Privacy Policy

1. Scope and Roles

This Privacy Policy applies when you visit a SideShift website, download or use a SideShift mobile application, create or use a creator, brand, or agency account, participate in a campaign, communicate through the Services, receive or make payments, use SideShift analytics or advertising tools, interact with SideShift support or sales teams, or otherwise engage with the Services.

For most personal information described in this Privacy Policy, SideShift determines why and how the information is processed and acts as the controller or business responsible for that processing. In certain business-to-business services - such as when SideShift processes a brand customer list, advertising account data, conversion events, purchase data, or other information solely on a brand or agency customer's instructions - SideShift may act as a service provider, contractor, or processor. In those situations, the applicable customer is responsible for its own privacy notices, lawful basis, permissions, and instructions, and its agreement with SideShift may contain additional data-protection terms.

This Privacy Policy does not govern a brand, agency, social network, payment processor, identity-verification provider, or other third party acting independently for its own purposes. Their privacy practices are governed by their own policies.

2. Personal Information We Collect

The personal information we collect depends on your role, how you interact with the Services, the features you use, and the information you choose to provide. We may collect the following categories:

3. Sources of Personal Information

We may collect personal information from the following sources:

• Directly from you, including when you create or update an account, apply for or manage campaigns, upload content, provide business-verification materials, make or receive payments, connect an integration, communicate with us, or exercise a privacy right.
• From brands, agencies, and other customers, such as when they invite creators by email, upload social handles, add team members, provide campaign briefs, or submit customer lists or advertising information for an optional advertising feature.
• From creators and other users, including information shared through marketplace interactions, campaign communications, ratings, approvals, and disputes.
• From social-media platforms and third-party analytics providers, including publicly available profile information and aggregate content-performance metrics for connected or campaign-associated handles.
• From payment, payout, identity-verification, tax, fraud-prevention, and financial-service providers, including Whop, Stripe, and verification providers made available through those services.
• From advertising platforms and brand advertising accounts when a customer authorizes SideShift to manage or measure advertising activity.
• Automatically from devices, browsers, applications, cookies, pixels, logs, and similar technologies when you use the Services.
• From publicly available sources, referrals, business partners, and service providers where permitted by law.

Where a brand or agency uploads an email address or social handle to invite a creator, the creator must opt in and create an account before participating. A brand or agency that provides information about another person represents that it has the right to do so and has provided any required notice or obtained any required permission.

4. How We Use Personal Information

We may use personal information for the following purposes:

Provide and operate the Services. Create and authenticate accounts; provide creator discovery, campaign management, messaging, content workflows, analytics, payments, payouts, subscriptions, integrations, customer support, and other requested features.

Facilitate marketplace relationships. Allow creators and brands to discover one another, evaluate opportunities, contract, communicate, exchange deliverables, approve content, rate performance, and manage campaigns.

Process payments and payouts. Facilitate deposits, subscriptions, creator earnings, transfers, invoices, refunds, reversals, chargebacks, tax records, reconciliation, and accounting.

Verify users and businesses. Confirm account authenticity, verification status, business legitimacy, age eligibility, and compliance with platform rules, including requirements that creators use their correct name, location, and a genuine photograph of themselves rather than an AI avatar.

Measure and improve performance. Analyze usage, content, creator, campaign, paid advertising, conversion, and product performance; troubleshoot; conduct research; and improve the Services.

Provide advertising tools. Manage campaigns in a brand's existing ad account, store and use advertising permissions and codes, process conversion and purchase data, measure paid and organic performance, and use optional customer lists as instructed by the brand.

Personalize and recommend. Recommend creators, campaigns, content, and product features; rank applications; identify high-performing content; and tailor the user experience.

Communicate with you. Send transactional, service, security, support, administrative, product, and marketing communications through email, SMS, push notifications, in-app messaging, or connected tools.

