SideBySide · Legal
Privacy notice.
This notice covers the manually admitted Creator–Brand pilot on sidebyside.social. The service owner approved this notice on 7 November 2026. The separate invited-test environment and any later public or paid service require their own scope review.
1. Controller and contact
Alessandro Guardascione, established in Ireland, is the service operator and data controller. Correspondence address supplied by the operator: Apt 203, Block F, Core 1, Hamilton Gardens, D07 WK2H, Ireland. For privacy, support, complaints and rights requests, email yalexein@gmail.com. No separate data protection officer contact has been designated.
2. Scope and participation
The pilot is for adults aged 18 or over, acting as a Creator or an authorized Brand representative, with manual admission. Creator and Brand applications do not require a separate email-verification step. Manual admission is not proof of mailbox ownership, identity, age or professional accreditation. Do not upload identity documents, sensitive personal information, children's data or content for which you lack permission. Account and profile fields, briefs and deliveries should contain only what the pilot requires.
3. Information, purposes and lawful basis for each purpose
| Information | Purpose and basis |
|---|---|
| Email, first and last name, country, role, company details where relevant, Creator-declared Instagram, TikTok and/or YouTube profile or channel links, application and admission decision | Handle your request for access and provide the requested pilot: steps before a contract or performance of a contract, where you are the contracting individual (Article 6(1)(b)). For staff representing a Brand, legitimate interests in administering the business relationship (Article 6(1)(f)). |
| Salted password verifier, email-proof and reset-token hashes, session and CSRF records, account status, rate-limit records and operator audit | Authenticate accounts, prevent misuse, protect participants and investigate incidents: legitimate interests in service security (Article 6(1)(f)). We do not store plaintext passwords in the account database. |
| Profiles, portfolio references, briefs, applications, invitations, agreement versions, messages and submitted delivery references | Run the collaboration functions requested by participants, using the applicable contract or business-relationship basis above. The optional Creator discovery setting controls profile visibility to admitted Brands; turning it off limits future discovery and does not automatically erase existing collaboration records. |
| Support, moderation, complaints and privacy-request correspondence | Respond and maintain evidence of the response: applicable contract, legitimate interests in resolving issues, or a specific legal obligation where one actually applies. A legal-obligation basis is not applied indiscriminately to all records. |
Required and optional information. An email address, first and last name, country, account role and password are required to request account access; Brand representatives must also provide their organization’s name, and Creators must provide at least one direct Instagram or TikTok profile link, or a YouTube channel link. Additional social links are optional. Declared social links do not establish ownership or an OAuth connection. Account surnames are kept separate from the initial public Creator display name. Without the required details we cannot process the application or provide an account. Portfolio and discovery information is optional; leaving it out limits the relevant profile or discovery functions. These are requirements of the requested service, not a general statutory duty to provide data.
Information is supplied by you, your organization or the other participants in a collaboration. We do not require marketing consent to obtain access. No marketing use or separate social-provider connection is included in this pilot. The controller is responsible for assessing and documenting the applicable basis and legitimate interests, where relied on.
4. Visibility and recipients
Authorized global operators can manage admission, accounts, organizations and platform safety. Brand workspace members and Creators can see the profile, brief, application and collaboration information that their authorized workflows disclose. A published pilot brief can be visible to other admitted Creators. Use a private delivery link where appropriate: the service cannot prevent independent access to a publicly accessible external media URL.
Cloudflare provides the Worker, D1 database and private storage for authenticated encrypted backup copies of the database and source code. Resend delivers account recovery, admission outcome and operator notification messages; the separate authorized operator activation may also use email verification. Operators keep encrypted backup copies on the originating Mac, a separate physical disk and private Cloudflare storage. Complete cloud retrieval, authenticated decryption and isolated integrity checks were verified on 7 November 2026. A restore on an independently controlled host and separate custody of recovery keys have not yet been demonstrated; the keys currently remain in a separate private directory on the originating Mac.
