Security & Your Data
It’s your data.
We treat it that way.
Connecting your shop management system is a trust decision. Here is exactly what we commit to — in plain English, with a link to the policy language behind every line.
The short version
Three commitments that don’t change
You own your data.
You retain all ownership rights to your shop data. We hold a limited license to process it for one purpose: providing the platform to you.
We never sell it.
We do not sell your shop data or personal information, and we do not share your identifiable data with competitors. Ever.
You can take it back.
Leave, and your shop management system data is deleted within 90 days — sooner if you ask. You can request an export first.
How it’s protected
The safeguards behind the platform
Encrypted in transit and at rest
TLS 1.2 or higher for data in transit. AES-256 encryption for data at rest.
Privacy Policy §6 →Controlled, logged access
Access controls and authentication requirements, with monitoring and logging of system access.
Privacy Policy §6 →Tested, not assumed
Regular security assessments and vulnerability testing, plus security awareness training for our team.
Privacy Policy §6 →Incident response
Documented incident response procedures, and a commitment to address security incidents promptly under applicable notification requirements.
Privacy Policy §6 →Works alongside your system
Nothing to replace or migrate. Your advisors keep working in the shop management system they already use.
See integrations →No method of transmission or storage is 100% secure, and we won’t pretend otherwise. What we commit to is the set of safeguards above and prompt, honest handling if something goes wrong.
Who touches your data
Service providers, and what they’re for
Our service providers help us run the platform under confidentiality obligations. Optional AI connections receive requested shop data only after you explicitly accept the updated Terms and authorize the named service. Each shop can access only its own authorized market and store data.
| Provider type | What it’s used for |
|---|---|
| Cloud hosting (Amazon Web Services) | Running the platform and storing your data. |
| Your shop management system provider | Limited data exchange, as needed to maintain the integration. The scope is set by that provider’s own API. |
| Payment processing | Billing for your subscription. |
| Email delivery & support tools | Delivering email and answering support requests. |
| Optional AI connections, including OpenAI | Answering your requests with permitted shop data after explicit acceptance and authorization. The AI provider’s terms and settings govern its handling and retention. See Privacy Policy §16 and Terms §27. |
| Anthropic (Claude) | Powers the chatbot on this website. No shop data or PII from shop management system integrations is shared with Anthropic. |
Texting your customers through SideKick360? Consumer mobile numbers and opt-in consent are never shared with third parties for marketing — see the SMS opt-in disclosure.
Retention & deletion
How long we keep things
| Data | How long |
|---|---|
| Shop management system data | While your account is active. Deleted within 90 days of termination, or sooner on request. |
| Account & profile data | While active, plus 90 days after closure to allow reactivation or export. |
| Backups | Purged within 30 days of the source data’s scheduled deletion date. |
| Server & application logs | 12 months, for security monitoring and debugging. |
| Billing & payment records | 7 years, to meet tax and financial reporting obligations. |
To request deletion or an export, email support@sidekick360.com. Need a Data Processing Addendum for your organization? Ask at the same address. Full detail lives in the Privacy Policy and Terms & Conditions.
Questions IT and ownership ask
Straight answers
Who owns the data from my shop management system?
You do. You retain all ownership rights to your shop data. SideKick360 receives a limited license to access, process, and analyze it solely to provide the platform to you.
Do you sell or share my shop data?
We never sell your shop data or personal information or share your identifiable data with other shops. Service providers help us operate the platform under confidentiality obligations. An optional AI or MCP connection may receive requested shop data only after an authorized user explicitly accepts the updated Terms and authorizes the named service. Each connection is limited to the markets and stores your account permits.
Can an AI connection see another shop’s data?
No. Each shop can access only its own authorized data. An account responsible for multiple locations can access only its assigned markets and stores. Accepting the MCP terms does not expand those permissions. Revoking the connection stops future access; it does not delete copies already received by the AI provider.
Is my data encrypted?
Yes. Data is encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256.
Where is SideKick360 hosted?
The platform runs on Amazon Web Services (AWS) cloud infrastructure.
What happens to my data if I cancel?
Shop management system data is deleted within 90 days of account termination, and you can request earlier deletion or an export. Backup copies are purged within 30 days of the source data's scheduled deletion date. Billing records are kept for 7 years to meet tax and financial reporting obligations.
Does the website chatbot see my customers' information?
No. Conversations with the AI chatbot on this website are processed by Anthropic (Claude). No shop data or personally identifiable information from shop management system integrations is shared with Anthropic.
Do I have to replace or modify my shop management system?
No. SideKick360 works alongside the system you already run. Your advisors keep working in it exactly as they do today.
Have a security questionnaire?
Send it over.
We’ll answer it directly — or walk your IT contact through the connection on a call.
Or book a walkthrough and bring your IT lead.