Protect users and the Services. Detect, investigate, prevent, and respond to fraud, impersonation, stolen payment methods, unauthorized transactions, chargebacks, account takeovers, policy violations, abuse, security incidents, and unlawful conduct.

Enforce rights and resolve disputes. Enforce agreements and policies, document approvals and performance, preserve evidence, resolve complaints, respond to payment disputes, and establish, exercise, or defend legal claims.

Comply with law. Meet legal, tax, accounting, regulatory, sanctions, law-enforcement, and recordkeeping obligations, and respond to valid legal process.

Carry out corporate transactions. Evaluate or complete a financing, merger, acquisition, restructuring, sale of assets, bankruptcy, or similar transaction.

5. Payments, Payouts, Identity Verification, and Tax Records

SideShift uses third-party payment and financial-service providers to support wallet deposits, subscriptions, creator payouts, transfers, identity verification, fraud monitoring, and related functions. Wallet deposits may be processed through Whop or Stripe; Stripe may also process subscriptions; creator payouts and transfers are processed through Whop; and identity verification is performed by Sumsub as a provider within Whop's services.

SideShift does not store complete payment card numbers, bank-account numbers, government identification images, or biometric verification materials used for identity verification. Those providers may collect and process such information under their own privacy policies. SideShift may receive limited information such as payment status, transaction history, the last four digits of a payment method, verification status, fraud or risk results, and chargeback evidence.

We may use and retain payment, payout, verification, device, fraud, and account information to process transactions; prevent unauthorized activity; determine whether funds should be released, held, offset, reversed, or refunded as permitted by our agreements and applicable law; respond to chargebacks; comply with legal obligations; and protect SideShift, payment providers, creators, brands, and other users.

SideShift may collect optional W-9 or other business-verification documents from brands. Creator identity verification and tax reporting, including issuance of applicable tax forms, may be handled by Whop and its providers. Users remain responsible for providing accurate information and satisfying their own tax obligations.

6. Creator Profiles, Campaigns, and Marketplace Visibility

Creator profiles may be visible to brands and agencies using SideShift. Before a creator is hired or contracted, a brand may generally view the creator's profile, portfolio, social handles and links, content, ratings, campaign history, and performance information. A creator's direct email address and telephone number generally become available only after the creator is hired or contracted, except where the creator separately chooses to share them.

Creators may view information about campaigns and participating brands, including brand identity, campaign details, campaign history, and ratings made available through the Services. Brands and creators should use information obtained through SideShift only for legitimate marketplace and campaign purposes and in accordance with SideShift's terms.

Creators must use their correct legal name and location and a genuine photograph of themselves. Creators may not impersonate another person, create accounts for another person, or use an AI-generated avatar as their profile photo. Agencies may create subaccounts on behalf of clients where supported, but the agency's main account must use accurate company information. SideShift may use profile, device, payment, verification, and other information to enforce these requirements.

Content and campaign records may remain available to relevant brands, agencies, creators, and SideShift personnel after a campaign ends where needed to administer the relationship, document rights and approvals, provide analytics, resolve disputes, enforce agreements, or comply with law.

7. Social Media, Content Analytics, and Advertising Services

Creators may provide or connect social-media handles and content from TikTok, Instagram, YouTube, Facebook, Snapchat, and other platforms that SideShift may support in the future. SideShift may use third-party analytics providers to collect or receive aggregate performance data associated with creator accounts and campaign posts, including views, likes, comments, shares, saves or bookmarks, engagement, and follower count.

SideShift generally stops collecting new performance information for an existing creator account or handle after the applicable campaign expires or the creator or handle is removed from the campaign. Previously collected campaign analytics may be retained in accordance with Section 13.

SideShift does not seek to identify individual people who view or engage with creator content through these analytics. We generally receive aggregate metrics supplied by social platforms or analytics providers.

For paid advertising services, a brand may authorize SideShift to operate within the brand's existing advertising account. SideShift may receive advertiser account IDs and access tokens; store Spark Ads codes or Meta partnership-ad permissions; create, manage, optimize, or measure campaigns; receive conversion events, purchase data, clicks, paid and organic views, and return-on-ad-spend information; and process optional customer lists provided by the brand for targeting or measurement.

