees, prevent fraud, maintain backups, improve products, and support legitimate business purposes.

Retention periods vary depending on the type of information, account status, plan, legal requirements, backup cycles, security needs, and operational constraints. Some information may remain in backups, logs, audit records, billing records, security systems, or archival systems for a limited period after deletion from active systems.

Submitting a Sidekick or account deletion request starts infrastructure teardown. After teardown completes successfully, the VPS-local workspace, signal queue, processed and failed signal artifacts, local GBrain/Honcho stores, and the per-customer OpenRouter key are removed. An accepted request or a deleted control-plane status is not by itself confirmation that every provider deletion has completed; incomplete cleanup may require retry or reconciliation. Backups, provider logs, payment records, analytics events, and legal records may follow separate retention and erasure timelines.

You are responsible for exporting or saving information you need before cancelling or deleting an account. We may delete or restrict access to workspace data after cancellation, termination, non-payment, inactivity, or operational need, subject to applicable law and written agreements.

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including access controls, authentication, infrastructure controls, monitoring, and provider security practices. However, no online service, AI system, integration, browser session, email system, hosting provider, or transmission method is perfectly secure.

You are responsible for using strong credentials, protecting devices, limiting team access, managing connected-app permissions, reviewing OAuth scopes, revoking unused integrations, keeping your own backups, and avoiding submission of unnecessary sensitive information. We are not responsible for unauthorized access caused by your credentials, devices, team members, connected accounts, third-party services, or failure to manage permissions.

We may process and store information in the United States and other countries where we or our service providers operate. Those countries may have privacy laws that differ from the laws where you live. Where required, we use appropriate transfer mechanisms or safeguards for international transfers.

By using the Services, you understand that information may be transferred to, processed in, and stored in locations outside your state, province, or country.

Depending on where you live, you may have rights to access, correct, delete, export, restrict, object to processing, withdraw consent, opt out of certain sharing, or appeal a privacy decision. These rights may be subject to verification, exceptions, legal limits, security needs, and our ability to identify the relevant information.

To make a privacy request, contact josh@getasidekick.ai. We may need to verify your identity, account ownership, authority, and jurisdiction before acting on a request. We will not discriminate against you for exercising rights provided by applicable law, but some requests may affect our ability to provide the Services.

If your data was submitted by a customer, employer, team owner, or workspace administrator, we may refer your request to that customer or administrator. Business customers are responsible for responding to requests relating to data they control unless a separate agreement says otherwise.

The Services are intended for business users and are not directed to children under 13 or the minimum age required by applicable law. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us so we can take appropriate action.

Do not submit sensitive personal information, protected health information, payment card data, government identifiers, biometric data, children’s data, highly confidential information, regulated financial information, or other regulated data unless your plan, settings, written agreement, and applicable law expressly allow that processing and you have implemented required safeguards.

Sidekick is not designed to be the system of record for regulated healthcare, banking, legal, insurance, government, emergency, safety-critical, or similarly high-risk data unless expressly covered by a separate written agreement. You are responsible for ensuring your use complies with laws and contracts that apply to your business.

Who we are and our role. Autopilot Ventures, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA, provides Autopilot Messaging, a technology service for businesses. A business connects its WhatsApp Business number to Autopilot Messaging through Meta Embedded Signup. We then receive and send WhatsApp messages for that business through the WhatsApp Business Platform (Cloud API), show its conversations in a shared Chatwoot inbox, and an AI assistant drafts or sends replies on the business's instructions. For the business's customers, we act as a processor (service provider) on behalf of the business, and the business you message is responsible for your data. We act as a controller only for our own client-account data, such as the business's contact and billing details. Questions about Autopilot Messaging: saurabh@getasidekick.ai.

Business information we receive from Meta when a business connects: its business portfolio ID, WhatsApp Business Account (WABA) ID, phone number ID, display phone number, verified business name, and the phone number quality rating. Meta also issues us a business access token for that business. We use the token only to operate the connection the business authorised.

Messages: the content and metadata of conversations between the business and its customers. This includes message text, media (such as images, documents and voice notes), shared locations, customer phone numbers and profile names, timestamps, and delivery and read status. We also process the message templates the business creates and their Meta review status.

Businesses that keep using the WhatsApp Business app on their phone (coexistence): Meta also sends us the contacts synced from the app, up to 6 months of past chat history that the business chooses to share during setup, and copies of the messages the business sends from its phone (message echoes).

