SideKickCo - Privacy Notice & Sub-processor List
Effective Date: 5th June 2026
1. Who We Are and What This Notice Covers
Launch Mode Ltd trading as SideKickCo ("we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Notice explains how we look after your personal data when you visit our website or use our services as a business customer.
Crucial Distinction: Controller vs. Processor
When you sign up for our service: We collect your name, email, billing details, and account preferences. For this data, we act as the Data Controller. This Privacy Notice explains how we handle this data.
When your clients call your SideKickCo number: We process caller audio, phone numbers, and transcripts purely to provide the AI booking service to you. For this caller data, you are the Data Controller, and we are your Data Processor. Our handling of caller data is governed strictly by our Data Processing Agreement (DPA) with you, not this general Privacy Notice.
2. The Data We Collect About You
We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped together as follows:
Identity Data: First name, last name, business name.
Contact Data: Billing address, email address, and telephone numbers.
Financial & Transaction Data: Payment card details (processed securely via Stripe; we do not store full card numbers) and details about payments to and from you.
Technical & Usage Data: Internet protocol (IP) address, browser type, time zone setting, operating system, and information about how you use our website and service.
Marketing & Communications Data: Your preferences in receiving marketing from us and your communication preferences.
3. How We Use Your Data & Our Lawful Bases
| Purpose / Activity | Type of Data | Lawful Basis for Processing |
|---|---|---|
| Registering you as a new customer and managing your account | Identity, Contact | Performance of a contract with you |
| Processing recurring subscription payments and collecting fees owed | Identity, Contact, Financial, Transaction | Performance of a contract; Legitimate interests (to recover debts due to us) |
| Managing our relationship with you (e.g., notifying you of changes to terms, privacy policies, or service outages) | Identity, Contact, Marketing & Communications | Performance of a contract; Legal obligation; Legitimate interests (keeping our records updated) |
| Administering and protecting our business and website (troubleshooting, data analysis, testing, system maintenance) | Identity, Contact, Technical | Legitimate interests (for running our business, provision of IT services, network security) |
| Sending B2B marketing communications about SideKickCo features and offers | Identity, Contact, Marketing & Communications | Legitimate interests (to develop our products and grow our business). You may opt out at any time. |
4. Authorized Sub-processors & Third Parties
To provide the SideKickCo service, we rely on carefully vetted third-party service providers. Some of these providers process your customers' caller data on our behalf (Sub-processors), while others only process your account/billing data.
| Provider | Function / Purpose | Location of Processing |
|---|---|---|
| Twilio | Telephony infrastructure, call routing, SMS notification | USA / UK / EEA |
| Vapi | Voice AI orchestration and telephony bridging | USA |
| OpenAI | Conversational logic, lead qualification reasoning | USA |
| ElevenLabs | Text-to-speech (TTS) voice generation | USA / EEA |
| Hetzner | Cloud infrastructure and server hosting for workflows | EU (Germany / Finland) |
| n8n | Workflow automation and data routing (Self-hosted) | EU (via Hetzner) |
| Supabase | Database hosting and data storage | EU / UK |
| Google Workspace | Cloud infrastructure, database mirror, lead logging | EEA / UK |
| Resend | Transactional and lead-notification email delivery (incl. caller lead details) | USA |
| Stripe | Payment processing (Independent Data Controller) | USA / EEA / UK |
5. International Data Transfers
Many of our external third parties are based outside the UK so their processing of your personal data will involve a transfer of data outside the UK. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data (such as the EEA or the US-UK Data Bridge).
Where we use certain service providers not covered by an adequacy decision, we use specific contracts approved for use in the UK (the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs) which give personal data the same protection it has in the UK.
6. Data Retention
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements. By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes.
7. Your Legal Rights
Under UK data protection laws, you have rights in relation to your personal data, including the right to:
Request access to your personal data (a "data subject access request").
Request correction of the personal data that we hold about you.
Request erasure of your personal data.
Object to processing of your personal data where we are relying on a legitimate interest.
Request restriction of processing of your personal data.
Request the transfer of your personal data to you or to a third party.
Withdraw consent at any time where we are relying on consent to process your personal data.
8. Contact Us & Complaints
If you have any questions about this Privacy Notice or our privacy practices, please contact us at: legal@sidekickco.co.uk.
You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.