A brand that provides customer lists, conversion data, purchase data, advertising credentials, or similar information represents that it has all required rights, notices, lawful bases, and permissions. SideShift will process such information for the customer's authorized advertising services and will not use a brand's customer data to advertise SideShift or benefit unrelated customers, except in aggregated or deidentified form where permitted by law and contract.

SideShift also measures its own advertising and product conversions using technologies such as Meta Pixel and Meta Conversions API, Google Ads, Callix, RB2B, and first- and last-touch attribution. Depending on the event and configuration, we may process advertising identifiers, UTM parameters, referral and landing-page information, IP address, user agent, and hashed contact or account information. Events may include PageView, AccountCreated, OnboardingCompleted, TrialStarted, and TrialConverted. Our Cookie Policy explains associated device-storage technologies and available controls.

YouTube connections

SideShift uses YouTube API Services. When you connect YouTube, we collect and store the selected channel's identity, handle, picture, uploaded-video information, and performance and audience reports that YouTube makes available. These reports can include views, watch time, engagement, traffic sources, retention, viewer age and gender percentages, and views by country. We use this information to provide your connection and campaign reports. We store access and refresh tokens to maintain the connection. We do not receive your Google password or permission to post for you. We do not use YouTube reports to train AI models, and SideShift's AI features do not read them.

You choose which brands can see the connected channel's reports. An approval applies to the channel shown when you share. You can remove a brand's access from Account. When you disconnect YouTube from Account, SideShift's access ends and we delete the stored access tokens, the channel's name and picture, and the YouTube reports for that connection. Campaign contract records keep the channel ID, verified handle and granted permissions, and records of removed brand approvals keep the channel ID. Disconnecting does not delete your channel or videos on YouTube.

In addition to these controls, you can revoke SideShift's access through Google's security settings. Google's handling of information is described in the Google Privacy Policy. For questions, complaints, or requests to delete stored YouTube data, contact support@sideshift.app.

8. Artificial Intelligence and Automated Processing

SideShift uses, and may further develop, artificial intelligence and automated systems to recommend creators to brands, rank creator applications, identify high-performing content, detect fraud and abuse, generate campaign briefs or strategies, analyze campaign performance, and support other platform functions.

These systems may process account, profile, content, campaign, performance, device, transaction, and fraud-related information. Outputs may include recommendations, rankings, predictions, summaries, risk signals, and suggested actions. Automated outputs may be inaccurate and are generally used to support human decision-making, platform operations, and customer workflows.

SideShift may use third-party artificial-intelligence service providers or SideShift-developed models. We may change providers over time. Where required by law, we will provide additional information or choices regarding solely automated decisions that produce legal or similarly significant effects. You may contact us if you believe an automated process has materially affected your account and you would like us to review the result.

We may use information submitted to the Services to provide, secure, improve, and develop AI-enabled features. We do not permit third-party AI providers to use SideShift data for their own independent marketing. Any use for model training or product improvement will be subject to applicable law, contractual restrictions, and appropriate safeguards.

9. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients:

• Creators, brands, agencies, and authorized account users, as needed to operate the marketplace, evaluate opportunities, manage campaigns, communicate, exchange deliverables, provide analytics, and resolve disputes.
• Payment, payout, identity-verification, tax, fraud-prevention, banking, and financial-service providers, including Whop, Stripe, and providers made available through them.
• Cloud hosting, authentication, communications, customer-support, product-analytics, error-monitoring, data-storage, security, CRM, business-software, and professional-service providers.
• Social-media, advertising, attribution, and analytics platforms where you connect an account, submit a handle, authorize an integration, participate in a campaign, or use an advertising feature.
• Artificial-intelligence and data-processing providers that support recommendations, analytics, content processing, fraud prevention, campaign strategy, and related features.
• Professional advisers, auditors, insurers, accountants, lawyers, and consultants where reasonably necessary.
• Government authorities, courts, law enforcement, regulators, card networks, issuing banks, payment processors, and affected parties where required or permitted by law, including to respond to legal process, report suspected unlawful activity, investigate fraud, or defend against payment disputes and legal claims.
• Potential or actual investors, buyers, sellers, lenders, and advisers involved in a financing, merger, acquisition, restructuring, sale of assets, bankruptcy, or similar corporate transaction.
• Other parties at your direction, with your consent, or as otherwise disclosed when the information is collected.

