Sidecar Intel — Privacy Policy
Location: https://signaldesk-azure-mu.vercel.app/privacy · Effective date: October 16, 2026 · Last updated: October 16, 2026
1. Who we are
Sidecar Intel is a sole proprietorship (d/b/a) of Zak Taylor, an individual based in California, USA ("we", "us"). We are responsible for the personal data described here (and a "business" for California purposes, to the extent the CCPA applies). Contact: boltmetta@gmail.com. We operate online only, and email is the way to reach us for all privacy matters.
Where the Service is offered. The Service is not offered to anyone in the European Union, the European Economic Area, the United Kingdom or Switzerland, and this policy is written for users in the United States and other places outside those regions. Please do not subscribe or send us personal data if you are located or established there.
2. Whose data this covers
(a) Customers and users (people who sign up, pay, or receive Digests); (b) website visitors; and (c) people who appear in Digests – e.g. founders, company accounts and other individuals whose public X posts or public web content we analyze (§4).
3. Data we collect about customers and visitors
If you arrive through a link with a campaign tag (for example ?ref=x-am), we add one to a daily count for that tag and page. If you then click through to our pricing or start a checkout, we add one to a daily count for that step. We don't store your IP address, browser details or any identifier with those counts, and they don't use cookies. If you go on to buy, the tag is attached to your Stripe checkout so we can tell which link led to a sale.
| Category | Examples | Source |
|---|---|---|
| Account & contact | name, email, company (if any), Google account email used to share Digest Docs with you | you |
| Customer Inputs | competitors, keywords, X handles, URLs you ask us to track | you |
| Billing | plan, billing name/address, tax ID (where collected), invoice history, last 4 digits/card brand. Card data is collected and stored by Stripe, not us. | you, Stripe |
| Communications | support emails, email delivery/bounce events (Resend open/click tracking is turned off) | you, Resend |
| Usage & logs | IP address, browser/device, pages/requests, timestamps, errors | automatically (Vercel/Neon logs) |
| Waitlist / early access | email address, which waitlist you joined, consent record and timestamp, IP-based rate limiting | you |
| Cookies | essential cookies only (currently set by Stripe's hosted checkout) — see Cookie Notice | automatically |
4. Public data about people who appear in Digests
To build Digests we collect publicly available content only through the official X API (we do not scrape x.com) and from public web pages that require no login (e.g. blogs, changelogs, launch pages): e.g. X display names, @handles, profile bios, public posts and engagement counts. This may include personal data of people who are not our customers. We do not collect private/protected posts, DMs, or content behind logins.
- What Digests show: Digests are link-first — a short excerpt or our automated summary, with the author's handle linking back to the original post or page. We do not republish full posts or articles.
- Sensitive-topic filter: we run a filter designed to exclude sensitive topics (e.g. health, religion, political opinions, sexual orientation) from Digests. No filter is perfect; tell us if something slips through and we'll remove it.
- Limits: we focus on professional and public content, keep source data only briefly, and honor removal requests.
- Ask to be excluded: anyone can object or ask to be excluded from Digests at boltmetta@gmail.com (subject "Digest removal"). We add your handle/name to our suppression list (kept only to honor the request), stop including you in future Digests, and delete stored copies we control within 30 days. Content deleted or changed on X is removed from our systems within 24 hours.
- California: information lawfully made available to the general public is largely excluded from "personal information" under the CCPA; we still honor removal requests.
5. How we use data
| Purpose | Data |
|---|---|
| Create accounts, deliver Digests, provide support | account, Customer Inputs, contact |
| Billing, invoicing, tax and accounting records | billing, tax ID (where collected) |
| Compile, rank and summarize Digests from public sources (automated) | public data (§4), Customer Inputs |
| Tell you when early access or a waitlisted plan opens, if you joined a waitlist (you consent when you join and can unsubscribe at any time by emailing us) | email, waitlist joined |
| Security, fraud prevention, debugging, logs | usage/logs, cookies |
| Service emails (receipts, renewals, changes) | contact |
| Product marketing email (if any), always with an opt-out | contact |
| Legal compliance, disputes | as needed |
Digests are ranked and summarized by automated processes. We do not use personal data for automated decisions with legal or similarly significant effects, and we do not use customer data or X content to train AI models. We do not currently use any third-party AI/LLM service; if we add one, we'll update the subprocessor list and give notice first.