Facebook Login: the business admin who connects signs in with Facebook and authorises our app. We do not store that person's Facebook profile. We keep only the Meta-issued identifiers needed to complete and maintain the connection (the business, WABA and phone number IDs above, and the app-scoped user ID that Meta sends us with a data deletion request).

Sensitive information: customers sometimes volunteer health information in conversations, for example allergies, medications or pregnancy, when they message a health or wellness business. We process this information only to provide the business's service on its instructions. We never use it, or any other message content, for advertising, profiling, or training AI models.

How we use this information: to deliver messages between the business and its customers; to run the business’s booking or customer-service assistant; to show conversations to the business’s staff; to send the business’s approved message templates; to prevent abuse and keep the service secure; and to give support to the business.

What we never do: we do not sell this information; we do not use it for advertising; we do not share one client's data with another client; and we do not use data we receive from Meta for any purpose other than providing and securing the service the business asked for.

Sub-processors for this service: Meta Platforms, Inc., United States (WhatsApp Business Platform and Cloud API, which carries every message); Cloudflare, Inc., United States, with a global network (application hosting, databases and storage); Hetzner Online GmbH, Germany (servers that host the Chatwoot inbox); Anthropic, PBC, United States (the Claude AI model that drafts the assistant’s replies; under Anthropic’s commercial terms, API inputs and outputs are not used to train its models); TypeSafe (classification of incoming messages, with common identifiers such as phone numbers and email addresses redacted first); and Stripe, Inc., United States (payment links and payments, when a business takes payments through the assistant). If a business uses its own Chatwoot server, that server is the business’s responsibility, not ours.

Meta Conversions API: when a business asks us to, we send conversion events (for example a new lead or a completed booking payment) to that business's own Meta dataset through the Meta Conversions API. Customer identifiers in these events, such as phone numbers and email addresses, are hashed before they are sent, as Meta requires. Message content is not sent.

International transfers: Autopilot Ventures, LLC is a United States company. This service runs on servers in Germany and on Cloudflare's global network, and Meta, Anthropic and Stripe process data in the United States. Where the law requires a transfer mechanism, we rely on the data processing terms these providers offer (for example Standard Contractual Clauses).

Retention: we keep this information only while the business is connected to Autopilot Messaging. When a business disconnects or sends us a verified deletion request, we stop processing at once and delete its business access token immediately. We delete our copies of its conversations, imported chat history, contacts, templates and logs within 30 days. Records the business keeps for itself, such as booking or consent records in its own systems, are the business's responsibility. Payment records held by Stripe follow Stripe's retention and the law on financial records.

Security: data is encrypted in transit (HTTPS). Business access tokens are stored encrypted. We verify the signature on every webhook Meta sends us, and access to client data is limited to the people at Autopilot Ventures, LLC who operate the service.

Requests from public authorities: if a public authority asks us for personal data that we process through Autopilot Messaging, we (1) review the request to confirm that it is lawful and that it is valid in the jurisdiction where it is made; (2) challenge the request if we consider it unlawful, overbroad or not properly authorized; (3) disclose only the minimum data necessary to comply; and (4) keep a written record of each request, our assessment and legal reasoning, the people involved, and our response. Where the law allows, we tell the affected business before we disclose its data. We have not received any such request.

Your rights: depending on where you live (for example under the GDPR, the UK GDPR, Thailand's PDPA, or California law), you may have rights to access, correct, delete, or export your information, or to object to its processing. If you messaged a business that uses Autopilot Messaging, contact that business first, because it controls your data; we help it respond. You can also write to saurabh@getasidekick.ai with the business's name and your WhatsApp number.

Disconnecting and deleting data: step-by-step instructions are at https://getasidekick.ai/data-deletion.

Children: Autopilot Messaging is a service for businesses and is not directed at children under 16.

Changes: if we make a material change to how Autopilot Messaging handles data, we update this page and email the contact address of each connected business before the change takes effect.

The Services may contain links to third-party websites, apps, integrations, providers, or services. Their privacy practices are governed by their own policies, not this Privacy Policy. We are not responsible for third-party privacy, security, content, outages, data handling, or compliance practices.

We may update this Privacy Policy from time to time to reflect product changes, provider changes, legal requirements, business practices, or operational needs. The updated Policy will be effective when posted unless a later date is stated. Your continued use of the Services after an update means you acknowledge the updated Policy.

If changes are material, we may provide notice through the Services, email, account notice, website notice, or other reasonable means where required by law.

The Services are operated by Autopilot Ventures, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA. For privacy questions, requests, or concerns, contact josh@getasidekick.ai. For Autopilot Messaging and WhatsApp Business Platform questions or data requests, contact saurabh@getasidekick.ai.