We do not sell personal information for monetary consideration. We may disclose identifiers, internet or other electronic network activity, commercial or conversion information, and related data to advertising, attribution, analytics, and measurement providers. Depending on applicable law and the provider's role, certain disclosures may be considered a sale, sharing, or processing for targeted advertising. Where required, we provide applicable choices as described in Sections 10, 16, and 17. We may also disclose aggregated or deidentified information that cannot reasonably be linked to an individual.

10. Cookies, Pixels, and Similar Technologies

SideShift and its service providers use cookies, pixels, local storage, IndexedDB, software development kits, log files, and similar technologies to authenticate users, maintain sessions, remember preferences, protect accounts, prevent fraud, measure use and product performance, provide support functionality, attribute visits and transactions, and measure SideShift's marketing campaigns and conversions.

These technologies may collect device, browser, IP address, referral and landing-page information, UTM parameters, advertising click identifiers, page views, events, sessions, conversions, and session-replay information. Providers may include Google Analytics 4, Google Tag Manager, PostHog, Amplitude, Meta Pixel and Meta Conversions API, Google Ads, Microsoft Clarity, Callix, DataFast, RB2B, Intercom, iClosed, Firebase Analytics, RevenueCat, and Superwall. Providers and practices may change over time. Our Cookie Policy, available through the Services, describes known device-storage technologies, purposes, and durations in more detail.

SideShift provides a first-party cookie-preference tool on sideshift.app and app.sideshift.app. Optional technologies operate until you withdraw them. The notice offers OK or Manage preferences, and choices may be changed or withdrawn through Cookie Settings, including at https://app.sideshift.app/cookie-settings. SideShift may retain a necessary consent cookie and corresponding local or server-side audit record.

Where integrated, the preference tool controls optional technologies by category. Certain technologies may operate before an initial choice or outside the website preference tool, including Callix, first- and last-touch attribution storage, Amplitude on business-dashboard routes, certain landing-page features, and mobile-app SDKs. Cookie choices apply prospectively. Withdrawing a choice stops future optional browser-side and server-side events associated with the withdrawn category; information processed before withdrawal may be retained as described in this Privacy Policy and our Cookie Policy.

Some browsers offer a Do Not Track signal. Because there is no uniform industry standard for interpreting this signal, we do not currently respond to it. Where required by applicable law, we will recognize legally mandated browser-based opt-out preference signals for the activities to which they apply. Blocking certain technologies may affect Service functionality.

11. Communications, Support, and Recordings

We may communicate with you through email, SMS, push notifications, in-app messages, customer-support tools, and optional Slack or Discord integrations available to brand users. We use these communications to operate the Services, provide support, send security and transaction notices, administer campaigns, and provide product or marketing information.

You may opt out of marketing emails by using the unsubscribe link in the message and may opt out of marketing text messages by replying STOP where available. You may continue to receive non-marketing messages that are necessary for your account, transactions, campaigns, security, or legal obligations.

SideShift may record or transcribe sales calls, support sessions, interviews, onboarding meetings, and other meetings. When recording or transcription is used, a recording or note-taking participant or tool may be visibly present, and additional notice may be provided. If you do not wish to be recorded, you should raise that concern before continuing the meeting. We use recordings and transcripts for documentation, training, quality assurance, support, and business operations, subject to applicable law.

