SideAway Privacy Policy

SideAway, Inc. is the data controller responsible for your personal information. Contact us at: SideAway, Inc., Attn: Privacy, 7111 Santa Monica Blvd, Ste B460, Los Angeles, CA 90046, USA, or privacy@sideaway.com. We have not appointed an EU/UK representative under Article 27 GDPR; EU and UK residents may contact us directly at the address above.

• Account details — name, email address, password, and role (Client or Assistant).
• Profile information you choose to share — photo, bio, skills, languages, rates, availability, and introduction videos.
• Booking and messaging activity — booking details, in-app messages, reviews, and dispute records.
• Payment and payout information — processed by our payment processor; bank details for Assistant payouts are handled through Plaid (Section 6).
• Verification data — identity and background-check results for Assistants who complete verification, handled through third-party providers.
• Technical data — IP address, device and browser information, and usage data collected through cookies and similar technologies (Section 5).

We use personal information to operate the marketplace: to match Clients with Assistants, process bookings and payments, verify identities, prevent fraud and enforce our Terms of Service, provide customer support, improve the Platform, and send transactional and (with your consent) marketing communications.

We share personal information only as needed to run the service: with the other party to a Booking (so a confirmed Client and Assistant can work together), with our payment processor, and with the service providers listed in Section 6, each under a data processing agreement that restricts them to acting on our instructions. We may also disclose information to comply with valid legal process (see our Terms of Service) or to protect the safety of our community.

We never sell your personal information, as “sale” is defined by the California Consumer Privacy Act (CCPA/CPRA), and we do not share personal information for cross-context behavioral advertising.

Cookies are small text files stored on your device; similar technologies include local storage, session storage, pixels, and SDKs. We refer to all of them as “cookies.” We use three categories:

• Strictly necessary — authentication, session management, security, load balancing, and remembering your cookie preference. These cannot be turned off.
• Analytics & session recording — help us understand which features are used and where users get stuck. Loaded only after you click Accept all in our consent banner.
• Preference — remember your language, interface, and accessibility settings.

Your choices. Non-essential cookies load only after you click Accept all; choosing Essential only means no analytics or session-recording scripts run. To change your choice, clear the sideaway.cookieConsent.v1 value in your browser storage and the banner will reappear on your next visit. You can also block or delete cookies in your browser settings, though blocking strictly necessary cookies will prevent parts of the Platform from working.

Session recording (Hotjar). After consent, Hotjar may capture mouse movement, clicks, scroll depth, and page content on pages you visit. Sensitive fields (passwords, payment inputs) are masked. You can opt out of Hotjar globally at hotjar.com/legal/compliance/opt-out.

• Supabase — application hosting, database, authentication, and file storage.
• Plaid Inc. — connecting and verifying Assistant bank accounts for payouts. If you connect a bank account, you grant SideAway and Plaid the right to access and transmit your personal and financial information from your financial institution. Your use of Plaid is subject to Plaid's End User Privacy Policy at plaid.com/legal.
• Hotjar Ltd. — product analytics and session recording (only after consent; see Section 5).
• UserWay Inc. — accessibility widget served from userway.org.
• Email delivery provider — transactional email (account notifications, password resets, receipts).
• Payment processor — payment card processing and Assistant payouts.

Each provider is bound by a data processing agreement restricting it to processing personal data only on our instructions.

Personal data is encrypted in transit and at rest. We follow industry best practices, restrict internal access to personal data on a need-to-know basis, and rely on trusted infrastructure providers. No system is perfectly secure; if a breach affecting your data occurs, we will notify you as required by law.

Wherever you live, you can access, correct, export, or delete your account data at any time from Settings, or by emailing privacy@sideaway.com. You can unsubscribe from marketing at any time via the link in any marketing email; transactional messages (receipts, booking notices) will continue while your account is active.

A growing number of US states — including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and others — have comprehensive consumer privacy laws. Rather than offering different rights depending on where you live, SideAway extends the following rights to all US residents, regardless of state:

• Know / access — confirm whether we process your personal information and obtain a copy of it in a portable format.
• Correct — fix inaccurate personal information.
• Delete — request deletion of personal information we hold about you.
• Limit sensitive data — limit the use of sensitive personal information.
• Opt out — opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, and profiling in furtherance of decisions with legal or similarly significant effects. As noted in Section 4, we do not sell personal information or share it for these purposes.

How to exercise these rights. Email privacy@sideaway.com or use the export/delete tools in Settings. You may designate an authorized agent to submit a request on your behalf. We will verify your identity, will not discriminate or retaliate against you for exercising your rights, and will respond within 45 days (extendable by 45 additional days where reasonably necessary).

Right to appeal. If we decline a request, we will explain why, and you may appeal by replying to our decision or emailing privacy@sideaway.com with “Appeal” in the subject line. We will respond to appeals within the timeframe required by your state's law (generally 45–60 days). If your appeal is denied, you may contact your state Attorney General.

Universal opt-out signals. We honor opt-out preference signals such as Global Privacy Control (GPC) as a valid request to opt out of the sale or sharing of personal information, as required by California, Colorado, and other state laws.

California “Shine the Light” (Cal. Civ. Code § 1798.83). California residents may additionally request a list of any personal information we disclosed to third parties for their direct-marketing purposes in the prior calendar year. We do not currently disclose personal information for third-party direct marketing.

11.1 Lawful bases

We process personal data under: contract (to deliver the service you signed up for), legitimate interests (fraud prevention, platform security, and product improvement), consent (marketing communications, analytics and session-recording cookies), and legal obligation (tax, accounting, and regulatory record-keeping).

11.2 Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting prior processing. To exercise any right, email privacy@sideaway.com or use the export/delete tools in Settings. We respond within one month, extendable by two further months for complex requests, as GDPR permits.

11.3 International transfers

SideAway is based in the United States, so your data is transferred to and processed in the US. Where data is transferred out of the EEA or UK, we rely on Standard Contractual Clauses or equivalent safeguards.

11.4 Complaints

If you believe our processing violates the GDPR or UK GDPR, you may lodge a complaint with your local supervisory authority (a list of EU authorities is at edpb.europa.eu; UK residents may contact the ICO at ico.org.uk). We would appreciate the chance to address your concerns first — email privacy@sideaway.com.

SideAway is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If we learn we have collected data from a person under 18, we will delete it. If you believe a child has provided us personal information, contact privacy@sideaway.com.

We may update this Privacy Policy from time to time. Material changes will be announced by email or an in-product notice at least 30 days before they take effect. The effective date at the top of this document reflects the most recent revision.