How we handle your data

Who we are

The Renters' Rights Act Companion is a free compliance tool operated by Sidekiq, a UK AI agency. Sidekiq is the data controller for the personal information described in this policy. You can reach us at hello@sidekiq.co.uk or via sidekiq.co.uk.

What we collect

When you sign up for the Companion, we collect:

• Business email (required) — to identify your account and to contact you about the service.
• Phone number (required) — so we can reach you about the service or related Sidekiq products.
• Full name (required) — to personalise the experience.
• Agency name (optional) — so we understand the kind of business using the tool.
• Account password (required) — stored only as a one-way salted hash; we never see your plaintext password.

As you use the tool we also collect:

• Checklist progress — which compliance items you've ticked off.
• Quiz attempts — score, percentage, and answers, so we can show your history.
• Chat usage — a count of how many questions you've asked the AI per hour, used only for rate-limiting.
• Authentication cookies — to keep you signed in across visits.

What we don't collect

We don't store the chatbot conversations. Each question you ask is sent to the AI provider, answered, and discarded from our servers. We do not retain a transcript.

How we use it

• To provide the Companion (sign-in, save your progress, generate AI answers).
• To send service-related emails (account confirmation, password reset, important changes).
• To contact you about Sidekiq's other products and services. You can opt out of marketing at any time by emailing us.
• To improve the tool by understanding aggregate usage patterns (which areas are most asked about, etc.).

Who we share it with

We use a small set of third-party processors:

• Supabase (EU/London region) — stores your account and progress data, handles authentication.
• Vercel (EU edge regions) — hosts the application.
• Anthropic (USA) — provides the AI model that answers your questions. Your question text is sent to Anthropic; your name, email and other personal details are not.
• Resend (EU region, where configured) — sends transactional emails.
• Vercel Analytics — anonymous traffic analytics; does not use cookies or track individuals.

We don't sell your data to anyone, and we don't share it with third parties for their own marketing.

How long we keep it

We keep your account and progress data while your account is active. If you ask us to delete your account, we remove your data from our systems within 30 days. Anonymous aggregate analytics may be retained indefinitely.

Your rights (UK GDPR)

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your account and data.
• Withdraw consent for marketing communications at any time.
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk) if you believe we've mishandled your data.

To exercise any of these rights, email hello@sidekiq.co.uk and we'll respond within 30 days.

Changes to this policy

If we update this policy in any material way, we'll notify registered users by email and update the "Last updated" date above.