SideShift may access, review, retain, or disclose communications sent through the Services where reasonably necessary to provide support, moderate the platform, investigate fraud or policy violations, resolve disputes, enforce agreements, protect users, or comply with law.

12. Legal Bases for Processing

Where the laws of the European Economic Area, United Kingdom, Switzerland, or another jurisdiction require us to identify a legal basis, we rely on one or more of the following:

• Performance of a contract or steps requested before entering a contract, including providing accounts, marketplace services, campaign workflows, payments, payouts, analytics, and support.
• Legitimate interests, including operating and improving the Services, preventing fraud and abuse, protecting users and the platform, measuring performance, communicating with business users, enforcing agreements, and developing new features, balanced against your rights and interests.
• Consent, including where required for optional communications, certain cookies or tracking technologies, connected services, or other processing that applicable law requires to be consent-based. You may withdraw consent at any time, including through Cookie Settings for technologies controlled there, without affecting prior lawful processing.
• Compliance with legal obligations, including tax, accounting, regulatory, sanctions, law-enforcement, and recordkeeping requirements.
• Protection of vital interests or the public interest where applicable and legally permitted.

Where SideShift processes personal information solely on a customer's instructions as a processor or service provider, the customer determines the applicable legal basis and is responsible for responding to data-subject requests relating to that processing, subject to the parties' agreement.

13. Data Retention

We retain personal information for as long as reasonably necessary to provide the Services and fulfill the purposes described in this Privacy Policy, including to comply with law, maintain security, prevent fraud, resolve disputes, enforce agreements, and establish, exercise, or defend legal claims. Retention periods vary based on the type of information, the nature of the relationship, legal requirements, and operational needs.

When you delete your account, we delete or deidentify personal information that we are not required or permitted to retain. Deleting an account does not require SideShift to delete information needed to complete transactions, maintain campaign or content records, comply with law, respond to chargebacks, prevent fraud or abuse, enforce agreements, preserve suspension or termination records, or defend legal claims. We may retain a minimal suppression record to prevent a deleted or suspended account from being improperly recreated.

14. Data Security

SideShift maintains administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. These safeguards may include access controls, authentication, encryption in transit, monitoring, vendor management, incident response, and employee or contractor confidentiality obligations, as appropriate to the nature of the information and the Services.

No system, transmission, or storage method is completely secure. We cannot guarantee that personal information will never be accessed, disclosed, altered, or destroyed without authorization. You are responsible for maintaining the confidentiality of your login credentials, using secure devices and networks, and promptly notifying us if you suspect unauthorized access to your account.

15. International Data Transfers

SideShift is based in the United States and provides Services to users in multiple countries. Personal information may be transferred to, stored in, or processed in the United States and other countries where SideShift, its customers, or its service providers operate. Those countries may have data-protection laws that differ from the laws where you live.

Where required by applicable law, we use appropriate safeguards for international transfers, which may include contractual protections, transfer-impact assessments, consent, or other lawful transfer mechanisms. SideShift is not currently certified under the EU-U.S. Data Privacy Framework.

16. Your Privacy Rights and Choices

Depending on where you live and subject to applicable exceptions, you may have the right to:

• Request confirmation of whether we process your personal information and access a copy of it.
• Request correction of inaccurate personal information.
• Request deletion of personal information.
• Request restriction of or object to certain processing.
• Receive certain personal information in a portable format.
• Withdraw consent where processing is based on consent.
• Opt out of certain marketing communications.
• Manage applicable cookie, analytics, advertising, and tracking choices through Cookie Settings.
• Appeal our denial of a privacy request where applicable.
• Request information about or review of qualifying automated decision-making where applicable.
• Lodge a complaint with a data-protection authority or regulator.

You can update certain account information or delete your account through available account settings. You may manage applicable cookie and tracking choices through Cookie Settings, including at https://app.sideshift.app/cookie-settings. To submit another privacy request, email support@sideshift.app. Please describe your request and the account or email address involved. We may need to verify your identity before completing a request and may request additional information reasonably necessary for verification. Authorized agents may submit requests where permitted by law, subject to proof of authority and identity verification.

