Privacy Policy

1. Introduction

SideKick360 is a product and service operated by 9DATA9 LLC, a legally registered limited liability company in the United States.

2. Information We Collect

Account Information

When you create an account, we collect:

Name and contact information (email address, phone number)
Business name and address
Job title or role
Billing and payment information (processed through our third-party payment processor)
Account credentials (email and hashed password)

Shop Management System Data

When you connect your shop management system, we may access and import:

Repair orders and service history
Customer names and contact information
Vehicle information (year, make, model, VIN, mileage)
Parts and labor details
Invoice and payment records
Technician assignments and productivity data
Appointment and scheduling data

Usage Data

We automatically collect certain information when you use the Platform:

Browser type and version
Device information and operating system
IP address and approximate location
Pages visited and features used within the Platform
Timestamps and session duration
Referring URLs and search terms that led you to our website

3. How We Use Your Information

We use the information we collect for the following purposes and legal bases:

Providing and maintaining the Platform — to deliver the core features of SideKick360, including analytics, reporting, and maintenance scheduling (Legal basis: Performance of contract)
Improving and developing new features — to analyze usage patterns and feedback to enhance the Platform’s functionality and user experience (Legal basis: Legitimate interest)
Communicating with you — to send service updates, security alerts, support messages, and administrative notices (Legal basis: Performance of contract / Legitimate interest)
Processing payments — to manage billing, invoicing, and subscription management through our third-party payment processor (Legal basis: Performance of contract)
Ensuring security — to detect, prevent, and address fraud, abuse, security risks, and technical issues (Legal basis: Legitimate interest / Legal obligation)
Complying with legal obligations — to meet applicable legal, regulatory, and tax requirements (Legal basis: Legal obligation)
Marketing and promotions — to send product updates, newsletters, and promotional content where you have opted in or where permitted by applicable law (Legal basis: Consent / Legitimate interest)
Generating aggregated insights — to create anonymized, non-identifiable industry benchmarks and analytics (Legal basis: Legitimate interest)

4. Automated and AI Processing

SideKick360 includes a combination of deterministic (rules-based) automated processing and machine learning processing. To provide transparency about where artificial intelligence is and is not applied, these are described separately below.

Maintenance Hunter — OE Schedule Application (Deterministic)

Maintenance Hunter applies published manufacturer maintenance schedule intervals (mileage and time-based) as static reference values against each vehicle’s recorded service history. This portion of the feature is deterministic and rules-based. It does not use artificial intelligence or machine learning to process, train on, or infer from OE maintenance data. Manufacturer maintenance intervals are applied as published, without modification, inference, or generative processing.

Maintenance Hunter — Service History Analysis (Machine Learning on Your Shop Data)

To determine whether a scheduled service has previously been performed on a given vehicle, SideKick360 applies machine learning techniques to your shop’s own repair order and service history data. This processing standardizes variable service descriptions within your Shop Data (for example, recognizing that “LOF,” “Oil Service,” and “Full Synthetic Oil Change” represent the same underlying service category) and identifies prior service events from your own records. This machine learning processing is applied exclusively to Shop Data owned by you; it does not process, train on, or infer from third-party OE maintenance data or other licensed third-party content. Outputs are decision-support recommendations only and do not constitute automated decision-making with legal or similarly significant effects under GDPR Article 22.

AI Chatbot Assistant

The public SideKick360 website includes an AI chatbot powered by Anthropic (Claude). The chatbot assists with general Platform questions, navigation, and support. Important disclosures regarding the chatbot:

The chatbot processes conversational inputs you provide directly in the chat interface
No personally identifiable information (PII) from your Shop Management System integrations is sent to the third-party AI provider (Anthropic)
The chatbot does not access or make recommendations from OE maintenance data
Chatbot conversation transcripts are retained for 90 days for quality improvement and support purposes, then permanently deleted
You may opt out of chatbot transcript retention by contacting support@sidekick360.app

Analytics and Reporting

The Platform uses automated processing to generate performance reports, identify trends, and surface operational insights from your Shop Data. These reports are generated entirely within our infrastructure and are not shared with third-party AI providers.

You have the right to request human review of any automated processing that significantly affects you. Contact us at support@sidekick360.app to exercise this right.

5. How We Share Your Information

We do not sell your personal information or Shop Data. We may share your information only in the following circumstances:

Service Providers — We share data with trusted third-party service providers who assist us in operating the Platform, including cloud hosting (Amazon Web Services), payment processing, email delivery, and customer support tools. These providers are contractually obligated to protect your data and use it only for the services they provide to us.
AI Service Providers — Conversational inputs to our AI chatbot are processed by Anthropic (Claude). No Shop Data or PII from SMS integrations is shared with Anthropic. Anthropic’s data handling is governed by their privacy policy and our data processing agreement with them.
SMS Integration Partners — Limited data exchange occurs with your shop management system provider as necessary to maintain the API integration. The scope of this exchange is determined by the SMS provider’s API specifications.
Legal Requirements — We may disclose your information if required to do so by law, regulation, legal process, or governmental request.
Business Transfers — In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.
With Your Consent — We may share your information with third parties when you explicitly consent to such sharing.

