Privacy Policy

Scope and Customer Conversations

This Policy covers our handling of account information and information collected through our own website and Service. When a business uses Sidetalk to communicate with its customers, that business determines the purposes of processing its customer information, and we process that information on its behalf to deliver the Service.

If you interact with a Sidetalk chatbot on another business's website, review that business's privacy notice and contact it about your conversation data. We assist the business with requests relating to information it controls.

1. Why We Process Personal Information

• Register and manage accounts; verify identity, age, consent, or account closure where necessary.
• Provide the Service, manage customer support, and communicate operational or policy notices.
• Prevent account misuse, fraud, security incidents, and violations of our Terms; retain records needed for disputes.
• Analyze service activity and usage to maintain and improve features and, where permitted, provide personalized content or advertising.
• Protect service security, privacy, and reliability, and fulfill applicable legal obligations.

We do not use personal information for purposes outside those disclosed without taking the steps required by applicable law, including obtaining additional consent where required. The restrictions on Google user data below apply even where a general purpose listed above would otherwise allow processing.

Google API Data and Limited Use

If you connect Google Calendar, Gmail, or Google Sheets, we access and process Google user data only to provide the integration features you explicitly request, using the minimum permissions and data needed.

We do not use Google user data for advertising, marketing, profiling, personalized or retargeted advertising, data sales or resale, credit assessment, lending, general service improvement, or developing, training, or improving general-purpose AI or machine-learning models. We do not sell, transfer, or disclose Google user data to third parties except as necessary to provide your requested integration features and as permitted by the Google API Services User Data Policy.

Our use of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements. Connecting a Google account is optional, and you can disconnect it using the controls provided in the Service.

2. Information We Process

Information collected depends on the features you use and the information you provide. Do not submit personal information you lack authority to share. Sensitive information requires any additional protections and consent required by applicable law.

3. Retention

We retain personal information for the disclosed purpose and the period agreed to when it is collected, or for a period required or permitted by law. Information is deleted when its purpose or retention period ends, unless a legal retention obligation applies.

Google OAuth tokens and integration information are retained only while the integration is provided and are deleted without undue delay when you disconnect the account or terminate the service agreement. Google user data is retained only as long as needed for the requested integration and deleted without undue delay when its purpose ends or you request deletion, except where legally required retention applies.

4. Use and Disclosure

We use information within the purposes disclosed at collection. We do not use or disclose it beyond that scope without prior consent, except where permitted by law, including lawful requests from authorities, processing necessary to perform the service agreement, or use of information that has been rendered non-identifying.

Google user data remains subject to the more specific Limited Use restrictions in Section 1.

5. Service Providers

We use providers to deliver email, hosting, databases, messaging, payments, and AI/API features. Providers receive only the information needed for their assigned services. The providers below may be used depending on your service configuration.

When a purchase is made through a separately identified payment provider or merchant of record, its privacy notice also applies to the information it processes for that transaction. Enabling an external integration may involve processing by that provider under its own terms and privacy notice.

These providers may process information outside your country of residence. The laws in those locations may differ from your local laws. Applicable requirements for cross-border transfers continue to apply; contact us for questions about processing relevant to your account.

6. Your Rights and Requests

You or your legal representative may request access to or correction of personal information, withdraw consent, or request account closure. Use the account controls provided in the Service or contact us using the details below. We may verify your identity or authority before acting.

Our policy provides for completing requests within 10 days where there is no valid reason for delay. If a request is denied or delayed on lawful grounds, we notify you of the reason and the procedure for raising an objection within 10 days. Applicable legal requirements take precedence.

Depending on your location and the law that applies, you may have additional rights, such as deletion, obtaining a copy of your information, objecting to or limiting certain processing, or making a complaint to a privacy regulator. We handle requests under the applicable rules. For conversations with another business's chatbot, contact that business first.

7. Cookies and Authentication Tokens

The Service uses cookies and authentication tokens to recognize sessions, support account access, and understand usage. Tokens are small text values stored by your browser or application. Essential authentication features may not work if you block or remove them.

You can manage cookies and local storage using your browser or device settings. If you do not wish to use essential authentication tokens, stop using the affected feature or remove the relevant application. Additional consent requirements under applicable law continue to apply.

8. Deletion

When a retention period ends, information is identified for deletion under our internal procedures and applicable law. Electronic records are deleted using methods designed to prevent recovery. Printed records are shredded or incinerated. Records that must be retained by law are handled for that limited purpose.

9. Security Measures

We maintain internal security rules, limit access according to staff responsibilities, monitor access, and restrict unauthorized access to personal-information databases. Passwords are stored using one-way hashing. Our safeguards also include encryption of personal information and preservation of access logs with measures against alteration.

Physical security for infrastructure hosted with AWS, GCP, Cloudflare, Microsoft Azure, and Oracle Cloud follows the relevant provider's data-center controls. No internet service can guarantee absolute security.

10. Camera and Microphone Features

If you use an available feature for video creation, photos, video calls, or live streaming, camera and microphone access requires your permission. Data obtained through those features is used to provide that content. It is stored on the server only when you choose to record the content.

11. Apple TrueDepth Features

Where an available feature uses Apple's TrueDepth camera for video, photos, calls, or streaming, additional camera information is used only for real-time processing for that purpose. It is not transmitted to our servers, retained, or shared with third parties.

12. Privacy Contact

For privacy questions, requests, or complaints, contact our privacy officer:

Chae Chan
Cosmosfarm Software
support@cosmosfarm.com

We update this Policy when service practices or legal requirements change and provide notice where required. The date above identifies the latest update to this English Policy.