Privacy rights are not absolute. We may deny or limit a request where permitted by law, including where information must be retained to complete a transaction, protect security, prevent fraud, preserve legal claims, comply with law, protect another person's rights, or where the request is manifestly unfounded or excessive. We will not unlawfully discriminate against you for exercising a privacy right.

17. United States State Privacy Disclosures

Residents of certain U.S. states may have additional rights under comprehensive state privacy laws. The categories of personal information SideShift may collect are described in Section 2; the sources are described in Section 3; the purposes are described in Sections 4 through 8; and the categories of recipients are described in Section 9.

SideShift does not sell personal information for monetary consideration. We may disclose identifiers, internet or other electronic network activity, commercial or conversion information, and related data to service providers, contractors, advertising platforms, attribution providers, analytics providers, payment providers, and other recipients for the purposes described in this Privacy Policy. Depending on applicable law and the provider's role, certain disclosures may be considered a sale, sharing, or processing for targeted advertising. Where applicable, you may request to opt out through Cookie Settings or by contacting support@sideshift.app.

We may process information that is considered sensitive under certain state laws, such as account credentials, precise financial or identity-verification information received in limited form, optional gender information, and information used to verify identity or prevent fraud. We process sensitive personal information only for permitted purposes, to provide requested Services, for security and fraud prevention, or with consent where required. We do not use sensitive personal information to infer characteristics about you for unrelated advertising purposes.

To exercise an applicable state privacy right, email support@sideshift.app. If we deny a request and your state provides a right to appeal, you may appeal by replying to our decision and clearly stating that you wish to appeal. You may also contact your state attorney general or other applicable regulator.

18. Children and Minors

The Services are intended only for individuals who are at least 18 years old. We do not knowingly collect personal information from, permit accounts for, or market the Services to anyone under 18. If we learn that an individual under 18 has provided personal information, we may suspend or close the account and delete the information, subject to legal, fraud-prevention, safety, and recordkeeping requirements. Contact support@sideshift.app if you believe a minor has used the Services.

19. Third-Party Services and Links

The Services may include links to, integrations with, or functionality provided by third parties, including social networks, payment providers, identity-verification providers, advertising platforms, app stores, communications tools, and customer systems. SideShift is not responsible for the privacy practices of third parties acting independently. Review their privacy policies before providing information or authorizing access.

When you connect a third-party account or integration, you authorize SideShift and the third party to exchange information as necessary to provide the requested functionality. You can remove certain integrations through SideShift or the third party, but previously transferred information may be retained as described in this Privacy Policy or the third party's policy.

20. Google Workspace APIs / Limited Use

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

SideShift does not use Google Workspace or Google Calendar user data (including raw, aggregated, or derived data) to create, train, or improve foundational or generalized machine learning or artificial intelligence models. Calendar data is used only to provide scheduling features (calendar list, free/busy, and owned events).

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Services, technology, law, or our practices. We will post the updated version and revise the effective date at the top. If a change is material, we may provide additional notice through the Services, by email, or by another reasonable method. Changes become effective on the date stated in the updated Privacy Policy unless otherwise specified.

22. Contact Us

For questions, concerns, or privacy requests, contact:

SideShift Corporation
Attn: Canyon Pergande, Privacy Contact
111 Broadway, Suite 503
New York, NY 10006
United States
Email: support@sideshift.app

If you are in the European Economic Area, our EU GDPR Article 27 representative is:

Prighter EU Rep GmbH
Schellinggasse 3/10
1010 Vienna
Austria
Email: support@prighter.com

If you are in the United Kingdom, our UK GDPR Article 27 representative is:

Prighter Ltd
20 Mortlake Mortlake High Street
London SW14 8JN
United Kingdom
Email: support@prighter.com