6. Data Security

We implement industry-standard security measures to protect your information, including:

Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
Regular security assessments and vulnerability testing
Access controls and authentication requirements
Monitoring and logging of system access
Employee security awareness training
Incident response procedures

While we strive to protect your information, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security but are committed to promptly addressing any security incidents in accordance with applicable notification requirements.

7. Data Retention

We retain your information for as long as necessary to provide our services and fulfill the purposes described in this Privacy Policy. Specific retention periods are as follows:

Account and profile data — Retained while your account is active, plus 90 days after account closure to allow for reactivation or data export requests
Shop Management System data — Retained while your account is active and deleted within 90 days of account termination, unless you request earlier deletion or an export
Billing and payment records — Retained for 7 years after the transaction date to comply with tax and financial reporting obligations
AI chatbot conversation transcripts — Retained for 90 days, then permanently deleted
Server and application logs — Retained for 12 months for security monitoring and debugging purposes
Backup copies — Purged within 30 days of the source data’s scheduled deletion date
Marketing consent records — Retained for the duration of consent plus 3 years for compliance documentation
Anonymized and aggregated data — May be retained indefinitely as it cannot be used to identify any individual or business

You may request earlier deletion of your data by contacting us at support@sidekick360.app, subject to our legal obligations to retain certain records.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on the Platform:

Essential Cookies — Required for the Platform to function properly, including authentication and session management. These cannot be disabled.
Analytics Cookies — Help us understand how users interact with the Platform so we can improve functionality and user experience. We use Google Analytics with IP anonymization enabled.
Preference Cookies — Remember your settings and preferences for future visits.

We do not use advertising or third-party tracking cookies. You can manage cookie preferences through your browser settings. Disabling essential cookies may affect Platform functionality.

9. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal information:

Right of Access — Request a copy of the personal information we hold about you
Right to Rectification — Request correction of inaccurate or incomplete personal information
Right to Erasure — Request deletion of your personal information, subject to legal retention requirements
Right to Restrict Processing — Request that we limit how we use your personal information
Right to Data Portability — Request your personal information in a structured, commonly used, machine-readable format (CSV or JSON)
Right to Object — Object to processing based on legitimate interests or for direct marketing purposes
Right to Withdraw Consent — Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing
Right to Non-Discrimination — Exercise your privacy rights without receiving discriminatory treatment

To exercise any of these rights, please contact us at support@sidekick360.app. We will respond to your request within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing certain requests.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to Know — You may request disclosure of the categories and specific pieces of personal information we have collected, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share your information.
Right to Delete — You may request that we delete your personal information, subject to certain exceptions.
Right to Opt-Out of Sale/Sharing — We do not sell or share your personal information for cross-context behavioral advertising purposes.
Right to Correct — You may request correction of inaccurate personal information.
Right to Limit Use of Sensitive Personal Information — You may limit our use of sensitive personal information to purposes necessary to provide the Platform.

To exercise your California privacy rights, contact us at support@sidekick360.app or call us at the number listed on our website. We will not discriminate against you for exercising your CCPA rights.

11. International Users and GDPR

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) or equivalent legislation applies to our processing of your personal data.

Legal bases for processing your data are specified in Section 3 of this Privacy Policy. In addition:

Data Controller — 9DATA9 LLC d/b/a SideKick360 acts as the data controller for personal information collected directly from you (account data, usage data). For Shop Data imported from your SMS, you are the data controller and we act as the data processor.
Cross-Border Transfers — Your data is processed and stored in the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission and supplementary technical measures to ensure adequate protection for international data transfers.
Data Protection Officer — For GDPR-related inquiries, contact our privacy team at privacy@sidekick360.app.
Supervisory Authority — You have the right to lodge a complaint with your local data protection authority if you believe our processing of your personal data violates applicable law.

Our Data Processing Addendum, available at sidekick360.app/dpa.pdf, provides additional details on our obligations as a data processor.

12. Children’s Privacy

The Platform is designed for use by automotive repair businesses and is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe we have inadvertently collected information from a minor, please contact us at support@sidekick360.app.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated through the Platform, email notification, or other reasonable means at least 30 days before they take effect.

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

The “Last Updated” date at the top of this page indicates when this Privacy Policy was last revised.

14. Governing Law

This Privacy Policy is governed by the laws of the State of Arizona.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

9DATA9 LLC d/b/a SideKick360

Gilbert, AZ

Email: support@sidekick360.app

Privacy inquiries: privacy@sidekick360.app

Website: sidekick360.app

For data protection inquiries related to the GDPR, please contact our privacy team at privacy@sidekick360.app.