Privacy Policy

Effective date: 20 October 2026

Version: 1.1

Sidekicklabs Pte. Ltd. (UEN 202405798H), 160 Robinson Road, #14-04, Singapore Business Federation Centre, Singapore 068914 ("Sidekick", "we", "us") is the controller of your personal data. You can reach our Data Protection Officer at [email protected].

This policy explains what we collect, how we use it, who we share it with, and your choices and rights.

1. What we collect

  • Account details — your name and email (from Google Sign-In), date of birth (see Section 8), display name, the country you live in, and an account identifier we assign.
  • What you share with Sidekick — your conversations with the assistant and the photos and voice messages you send it; bookings you make through Sidekick; and the travel-diary entries you create in the app, such as your photos and captions. No facial recognition is run on your photos.
  • Location and experiences — with your permission, your device's location while you use the app, so Sidekick can give you help and information that fit where you are. In some places Sidekick offers an experience — content made for that place, sometimes with a partner organisation that provides official information — and we record that you took part and how you used it. Your location is also sent with your questions to the assistant, so its answers fit where you are.
  • Device and diagnostic data — crash and error reports and, in the Android app, masked recordings of a small sample of app sessions, to find and fix problems. Recordings are designed so that text and images on screen are replaced with blank boxes before a recording leaves your phone, showing only how the app behaved — which screens were open, where you tapped, and any errors — never what you typed, what the assistant replied, or your photos. Recordings contain no sound. We also collect device identifiers: a random installation ID attached to crash reports and recordings, and the installation identifier and notification token that Google's notification service creates so the Android app can receive notifications.

If you share information about other people — in a photo, a message, or a booking you make for someone else — please make sure you are entitled to share it with us.

2. How we use it

We use your information to provide and personalise Sidekick, improve and develop it, keep it safe, support you, fix problems, and meet our legal obligations. For users in the EU and UK, our legal bases under the GDPR are:

  • Contract (Art 6(1)(b)) — the assistant (including your location when you ask it something), help and content for where you are, your account, and your bookings and itinerary.
  • Legitimate interests (Art 6(1)(f)) — security and abuse prevention, fixing problems, improving and developing Sidekick (for example, testing how well the assistant answers), and aggregate, anonymised analytics for us and our partner organisations. You can object to this (see Section 9).
  • Consent — the website waitlist, and health or religious information you choose to share (below). You can withdraw consent at any time.
  • Legal obligation — where the law requires us to process or keep data.

Health and religious information. Some things you might tell Sidekick can reveal your health or your religious or philosophical beliefs, which the law treats as sensitive: for example an allergy, a mobility need, a health consideration for an activity, or a halal or kosher diet. Please don't share this kind of information unless it's genuinely needed for what you're asking Sidekick to help with. If you do choose to share it, in a conversation or as a preference in the app, you explicitly consent to us using it for that limited purpose: taking it into account in the help Sidekick gives you. Sidekick may remember it so you don't have to repeat it. We never use it for advertising.

You can withdraw this consent at any time: change your choices in Dietary Preferences or AI Memory (both in Settings), or email [email protected] and we will delete what Sidekick remembers about it. Withdrawing doesn't affect what happened before. Messages you have already sent stay until you delete your account or ask us to delete them (Sections 6 and 9).

Our AI and speech providers may not use your photos, conversations, voice messages or diary content to train their models. They process your content only to return a response to you and, for some, to check for abuse. We do not use your personal data to train our own AI models; where we develop our own models, we use synthetic or anonymised data.

3. The AI assistant

Sidekick's assistant runs on AI models and services from specialist providers, which process your requests on our behalf — what you type, photos you ask about, voice messages, web searches it runs for you, and replies read aloud — mainly in Singapore or the United States (see Section 5). You are always told when you are interacting with the AI. It recommends and personalises; it does not make decisions with legal or similarly significant effects about you.

