Privacy Policy

Last updated: September 2026

This Privacy Policy explains how Sidekick AI Inc., doing business as Email Donut, collects, uses, shares, and protects information when you use Email Donut websites, applications, integrations, browser extensions, and related services.

1. Who We Are

Email Donut is a business-to-business software platform for ecommerce and lifecycle marketing teams. Email Donut helps users collect email inspiration, plan marketing calendars, review marketing context, and generate campaign briefs and copy. Email Donut may connect to third party platforms such as Klaviyo and Shopify when a user authorizes an integration.

2. Information We Collect

A. Account and Workspace Information

• Name, email address, and profile photo
• Authentication information from supported sign-in providers
• Workspace, brand, board, subscription, and settings information
• Support messages and other communications

B. Klaviyo Integration Data

If you connect Klaviyo, Email Donut receives access only to the Klaviyo data authorized through the OAuth permission flow. This may include account metadata, campaigns, flows, events, metrics, templates, images, product catalogs, signup forms, lists, segments, tags, subscription and consent status, and profile data such as email addresses, phone numbers, names, identifiers, and marketing attributes.

Email Donut uses this data to report on marketing performance, plan email and SMS calendars, and generate campaign content.

Email Donut can also create content in your Klaviyo account when you ask it to: email templates, images used in those emails, audience segments, tags on the assets it creates, and campaigns and flows together with their send schedule. Every one of these is initiated by you.

Email Donut never modifies your customer records, never changes anyone's marketing consent, never processes data deletion or privacy requests, and never alters your account tracking settings. It does not request the Klaviyo permissions those actions would need.

C. Shopify and Ecommerce Data

If you connect Shopify or another ecommerce platform, Email Donut may process store, product, order, customer, and performance data authorized through that integration. This data is used to provide product context, calendar planning, reporting, and related analytics features.

D. User Content

• Uploaded or saved email examples
• Calendar inputs, campaign notes, and generated plans
• Generated copy, briefs, templates, and feedback
• Images or URLs added to articles, briefs, or boards

E. Usage, Device, and Log Information

• Pages or features used and actions taken
• Basic log data such as timestamps, IP address, and request metadata
• Device, browser, and approximate location information
• Error, job, and operational logs

F. Browser Extension Data

The Email Donut browser extension allows users to save marketing emails they choose to add to their Email Donut library. When a user clicks Save, the extension may collect the selected email HTML, visible sender information, subject line, date, and user-assigned categories or tags.

The extension does not transmit content from pages the user does not explicitly save. Extension data is used to provide the user’s Email Donut library and related product features.

3. How We Use Information

We use information for the purposes below. Where the EU or UK General Data Protection Regulation applies, the legal basis we rely on under Article 6(1) is identified for each purpose.

• Provide and operate Email Donut, authenticate users, and manage accounts. Performance of a contract, Article 6(1)(b).
• Connect and maintain the integrations you authorize. Performance of a contract, Article 6(1)(b).
• Generate marketing calendars, reports, campaign briefs, and copy that you request. Performance of a contract, Article 6(1)(b).
• Process payments and subscriptions. Performance of a contract, Article 6(1)(b), and compliance with a legal obligation for tax and accounting records, Article 6(1)(c).
• Respond to support requests. Performance of a contract, Article 6(1)(b), and our legitimate interest in helping users resolve problems, Article 6(1)(f).
• Secure the service and detect errors, abuse, and security events. Our legitimate interest in keeping the service and its users safe, Article 6(1)(f).
• Improve the reliability, performance, and features of the service. Our legitimate interest in improving a service our customers rely on, Article 6(1)(f).
• Comply with legal obligations. Compliance with a legal obligation, Article 6(1)(c).
• Establish, exercise, or defend legal claims and enforce our terms. Our legitimate interest in protecting our rights, Article 6(1)(f).
• Place non-essential cookies and similar technologies where consent is required. Consent, Article 6(1)(a), which you may withdraw at any time.

Where we rely on legitimate interests, we weigh those interests against your rights and freedoms, and you may object to that processing as described in Section 10.

This section describes the purposes for which Sidekick AI Inc. acts as a controller. Where a customer connects a platform such as Klaviyo or Shopify, that customer decides why the data from that platform is processed, and we process it as their processor on their documented instructions.

4. AI Features

Email Donut uses artificial intelligence features to classify email examples, generate calendars, draft copy, summarize context, and produce related marketing outputs. Inputs sent to AI providers may include brand context, calendar details, campaign information, connected integration context, user instructions, and selected email examples.

AI outputs are provided for review and editing by users. Users are responsible for reviewing outputs before using them in marketing or business workflows.

5. How We Share Information

We do not sell personal information. We share information only as needed to provide Email Donut, operate authorized integrations, comply with law, protect rights and safety, or complete a business transfer.

• Cloud infrastructure and database providers, including Firebase and Google Cloud
• Payment processors and billing providers, such as Stripe
• AI providers used to generate or process requested outputs
• Error monitoring, analytics, logging, and operational service providers
• Third party platforms that you choose to connect, such as Klaviyo or Shopify

6. Integration Credentials

OAuth tokens and integration credentials are used to connect Email Donut to services authorized by the user. We protect integration credentials using access controls and encrypted storage where applicable. Users can revoke integrations from Email Donut or from the connected platform.

