Privacy policy

Data controller

VINCENT AUGEROT EURL, 99 rue du Clos, 38570 Tencin, France. Contact for any question about your data: contact@sidehub.io.

Data we process

We only process what the service needs:

• Account: email address, password (stored hashed), language, or your Google, GitHub or Microsoft account id if you sign in with it.
• Workspace content: tasks, documents, workflows, schedulers, prompts, invited members, secrets (encrypted).
• Agents and runs: agent name and version, operating system, run status and duration, token usage, install diagnostics sent by the agent.
• Terminal output: it goes through our servers to be displayed in your browser, without being stored there. Your code stays on your machines.
• Problem reports: your message, the page concerned and your browser (user agent).
• Billing: handled by Stripe; we never see your card numbers.
• Audience measurement and technical errors: page views, where visits come from, clicks and sign-ups counted in aggregate, application errors (without terminal content).

Purposes and legal bases

• Providing the service, support and billing: performance of the contract.
• Service emails (verification, password, notifications you turn on): performance of the contract.
• Getting-started tips by email, which you can unsubscribe from in one click: legitimate interest.
• Security, abuse prevention, fixing errors: legitimate interest.
• Audience measurement, without cookies or identifiers: legitimate interest.
• Accounting and tax obligations: legal obligation.

Processors

Your data is never sold or rented. It is only shared with the providers the service needs:

• Railway: hosting of the application and the database.
• Amazon Web Services: sending emails (Amazon SES) and storing files.
• Stripe: payments and subscriptions.
• Sentry: technical error tracking.
• Umami: audience measurement, without cookies.
• Google, GitHub and Microsoft: only if you sign in with their accounts.
• OpenAI: only if your workspace sets its own OpenAI key, for the AI features (semantic search, assistant).
• Telegram: only if you connect a bot to receive your notifications.

Transfers outside the European Union

Some providers are located in the United States. These transfers rely on the European Commission's standard contractual clauses, or on the EU-US Data Privacy Framework when the provider is certified.

Retention

• Account and content: as long as the account is active, then deleted within 30 days of a deletion request.
• Billing data: 10 years (accounting obligation).
• Technical logs and errors: a few weeks at most.

Cookies and local storage

SideHub uses a secure session cookie (to renew your sign-in) and the browser's local storage for your session and preferences (language, theme). They are needed for the service to work, so they require no consent.

Audience measurement (Umami) sets no cookie, stores nothing in your browser and does not follow you across sites: it only produces aggregate statistics, used by us alone. No advertising cookie is used.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, and to set instructions for what happens to it after your death. Write to contact@sidehub.io: we answer within one month.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr), the French data protection authority.

Security

Traffic is encrypted (HTTPS, WSS), passwords are hashed, secrets and API keys are encrypted at rest. The agent opens no inbound port on your machines.