Privacy Policy

01 Who We Are

Sidekik AI is a Prodocut of HOLLER AI LLC ("SideKik," "we," "us," or "our") is a software company incorporated in the United States that provides a private, enterprise-grade AI assistant platform accessible at https://sidekikai.com. Our platform enables organizations to deploy a dedicated AI assistant that ingests their proprietary data, connects to their business applications, and provides intelligent, context-aware responses — all within a privately hosted environment.

This Privacy Policy describes how Sidekik AI is a Prodocut of HOLLER AI LLC collects, uses, stores, shares, and protects personal information and organizational data in connection with our website, platform, and related services (collectively, the "Services").

If you are a customer organization ("Customer"), this policy governs both your use of our platform and the personal data of your end users ("End Users") that may be processed through our Services. If you are an individual visiting our website, this policy governs the limited information we collect about your visit.

02 Information We Collect

2.1 Account & Registration Information

When you register for a SideKik account or request a demo, we collect:

• Full name and business email address
• Company name, size, and industry
• Billing information (processed via Stripe; we do not store raw card data)
• Phone number (for account verification and support)
• Password (stored as a salted, hashed value; never in plaintext)

2.2 Usage & Platform Data

When you use the SideKik platform, we may collect:

• Conversation logs and query history within your private instance (stored in your dedicated database)
• Feature usage patterns, session durations, and interaction metadata
• Error logs, crash reports, and performance telemetry (anonymized where possible)
• IP addresses and device/browser information for security and fraud prevention

2.3 Corporate Data You Provide

As part of the onboarding process, Customers may upload or connect the following types of organizational data to their private SideKik instance:

• Documents (PDFs, Word files, spreadsheets, presentations)
• Database records from connected CRM, POS, ERP, or scheduling systems
• Email and calendar data from connected Google Workspace or Microsoft 365 accounts
• Knowledge base articles, SOPs, and internal wikis
• Any other data ingested through configured MCP server integrations

2.4 Website Visitor Data

When you visit sidekikai.com, we collect standard web analytics data including page views, referral sources, browser type, and approximate geographic location. See our Cookie Policy for details.

03 How We Use Your Information

We use the information we collect for the following purposes:

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

04 Private AI Data Processing

4.1 Dedicated Infrastructure Architecture

Each SideKik customer receives a fully isolated deployment consisting of:

• A dedicated OpenWebUI instance running on a private cloud server
• A dedicated Supabase PostgreSQL database with Row-Level Security (RLS) enabled
• A dedicated vector store (pgvector) for RAG (Retrieval-Augmented Generation) operations
• Private MCP server instances for each configured integration

4.2 Data Ingestion Process

When corporate data is ingested into SideKik, the following process occurs entirely within your private instance:

1. Documents and data are uploaded or streamed from connected sources via authenticated API calls
2. Text is extracted, chunked, and embedded using the configured AI embedding model
3. Embeddings are stored in your private vector database alongside the original text chunks
4. All data remains within your dedicated infrastructure; no data is transmitted to SideKik's central systems

4.3 AI Query Processing

When an End User submits a query to SideKik:

1. The query is processed within your private instance
2. Relevant context is retrieved from your private vector store via semantic search
3. The query and retrieved context are sent to the configured AI model provider (e.g., Anthropic, OpenAI, or a self-hosted model) via an encrypted API call
4. The AI model generates a response using only the provided context; it does not retain this data
5. The response is returned to the End User and optionally logged in your private conversation history

4.4 Conversation Logging

Conversation logs are stored in your private Supabase database. Customers control retention periods and can configure automatic deletion. SideKik staff cannot access conversation logs without explicit written authorization from the Customer administrator.

05 A2P Messaging Authorization & Compliance

5.1 What is A2P Messaging?

Application-to-Person (A2P) messaging refers to SMS or MMS messages sent from our platform to your registered phone number for purposes such as two-factor authentication (2FA), account alerts, and service notifications.

