1. Introduction

Sidekick Intelligence LLC (doing business as "Chikoh") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

2.1 Information You Provide

Account Information: Email address, name, password
Profile Information: Username, preferences, settings
League/Show Information: Fantasy league details, TV show preferences, watch party information
Payment Information: Billing details processed through Stripe and PayPal (we do not store full payment card details)
Communications: Messages sent through our AI chat feature

2.2 Automatically Collected Information

Usage Data: Pages visited, features used, time spent on the Service
Device Information: IP address, browser type, operating system, device identifiers
Location Data: General geographic location based on IP address
Cookies and Tracking: We use cookies and similar technologies to enhance your experience

2.3 Third-Party Platform Data

When you connect third-party fantasy sports platforms (ESPN, Yahoo, Sleeper, CBS, Fantrax, MFL, etc.), we may collect:

League rosters and standings
Player statistics and performance data
Transaction history
League settings and scoring rules

2.4 Platform Write Access Data (Yahoo Fantasy)

If you enable Platform Write Access for Yahoo Fantasy, we additionally collect and store:

Execution Logs: A detailed record of every action submitted to Yahoo on your behalf, including the action type, players involved, timestamps, and Yahoo API response status. These logs are retained for audit, rollback, and dispute resolution purposes.
Pre-Execution Roster State: A snapshot of your roster before each execution, enabling rollback functionality and verification.
Consent Records: Timestamped records of your per-action consent confirmations, stored for legal compliance.
OAuth Tokens: Your Yahoo OAuth access and refresh tokens, stored encrypted, used solely to authenticate write operations you have explicitly authorized. Tokens are deleted when you disconnect your Yahoo account or revoke write access.

2.5 MCP and Agent Access Data

When you access Chikoh through our MCP interface, API keys, or third-party AI platforms (Claude, ChatGPT, Gemini, etc.), we collect:

API Key Usage: Requests made, tools invoked, timestamps, and response metadata
Agent Identifiers: Agent ID headers, session identifiers, and platform source information
Query Content: The content of queries sent to our tools, used for response generation and quality improvement
Ticket Consumption: Records of ticket usage per tool invocation

2.6 Agentic Commerce Data

When you use Agentic Commerce features (execution billing, automated operations), we collect and retain:

Execution request details and parameters
Third-party passthrough cost records
Billing aggregation and settlement data
Consent records for execution billing authorization

3. How We Use Your Information

We use your information to:

Provide and maintain the Service
Generate AI-powered recommendations and insights
Process payments and manage subscriptions
Communicate with you about the Service
Improve and personalize your experience
Detect and prevent fraud or abuse
Comply with legal obligations
Send marketing communications (with your consent)
Enforce our Terms of Service and other policies
Respond to legal requests and prevent harm

4. AI and Machine Learning

We use artificial intelligence and machine learning to provide personalized recommendations. Your data may be used to:

Train and improve our AI models
Generate personalized insights and predictions
Enhance the accuracy of recommendations

We implement safeguards to protect your privacy in our AI systems, including data anonymization and aggregation where appropriate. We do not use your personal information to train models that are sold to or shared with third parties. AI model training uses aggregated, de-identified data only.

5. Information Sharing and Disclosure

We do not sell your personal information. We may share your information with:

Service Providers: Third-party vendors who help us operate the Service (hosting, analytics, payment processing)
Authentication Providers: Supabase for account management and authentication
Payment Processors: Stripe and PayPal for payment processing
AI Providers: Anthropic, OpenAI, and Google for AI model inference (queries are processed but not used to train their models per our enterprise agreements)
Legal Requirements: When required by law or to protect our rights
Business Transfers: In connection with a merger, acquisition, or sale of assets

6. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
Regular security assessments and penetration testing
Access controls and multi-factor authentication for internal systems
Secure data storage with Supabase (EU region) with Row Level Security
Encrypted storage of OAuth tokens and API keys
Automated security monitoring and alerting

However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

7. Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

Notify affected users via email within 72 hours of confirming the breach
Notify relevant supervisory authorities as required by applicable law (including GDPR's 72-hour notification requirement)
Provide details about the nature of the breach, the types of data affected, and the measures taken to address it
Offer guidance on steps you can take to protect yourself

8. Your Rights and Choices

You have the right to:

Access: Request a copy of your personal information
Correction: Update or correct inaccurate information
Deletion: Request deletion of your account and data
Opt-Out: Unsubscribe from marketing communications
Data Portability: Request your data in a portable format (JSON or CSV)
Withdraw Consent: Withdraw consent for data processing where applicable
Restrict Processing: Request that we limit how we use your data
Object to Processing: Object to processing based on legitimate interests

To exercise any of these rights, contact us at [email protected]. We will respond to verified requests within 30 days (or 45 days for complex requests, with notice).

9. Cookies and Tracking Technologies

We use cookies and similar technologies to:

Remember your preferences and settings
Analyze usage patterns and improve the Service
Provide personalized content and recommendations
Measure the effectiveness of our marketing

You can control cookies through your browser settings, but disabling cookies may limit your ability to use certain features. For detailed information, see our Cookie Policy.

10. Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. We currently do not respond to DNT signals, as there is no industry-standard interpretation of DNT. However, you can control tracking through your browser's cookie settings and opt-out mechanisms described in this policy.

11. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

12. Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately at [email protected], and we will take steps to delete such information promptly.

13. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy, including:

Our primary data storage is in the EU region (Supabase EU)
Standard Contractual Clauses (SCCs) for transfers outside the EU/EEA where applicable
Data processing agreements with all sub-processors that require equivalent protections

14. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy. Specific retention periods:

Account data: Retained while your account is active, deleted within 90 days of account deletion
Transaction records: Retained for 7 years for tax and legal compliance
Execution logs (Platform Write Access): Retained for 2 years for audit purposes
AI chat logs: Retained for 1 year, then anonymized
Analytics data: Aggregated and anonymized after 2 years

When you delete your account, we will delete or anonymize your personal information, except where we are required to retain it for legal purposes.

15. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know: Request disclosure of what personal information we collect, use, disclose, and sell
Right to Delete: Request deletion of your personal information
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out: Opt out of the sale or sharing of personal information (note: we do not sell personal information)
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
Right to Limit Use of Sensitive Personal Information: You may limit our use of sensitive personal information to what is necessary for the Service

To exercise your California privacy rights, contact us at [email protected] or submit a request through your account settings.

16. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR), including the right to access, rectification, erasure, restriction of processing, data portability, and the right to object to processing. You also have the right to lodge a complaint with your local data protection supervisory authority.

Our legal bases for processing your data include: contract performance (providing the Service), legitimate interests (improving the Service, preventing fraud), consent (marketing communications), and legal obligations (tax and regulatory compliance).

For detailed information about your GDPR rights, see our GDPR Rights page. For data processing terms, see our Data Processing Agreement.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 30 days before changes take effect. Your continued use of the Service after changes constitutes acceptance of the updated Privacy Policy. The "Last Updated" date at the top of this page reflects the most recent revision.

18. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Privacy inquiries: [email protected]
General support: [email protected]
Legal inquiries: [email protected]
Mail: Sidekick Intelligence LLC, 1021 E Lincolnway, Ste 8412, Cheyenne, WY 82001