6. Sharing and subprocessors
We share data only with service providers acting on our instructions, as required by law, or in a business transfer. We do not sell personal information and do not "share" it for cross-context behavioral advertising (we use no ad pixels or trackers).
| Vendor | Purpose | Data | Location |
|---|---|---|---|
| Vercel Inc. | app hosting, edge/CDN, logs | all app traffic, logs | US (+ global edge) |
| Neon (a Databricks company) | Postgres database | account, inputs, digest data | US — AWS us-east-1 |
| Stripe, Inc. | payments via Stripe-hosted checkout (checkout.stripe.com), invoicing | billing, card data (Stripe only) | US/global |
| Resend | transactional email such as receipts and account notices, once enabled (open/click tracking off) | email address, email content | US |
| Google LLC | Digest Docs (Google Docs/Drive, owned by the Sidecar Intel Google account and shared with you); Gmail for email delivery | recipient email, Digest content | US/global |
| X Corp. | data source (official API) | Customer Inputs sent as API queries (e.g. handles/keywords) | US |
We will list any change to these vendors in this section, and update the "Last updated" date above. We do not currently use any third-party AI or language-model service.
7. Where data is processed
We are based in the US, and your data is processed and stored in the US (and by our vendors in the places listed in §6). By using the Service you understand your data will be processed in the US.
8. Retention
- Delivered Digests and related records: kept for 12 months, or deleted within 30 days of account closure if that is sooner.
- Account and Customer Inputs: for the life of the account, then deleted within 30 days of account closure.
- Raw source data (including X content): we delete it on a rolling basis, with a target of 30 days.
- Content deleted or changed on X: we remove or update it in our systems when we detect the change and as X's terms require.
- Billing/tax records: at least 7 years, or longer where the law requires. Billing records are held by Stripe as our payment processor.
- Logs: we keep no logs of our own beyond the built-in logs of our hosting and database providers (Vercel, Neon), which they keep for short periods under their own policies. Our own logs contain no personal data.
- Waitlist: until we have told you about the plan or feature you joined for, or you ask us to delete it, and no longer than 12 months.
- Suppression list: as long as needed to honor exclusion requests.
- Backups: deleted data may remain recoverable in backups for a short period: our database keeps a restore window of up to 6 hours, and deleted Google Docs stay in trash for up to 30 days before permanent deletion.
9. Security
Reasonable administrative, technical and physical safeguards: TLS in transit, provider-managed encryption at rest, limited access to production systems, and secrets kept in protected environment settings. No system is perfectly secure; we'll notify affected people and regulators of breaches as required by law.
10. Your rights
- California (CCPA/CPRA) and other US states with privacy laws: right to know/access, delete, correct, opt out of sale/sharing (we don't sell or share), limit use of sensitive personal information (we don't use it for such purposes), and non-discrimination. We respond within 45 days and may verify your identity; authorized agents may submit requests.
- Other places: if your local law gives you privacy rights, email us and we will consider your request.
- How: email boltmetta@gmail.com with subject "Privacy request".
11. Marketing email
Transactional emails (receipts, Digests, account notices) are part of the Service. Any marketing email will follow CAN-SPAM (accurate headers/subject, identified as an ad where applicable, a valid postal address, a working unsubscribe honored within 10 business days) and other applicable law.
12. Cookies
We use essential cookies only. We use no third-party analytics, advertising pixels or tracking cookies. We do not use embedded X posts or other third-party tracking, and we do not track email opens or clicks. See our Cookie Notice at https://signaldesk-azure-mu.vercel.app/cookies.
13. Children
The Service is for adults (18+) and is not directed to children (under 13 in the US). We don't knowingly collect children's data; contact us to delete it.
14. Changes
We'll post updates here with a new "Last updated" date and notify customers (by email or on the Service) about material changes before they take effect.
15. Contact
Sidecar Intel (a sole proprietorship of Zak Taylor), boltmetta@gmail.com.