Who is responsible for your data
Sidefold is operated from Madrid, Spain. For the purposes of the EU General Data Protection Regulation (GDPR) and Spanish data-protection law, Sidefold is the data controller for personal data processed through the service.
Questions and privacy requests can be sent to hello@sidefold.co.
Data we collect
Creator accounts
When you sign in with Google, we receive your Google account identifier, verified email address, name, and profile picture. When you connect Instagram, we receive your Instagram account identifier, username, name, profile picture, granted permissions, and token-expiry information.
Creators can also sign up and sign in with an email address and password. We store your email address, account name, and a salted password hash, not your plaintext password. We send transactional email verification and password-reset messages through Cloudflare Email Service and store hashed, short-lived verification and reset tokens. Review accounts use the same access controls as other creator accounts and may have an access-expiry date.
Manuscripts and publications
When you choose a Google Doc, we process the selected file’s identifier, title, link, modification and revision information, text, structure, formatting, links, and images. We store a Sidefold copy of the imported manuscript so we can build and update your web reader, PDF, EPUB, creator page, and previews. We also store publication settings such as title, author, free chapters, lead-capture settings, custom domains, and affiliate details.
Lead magnets and reader delivery
When a reader requests a free resource, we store the publication and creator identifiers, reader email, access status, and delivery status so the creator can view the lead and Sidefold can provide the private access link. The reader can separately choose whether to receive marketing emails from the creator. If they opt in, we record the choice, time, language, and exact checkbox wording and show the choice to that creator. Free access does not depend on marketing consent. Readers can withdraw consent using the unsubscribe option in a marketing email or by contacting the creator. Sidefold does not collect payment-card or creator payout information for publications.
Optional email resources
If you request a blog resource through a Sidefold signup form, MailerLite processes your email address, the resource you request, and your subscription, confirmation, and unsubscribe status. Both resource forms use the same Sidefold mailing list. Your download link appears after signup; confirm your email to join the list. You can unsubscribe anytime.
Usage and support
With analytics consent, we process creator-page views, reader opens, lead requests, referral and campaign parameters, the event date, and a pseudonymous visitor identifier that is hashed before storage. Google Analytics may also receive browser, device, approximate-location, interaction, and network information. We process the messages and contact details you provide when you contact us. When you request a free creator resource, we store the email address you submit, show it to that resource’s creator as a lead, and use it to deliver your private access link.
How and why we use data
- Provide the service
- To create and secure accounts, import manuscripts, generate editions, host publications, deliver free resources, run automations, and provide creator dashboards. The legal basis is performance of our contract with you.
- Optional creator emails
- To record and show a reader’s separate marketing email choice to the creator whose free resource they requested. The legal basis for the optional marketing choice is consent.
- First-publication help
- To send a short series of practical setup emails when a creator has not published yet. When a signed-in creator follows one of these emails, we record the sequence step, click time, and whether a first publication is published within 30 days. This limited account-level attribution helps us evaluate the guidance without email-open tracking pixels. The series stops when you publish or use the unsubscribe link included in every message. Delivery, attribution, and preference records are kept so we can improve the service, respect your choice, and avoid duplicate messages. The legal basis is our legitimate interest in helping creators complete the service they joined and understanding whether that help works.
- Connected services
- To access the Google file or Instagram professional-account features you deliberately connect, including insights and creator-configured comment and direct-message automations. The legal basis is your consent and, where applicable, performance of the service you request. You can withdraw access through your Google or Meta account settings and by contacting us.
- Security and reliability
- To protect accounts, prevent abuse and fraud, troubleshoot errors, maintain records, and enforce our terms. The legal basis is our legitimate interests and compliance with legal obligations.
- Sidefold subscriptions
- To administer optional Sidefold Pro subscription billing and related accounting records. The legal basis is performance of a contract and compliance with legal obligations.
- Optional analytics
- To understand how Sidefold and creator storefronts are used and improve them. The legal basis is consent. Optional analytics remain off unless you accept them.
Sidefold does not sell personal data and does not use personal data for automated decisions that produce legal or similarly significant effects.
Google user data
Google sign-in requests openid, email, and profile. If you choose to connect Google Drive or a Google Doc, Sidefold separately requests drive.file. That permission lets Sidefold access only files you select for use with Sidefold or create through Sidefold; it does not give Sidefold general access to your Drive.
We use Google account data for sign-in, account identification, and optional first-publication guidance about the Sidefold account you created. Every guidance email includes an unsubscribe link. We use selected Google Drive data only to import, synchronize, format, publish, and export your manuscript at your direction. Access and refresh tokens are encrypted at rest and used only to provide these features.
Sidefold’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used for advertising, sold, or used to train generalized artificial-intelligence or machine-learning models. It is shared only when necessary to provide or secure Sidefold, comply with law, or with your explicit direction.
Instagram data
Sidefold requests instagram_business_basic to identify a connected professional account and show its profile and selected media, instagram_business_manage_insights to retrieve account reach and profile-view metrics, instagram_business_manage_comments to receive and reply to comments on that account’s media, and instagram_business_manage_messages to receive and respond to messages sent to that account.
Creators can configure exact keywords and response text for automations. For a matching comment, Sidefold can publish the creator’s configured public reply and send the single private reply permitted for that comment. For a matching user-initiated direct message, Sidefold can send the creator’s configured response or publication link. Sidefold does not use these permissions to start unrelated conversations, publish Instagram posts, sell Instagram data, serve advertising, or train generalized artificial-intelligence or machine-learning models.
We store the connected account ID and username, encrypted access token, token expiry, and granted scopes. To run and measure an active automation, we also process the relevant Instagram-scoped sender or commenter ID and username, comment or message identifier and text, matched automation, and delivery status. This data is used only to match creator-configured keywords, prevent duplicate actions, deliver the requested response, troubleshoot failures, and show automation results. Insights are used to show the creator how Instagram reach compares with visits to their Sidefold publication. You can disconnect the account in Sidefold, remove Sidefold through Instagram’s connected-app settings, or request deletion using the instructions below.
Retention and security
We keep account, publication, lead, and connected-service data while your account is active and for as long afterward as reasonably needed to complete a deletion request, resolve disputes, enforce agreements, or meet legal obligations. OAuth tokens are removed when the related connection or account is deleted, subject to limited backup retention. Sidefold subscription and accounting records are retained for the periods required by Spanish and EU law. Analytics is kept only as long as needed for reporting and is then deleted or aggregated.
We use HTTPS, secure session cookies, access controls, token hashing, and authenticated encryption for stored Google and Instagram credentials. No online service is completely secure, but we review safeguards in proportion to the data and risks involved.
Your privacy rights
Depending on your location, you may have rights to access, correct, erase, restrict, or receive a portable copy of your personal data; object to certain processing; and withdraw consent without affecting earlier lawful processing. These rights are free to exercise in most cases.
Email hello@sidefold.co from the address connected to your account. We may ask for reasonable proof of identity and will normally respond within one month. You may also complain to the Spanish Data Protection Agency (AEPD) or your local supervisory authority.
Disconnect or delete your data
Signing out ends the current session but does not delete your account. To delete a Google or Instagram connection, publication data, or your full Sidefold account, follow our data-deletion instructions or email hello@sidefold.co. We will verify the request, remove data that is no longer legally required, and confirm completion.
Changes to this policy
We may update this policy when Sidefold, our providers, or applicable law changes. Material changes will be announced through the service or by email where appropriate. The date at the top shows the latest version.