7. Data Retention and Deletion

We retain information for as long as reasonably necessary to provide the service, maintain security, comply with legal obligations, resolve disputes, and enforce agreements. The criteria we apply by data type are set out below.

• Account and profile information. Kept while your account is open, and deleted after your account is closed or on request, except where we must keep a record for legal, billing, or security reasons.
• Integration credentials. Kept until you disconnect the integration or close your account. When you disconnect, we revoke the token with the provider and then delete the stored credential.
• Data synced from connected platforms, such as campaigns, flows, metrics, orders, and hashed customer identifiers. Kept while the brand remains connected, and deleted when you delete the brand or disconnect the integration.
• Content you or the service generates, such as calendars, briefs, copy, and saved library items. Kept while your account is open, and deleted when you delete the item or your account.
• Billing and payment records. Kept for as long as tax and accounting law requires.
• Operational and application logs. Kept on a rolling basis, currently thirty days for general service logs. Cloud administrative audit logs are kept for up to four hundred days by our cloud provider.
• Backups. Kept for a limited period and overwritten on a rolling schedule. Information deleted from the live service remains in backups until those backups age out.
• Records of privacy and deletion requests. Kept for as long as needed to show that we handled the request.

Users may request deletion of account data, saved library content, or connected integration data by contacting us. Some information may be retained where required for security, legal, billing, backup, or legitimate business purposes.

8. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. These include HTTPS, authenticated backend access, authorization checks, least-privilege integration scopes, environment-based secret management, cloud provider security controls, restricted production access, logging and monitoring, access reviews, and vulnerability remediation processes.

No method of transmission or storage is completely secure. If we become aware of a security incident affecting personal information, we will investigate and provide notices where required by law or applicable platform requirements.

9. Cookies and Similar Technologies

We use cookies and similar technologies to maintain sessions, remember preferences, measure usage, and improve the service. You can manage cookies in your browser settings, but some features may not work properly without them.

10. Your Choices and Rights

Depending on your location, you may have rights to access, correct, delete, export, object to, or restrict processing of personal information. To exercise these rights, contact us at support@emaildonut.com.

11. California Privacy Rights

This section applies to California residents and supplements the rest of this policy. It is provided under the California Consumer Privacy Act as amended by the California Privacy Rights Act.

In the preceding twelve months we collected the following categories of personal information.

• Identifiers. Name, email address, account identifier, and internet protocol address.
• Customer records. Contact and billing details you provide.
• Commercial information. Subscription plan, transaction history, and billing records.
• Internet or other electronic network activity. Usage and log data, error reports, and pages viewed.
• Professional information. The role and sector you tell us during setup.
• Sensitive personal information. Account log-in credentials in the form of access tokens for the platforms you choose to connect.

We collect this information from you, from your use of the service, from the platforms you connect at your direction, and from our service providers. We collect and use it for the business purposes described in Section 3, and we disclose it for business purposes to the categories of service providers listed in Section 5. We retain it according to the criteria in Section 7.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done either in the preceding twelve months. We do not use or disclose sensitive personal information for any purpose that would give a consumer the right to limit that use. We use access tokens only to operate the integrations you authorize, and we do not use them to infer characteristics about anyone.

Subject to verification, California residents have the right to know what personal information we collect and how we use and disclose it, to request access to or a copy of it, to request correction of inaccurate information, to request deletion, to opt out of sale or sharing, and to limit the use of sensitive personal information. We will not discriminate against you for exercising any of these rights.

To make a request, contact us at support@emaildonut.com. We verify your identity using information associated with your account. An authorized agent may submit a request on your behalf with your written permission, and we may ask you to confirm that permission directly. We do not knowingly sell or share the personal information of consumers under sixteen years of age.

When one of our customers connects a platform such as Klaviyo or Shopify, we handle the information from that platform as a service provider, and we process it only to perform the service under our agreement with that customer. If you are a customer of one of our customers, please direct your request to that business, and we will support them in responding.

12. International Processing

Sidekick AI Inc. is established in Canada and runs the service on cloud infrastructure located in the United States. Our service providers may also process information in the United States and other countries.

Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the following safeguards.

• Standard Contractual Clauses. The clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, incorporated into our agreements with the service providers that process personal information on our behalf.
• UK International Data Transfer Addendum. The addendum issued by the UK Information Commissioner, applied to those clauses for transfers from the United Kingdom.
• Swiss addendum. The amendments recognized by the Swiss Federal Data Protection and Information Commissioner for transfers from Switzerland.
• Adequacy. Canada holds an adequacy decision from the European Commission for commercial organizations subject to the Personal Information Protection and Electronic Documents Act.

To request a copy of the safeguard relied on for a particular transfer, contact us at support@emaildonut.com.

13. Children

Email Donut is intended for business use and is not directed to children. We do not knowingly collect personal information from children.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new last updated date. Continued use of Email Donut after updates means you accept the revised policy.

15. Contact

For privacy-related questions or requests, contact support@emaildonut.com.

Mailing address: Sidekick AI Inc., 470 Front Street West, Suite 1104, Toronto, ON M5V 0V6, Canada.