5.2 Consent & Opt-In

We only send A2P messages to users who have explicitly provided consent. Consent is obtained through:

• A clear opt-in checkbox during account registration (not pre-checked)
• An explicit written confirmation for any marketing or promotional SMS communications
• Verbal or written consent documented during onboarding for enterprise accounts

5.3 Message Types & Frequency

SideKik may send the following types of A2P messages:

• Transactional: One-time passcodes (OTP), login verification codes, security alerts
• Service Notifications: System status updates, scheduled maintenance notices
• Account Alerts: Billing reminders, usage threshold notifications (opt-in only)

Message frequency varies by account activity. Standard carrier message and data rates may apply.

5.4 Opt-Out

You may opt out of A2P messaging at any time by:

• Replying STOP to any SMS message from SideKik
• Updating your notification preferences in your account settings
• Contacting us at [email protected]

5.5 TCPA Compliance

SideKik complies with the Telephone Consumer Protection Act (TCPA) and all applicable state and federal regulations governing A2P messaging. We maintain records of consent for a minimum of five (5) years. We do not use automated dialing systems for marketing purposes without prior express written consent.

5.6 10DLC Registration

SideKik's A2P messaging campaigns are registered with The Campaign Registry (TCR) under the 10-Digit Long Code (10DLC) framework as required by U.S. mobile carriers. Our registered use cases include: account notifications, two-factor authentication, and customer care.

06 Google Cloud Project Authorization

6.1 Google Workspace Integration

When a Customer connects their Google Workspace account to SideKik via our Google Cloud integration, the following applies:

• SideKik requests only the minimum OAuth scopes necessary to perform the requested functions (principle of least privilege)
• OAuth tokens are stored encrypted within your dedicated Supabase instance, not on SideKik's central servers
• Access is scoped to the specific Google Workspace account authorized by the Customer administrator

6.2 OAuth Scopes Requested

Depending on the features enabled, SideKik may request the following Google OAuth scopes:

6.3 Data Handling Under Google API Services User Data Policy

SideKik's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Data obtained from Google APIs is used only to provide or improve user-facing features visible within SideKik
• Google user data is not used for advertising, sold to third parties, or used to train AI models
• Human access to Google user data is restricted to security and compliance purposes, with user consent
• Customers may revoke Google authorization at any time through their Google Account settings or SideKik account settings

6.4 Token Revocation

Customers can revoke SideKik's access to their Google account at any time by visiting Google Account Permissions or through the SideKik integrations settings panel. Upon revocation, all stored OAuth tokens are immediately deleted from your SideKik instance.

07 Third-Party Integrations & MCP Servers

7.1 Model Context Protocol (MCP) Architecture

SideKik uses Model Context Protocol (MCP) servers to establish secure, authenticated connections between your private AI instance and your business applications. Each MCP server operates as a bridge that:

• Authenticates with the target application using your credentials (stored encrypted in your private instance)
• Executes only the specific API calls authorized by your SideKik configuration
• Returns data directly to your private AI instance without routing through SideKik's central infrastructure

7.2 Supported Integrations & Data Accessed

The following integrations may be configured by Customers. Data accessed is governed by the respective third-party application's terms and the Customer's authorization:

7.3 Third-Party Privacy Policies

SideKik is not responsible for the privacy practices of third-party applications you connect to your instance. We encourage you to review the privacy policies of all connected applications. SideKik acts as a data processor with respect to data retrieved from third-party integrations; the Customer remains the data controller.

7.4 Credential Security

All API keys, OAuth tokens, and credentials stored for integration purposes are encrypted at rest using AES-256 encryption. Credentials are stored exclusively within your dedicated Supabase instance and are never transmitted to SideKik's central systems.

08 Data Retention & Deletion

8.1 Customer Data Retention

Customers control the retention period for all data stored within their private SideKik instance, including:

• Conversation logs and AI interaction history
• Ingested documents and vector embeddings
• Integration query cache

Default retention periods are configurable through the SideKik administration panel. Customers may set automatic deletion schedules ranging from 30 days to indefinite retention.