4. Who we share it with

  • Partner organisations — in some places we work with partner organisations, such as attractions, that provide official content for an experience. They receive only aggregate, anonymised analytics about how their experience is used — never your identity, location, conversations or photos, unless you choose to share them with that partner.
  • Service providers that process personal data on our instructions under a data-processing agreement: hosting and storage, AI models, speech-to-text and text-to-speech, web search, sign-in, app notifications, email delivery, crash diagnostics, and our website host. Ask us at [email protected] for the current list, what each does, and where.
  • Booking and ticket providers, when you choose to book — when you book or buy through a link in Sidekick, you complete it with the provider, and their own privacy policy covers what you give them. We share with them only what is needed to complete what you asked for.
  • App stores and operating-system providers.
  • Professional advisers, such as lawyers, auditors and insurers, under a duty of confidentiality.
  • Authorities and others where needed — to comply with the law or a valid legal request, to establish, exercise or defend legal claims, or to protect the rights, safety or property of our users, the public or Sidekick, including preventing fraud and abuse.
  • A buyer or successor — if Sidekick is involved in a merger, acquisition, financing, reorganisation or sale of assets, personal data may be transferred as part of it, and stays protected by this policy.

We do not sell your personal data or share it for cross-context behavioural advertising.

5. Data sent abroad

Sidekick is hosted in Singapore. Some of our service providers process data elsewhere — mostly in the United States, and in some cases in the EU or on a provider's global infrastructure. They include our AI language-model provider, an image-recognition step, cloud text-to-speech, web search, the Android notification service, email delivery and crash diagnostics. We protect these transfers with Standard Contractual Clauses (with the UK Addendum where applicable) and, where the provider holds it, EU–U.S. Data Privacy Framework certification. Ask us at [email protected] for the list of providers and a copy of the safeguards. Sidekick is not offered in mainland China, or in some other countries and regions that we do not currently serve.

6. How long we keep it

We keep personal data while your account is active, and for the periods below.

  • Your account and what's in it — your profile and what Sidekick remembers about you, your conversations (including photos and voice messages), itinerary and bookings, diary, and the experiences you have taken part in — for the life of your account. When you delete your account (in the app under Settings › Profile, or by emailing us), access ends straight away and the data is erased after 30 days.
  • Location history and diagnostic records — your device's location readings, crash reports and masked session recordings — up to 90 days, then deleted automatically.
  • The assistant's working copy of a conversation — the copy our AI system uses while you are chatting, kept separately from your saved conversation history — deleted about a day after the conversation ends.
  • Compliance audit logs — records of what processing happened, including your email address and IP address but never message contents, kept for 5 years, including after you delete your account.
  • Content our AI and speech providers process — our AI model providers may keep it for up to 30 days to check for abuse, then delete it. Our speech-to-text provider does not keep the audio of your voice messages. Our cloud text-to-speech providers keep nothing, or keep the reply text and audio until we delete them, which we do within 24 hours; deleted copies leave the provider's backups within 30 days.
  • Backups — erased data can remain in encrypted, restore-only backups for up to 7 days, until they roll off.

We may keep some data longer where the law requires it, or where we need it to resolve a dispute, establish or defend a legal claim, prevent fraud or abuse, or enforce our terms.

7. Security

We use safeguards designed to protect your data, including encryption in transit and at rest in our databases and file storage, and access limited to staff who need it for their role. No system is perfectly secure, so we cannot guarantee the security of your data; we notify you and regulators of breaches where the law requires.

8. Children

Sidekick is for people aged 18 and over. We ask for your date of birth at sign-up to confirm you are 18 or over; we use it only for that check and do not store it. If you believe someone under 18 has given us personal data, contact us at [email protected] and we will take steps to delete it.

9. Your rights

Depending on where you live, data-protection law gives you rights over your personal data, and we honour requests made under it. These can include asking us to access, correct or delete your data, give you a copy in a portable form, or restrict some processing, and withdrawing a consent you have given. You have the right to object to processing based on our legitimate interests (Section 2). These rights have limits and exceptions set by law, and we may decline or limit a request where the law allows — for example, where it would reveal other people's data or where we must keep the data. You can also complain to the data-protection authority where you live.

To make a request, email [email protected]. We may need to verify your identity first, and we respond within the time the law requires, usually 30 days. You can delete your account yourself in the app, under Settings › Profile › Delete account.

10. Our website

Our website collects what you submit: waitlist sign-ups (name, email, age range and travel frequency, on your consent; 18+; unsubscribe any time) and partner enquiries (on our legitimate interest in replying). Form data is hosted by our website provider in the United States under Standard Contractual Clauses. Website analytics are cookie-free, with no persistent identifiers.

11. Changes

We may update this policy; the effective date at the top shows the current version. We will tell you in the app when a material change takes effect, and ask for your agreement where the law requires it.