5. Processing locations and international transfers
The staging database is configured for the EU jurisdiction; this does not mean that all Cloudflare request processing or all other providers operate only in the EU. Resend states that customer email content and delivery logs are stored and primarily processed in the United States, including when a European sending region is selected. Its published Data Processing Addendum includes Standard Contractual Clauses. We remain responsible for checking the processing arrangements and applicable safeguards for the providers we use. Request information about the applicable safeguards using the contact above.
6. Retention and review
Legacy signup and operator-verification links expire after 24 hours, reset links after 15 minutes and browser sessions after eight hours. Restricted waiting-browser authorizations expire after 24 hours and can be exchanged only once after manual approval. Expired waiting-browser records are pruned when a new waiting authorization is issued. Password reset invalidates earlier browser sessions; reset proofs are single-use. Expiry prevents further authorization and does not itself prove deletion of every stored record. Rejecting a pending application removes its pending account details and password verifier while retaining the administrative decision audit.
Our retention and review schedule is: review unapproved applications at 30 days; remove expired or consumed proof, reset, session and rate-limit rows within seven days where no security hold applies; assess closed-account/profile data for removal within 30 days; review completed pilot collaboration material after 90 days; retain narrowly necessary decision/security evidence for up to 12 months, subject to justified holds; rotate ordinary encrypted recovery snapshots within 30 days. These are review and deletion targets requiring manual action; automated scheduled deletion is not currently operating. Protected audit and recovery records require a controlled retention process and review of any justified hold. Contact us about erasure or other privacy requests rather than assuming that expiry has physically removed a record.
Resend currently publishes 30-day email/log retention for its Free, Pro and Scale plans, seven-day backup persistence and deletion of remaining customer data within 90 days of service termination. These provider periods are distinct from the application token lifetimes and must be checked against the actual account plan. Restored backups must reapply the record of approved deletions before normal service resumes.
7. Rights and complaints
You may ask for access, correction, erasure, restriction or portability, or object to processing where the relevant right applies. Where a particular activity relies on consent, withdrawal does not affect processing that was lawful before withdrawal. Contact the controller using the email above. We may seek proportionate evidence to identify the requester and protect another participant's information; do not email a password or an unrequested identity document. The operating procedure records receipt, scope, applicable deadline and the outcome, normally responding within one calendar month; any lawful extension must be explained within that initial period.
You can raise a concern with the Irish Data Protection Commission or complain to another competent supervisory authority. A rights request does not automatically erase another participant's records, necessary security evidence or information that must lawfully be retained; any applicable limitation should be explained individually.
8. Cookies, local storage and security
The service uses the Secure, HttpOnly, SameSite=Lax __Host-dalvan_session cookie and a Secure, SameSite=Lax __Host-dalvan_csrf cookie. The CSRF value is readable by same-origin scripts so the server can verify requests. Both cookies have an eight-hour maximum lifetime and serve account authentication and request security. A Secure, HttpOnly, SameSite=Strict __Host-dalvan_waiting cookie, with a maximum lifetime of 24 hours, identifies only the saved application in that browser and allows automatic entry after approval. It does not grant workspace access before approval and is cleared on exchange. Account onboarding uses a per-tab handoff flag. Local storage also remembers your chosen light/dark appearance, dismissed workspace introductions and the admin console’s chosen reading size. The handoff flag is consumed by onboarding or ends with the tab’s session; device preferences remain until replaced or cleared in your browser settings. These settings contain no account password. Clearing account cookies signs you out; clearing preferences resets the corresponding display choices. No optional marketing or analytics script was identified in the inspected staging package; edge security and provider processing still require their own account-level inventory. Optional tracking must be reviewed before it is introduced.
Admission decisions are made by authorized operators. Deterministic expiry, authorization and rate-limit checks protect access; they are not an assurance of identity or a claim of AI-based eligibility profiling. Report security concerns to the contact above. Do not send recovery links, passwords or session tokens in support messages. Material changes to the approved notice will be recorded and communicated as required.