8.2 Account Termination

Upon termination of a SideKik subscription:

• Customers have 30 days to export their data in standard formats (JSON, CSV, PDF)
• After 30 days, all customer data is permanently deleted from the dedicated infrastructure
• Deletion is irreversible and confirmed in writing to the Customer administrator
• Backups containing customer data are purged within 90 days of account termination

8.3 Individual Data Deletion Requests

End Users may request deletion of their personal data by contacting their organization's SideKik administrator or by emailing [email protected]. We will process verified deletion requests within 30 days.

8.4 Website Visitor Data

Analytics data collected from website visitors is retained for 24 months, after which it is automatically aggregated and anonymized.

09 Security & Infrastructure

9.1 Technical Safeguards

SideKik implements the following technical security measures:

• Encryption at Rest: AES-256 encryption for all stored data, including databases, file storage, and vector stores
• Encryption in Transit: TLS 1.3 for all data transmissions; HTTPS enforced across all endpoints
• Authentication: Multi-factor authentication (MFA) available for all accounts; SSO via SAML 2.0 for enterprise customers
• Access Controls: Role-based access control (RBAC) with principle of least privilege; Row-Level Security (RLS) in Supabase
• Network Security: Private VPC deployment, firewall rules, DDoS protection, and intrusion detection
• Audit Logging: Comprehensive audit trails via Langfuse for all AI interactions and administrative actions

9.2 Organizational Safeguards

• Background checks for all SideKik employees with access to production systems
• Security awareness training conducted quarterly
• Incident response plan with defined SLAs for breach notification
• Vendor security assessments for all third-party service providers

9.3 Breach Notification

In the event of a data breach affecting your organization's data, SideKik will notify affected Customers within 72 hours of becoming aware of the breach, consistent with GDPR Article 33 requirements. Notification will include the nature of the breach, categories of data affected, likely consequences, and measures taken to address the breach.

10 GDPR Compliance

10.1 Legal Basis for Processing

For individuals in the European Economic Area (EEA), United Kingdom, or Switzerland, SideKik processes personal data under the following legal bases as defined in GDPR Article 6:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide the Services you have contracted for
• Legitimate Interests (Art. 6(1)(f)): Security monitoring, fraud prevention, service improvement
• Legal Obligation (Art. 6(1)(c)): Compliance with applicable laws and regulations
• Consent (Art. 6(1)(a)): Marketing communications, optional analytics, A2P messaging

10.2 Data Subject Rights

Under GDPR, individuals have the following rights with respect to their personal data:

• Right of Access (Art. 15): Request a copy of your personal data we hold
• Right to Rectification (Art. 16): Request correction of inaccurate personal data
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Right to Restriction (Art. 18): Request restriction of processing in certain circumstances
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Rights Related to Automated Decision-Making (Art. 22): Not be subject to solely automated decisions with significant effects

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10.3 Data Processing Agreements

SideKik offers a Data Processing Agreement (DPA) to all Customers who require one for GDPR compliance. The DPA governs the processing of personal data on behalf of the Customer and includes the Standard Contractual Clauses (SCCs) approved by the European Commission for international data transfers. Contact [email protected] to request a DPA.

10.4 Data Protection Officer

SideKik has designated a Data Protection Officer (DPO) who can be reached at [email protected]. You also have the right to lodge a complaint with your local supervisory authority.

11 CCPA / CPRA Compliance

11.1 California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you specific rights regarding your personal information.

11.2 Categories of Personal Information Collected

In the preceding 12 months, SideKik has collected the following categories of personal information from California residents:

• Identifiers (name, email address, IP address, account ID)
• Commercial information (subscription plan, billing records)
• Internet or other electronic network activity information (usage logs, interaction data)
• Professional or employment-related information (company name, job title)
• Inferences drawn from the above to create a profile (account preferences, feature usage patterns)

11.3 Your California Rights

• Right to Know: Request disclosure of the categories and specific pieces of personal information collected about you
• Right to Delete: Request deletion of personal information we have collected from you
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond what is necessary to provide the Services
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights

To submit a CCPA/CPRA request, email [email protected] with the subject line "California Privacy Request." We will verify your identity and respond within 45 days.

11.4 Do Not Sell or Share My Personal Information

SideKik does not sell personal information as defined under the CCPA/CPRA. We do not share personal information with third parties for cross-context behavioral advertising purposes.

12 HIPAA Considerations

12.1 HIPAA-Aware Architecture

SideKik's dedicated infrastructure architecture is designed with HIPAA compliance considerations in mind, including:

• Dedicated, isolated infrastructure per customer (no shared multi-tenant environments)
• AES-256 encryption at rest and TLS 1.3 in transit for all data
• Comprehensive audit logging of all data access and AI interactions via Langfuse
• Role-based access controls and minimum necessary access principles
• Ability to configure data retention and automatic deletion policies

12.2 Business Associate Agreement (BAA)

For Customers who are Covered Entities or Business Associates under HIPAA and who intend to process PHI through SideKik, we are prepared to execute a Business Associate Agreement (BAA). Please contact [email protected] to initiate the BAA process. Do not upload PHI to SideKik without a signed BAA in place.

12.3 AI Model Provider Considerations for PHI

If PHI is processed through SideKik, Customers must ensure that the AI model provider configured for their instance also has appropriate HIPAA safeguards in place. SideKik can assist in configuring fully self-hosted, open-source AI models (e.g., Llama via Ollama) to ensure PHI never leaves your private infrastructure.

13 SOC 2 Readiness

SideKik is actively working toward SOC 2 Type II certification. Our infrastructure and operational practices are aligned with the AICPA Trust Services Criteria across the following categories:

• Security: Firewall controls, intrusion detection, vulnerability management, access controls, MFA
• Availability: Uptime monitoring, redundant infrastructure, incident response procedures
• Confidentiality: Encryption at rest and in transit, data classification, access restrictions
• Processing Integrity: Input validation, error handling, audit logging via Langfuse
• Privacy: Aligned with this Privacy Policy and applicable regulations

Enterprise customers requiring evidence of security controls may request our security documentation package, including penetration test summaries, infrastructure diagrams, and policy documentation, by contacting [email protected].

14 AI Model Data Usage

14.1 How AI Models Are Used

SideKik uses AI models as inference engines — meaning they receive a query and context, generate a response, and do not retain that information. Specifically:

• Queries and context are sent to AI model APIs (e.g., Anthropic, OpenAI) solely to generate responses
• We configure API calls with the "no training" flag where available (e.g., OpenAI's opt-out of training)
• For maximum data privacy, Customers may use fully self-hosted, open-source models (Llama, Mistral, Qwen, etc.) via Ollama, ensuring no data ever leaves their private infrastructure

14.2 Third-Party AI Provider Policies

When using cloud-based AI models, the relevant provider's data usage policies apply to API calls. SideKik selects providers that offer enterprise API agreements with no-training commitments. Customers are encouraged to review the data usage policies of their configured AI model providers.

15 Children's Privacy

SideKik's Services are designed for business use and are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected such information, please contact us immediately at [email protected] and we will promptly delete it.

16 International Data Transfers

SideKik's primary infrastructure is hosted in the United States. For Customers in the EEA, UK, or other jurisdictions with data transfer restrictions, we offer the following transfer mechanisms:

• Standard Contractual Clauses (SCCs): Incorporated into our DPA for EEA/UK customers
• UK International Data Transfer Agreement (IDTA): Available for UK customers post-Brexit
• Regional Hosting: Enterprise customers may request infrastructure deployment in specific geographic regions (EU, UK, APAC) to satisfy data residency requirements

17 Changes to This Policy

SideKik may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify registered Customers via email at least 30 days before material changes take effect
• Post a prominent notice on our website

Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree with the changes, you may terminate your account and request deletion of your data.

18 Contact Us

For any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact: