Last updated: September 21, 2026
Sidebar is a legal AI workspace built for attorneys, which means we are held to the standard our customers are: confidentiality by default, and no surprises. This policy says what we collect, what we do with it, and what we never do with it — in plain language.
Account information. Your name, email address, and firm/organization details, managed through our authentication provider (Clerk). We never see or store your password.
Workspace content you create. Conversations with the AI, documents you upload, research memos, generated drafts, and matter memory. This is your data; we store it so your workspace persists between sessions — see “How we protect it” below.
Usage metadata. Which model handled a request, token counts, estimated cost, and timestamps — used for billing and rate limiting. Usage records do not contain your message content.
Billing information. Handled by Stripe. Stripe sees your payment details and billing identity; it never sees any workspace content.
Connected accounts (optional). If you connect your own Google Drive or Gmail, Sidebar searches and reads that account only when you ask it to. The passages it reads become part of that conversation, and email drafts you prepare are stored encrypted. See Section 5.
We use your information to operate Sidebar: run your AI requests, persist your workspace, bill your subscription, enforce rate limits, and fix errors. That is the complete list of purposes, plus measuring our own ads (Section 9).
What we never do: we do not sell your data; we do not use your content for advertising; we do not use your content to train AI models; and every AI model we offer is reached only over channels covered by written zero-retention terms (see Section 4).
All traffic is encrypted in transit (TLS 1.2+). Your workspace lives in a database partition isolated per firm, enforced on every request with row-level security as a backstop. Conversation content, extracted document text, research memos, and matter memory are additionally encrypted at rest with application-layer AES-256-GCM under Sidebar's own key, on top of our infrastructure's disk encryption. Uploaded original files and generated documents are stored in private, access-controlled storage. Workspace labels (conversation titles, matter names) are stored unencrypted so lists and search work; if you prefer, use matter numbers rather than client names in titles.
All content-bearing infrastructure runs in the United States. We do not currently offer other data-residency options.
Your prompts and documents are sent to the AI model that handles your request. Every AI model we offer is reached only over channels covered by written zero-retention terms, which prohibit retaining your content after the request is processed and using it to train models. Where a provider offers a no-retention setting, we enforce it in code on every request.
Research queries. When you use case-law or web research, search queries are composed by the model from your conversation and sent to CourtListener (public case-law database) and Brave (web search). We attach no account or firm identifiers to these queries, but the query text itself derives from your conversation — an inherent property of any web-grounded research. If a matter is too sensitive for external research, don't enable research for it.
Connecting Google Drive or Gmail is optional and per attorney. A firm administrator can switch Drive, Gmail reading, or Gmail sending off for the whole firm, and you can disconnect at any time. Sidebar searches and reads your account only when you ask it to, and an email draft is sent only when you press Send on that specific draft.
Sidebar does not edit, move, share, or delete Drive files; does not delete, archive, label, or change mail; does not send mail on its own; does not open email attachments; does not monitor, sync, copy, or index a Drive or mailbox in the background; and does not use one attorney's connection for anyone else.
The connection runs through Composio (Sampark, Inc.), which holds your Google credentials, encrypted. Requests and responses pass through Composio, configured not to store contents, so it keeps activity metadata only (action, time, status, connection identifier); a file being read is staged in Composio's temporary storage and then deleted by Composio (about 24 hours, according to Composio's documentation). The passages Sidebar reads become part of that conversation, encrypted at rest and deleted with it; a whole file is stored only if you add it to the firm Library, and email drafts are stored encrypted. Google's permission screen names Composio and lists full access because Google approves Composio's application for full access only; Sidebar's use is limited to what is described above. Disconnecting deletes the connection at Composio and Sidebar's record of it. Sidebar's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Your workspace is retained until you delete it. Deleting a conversation or matter is a hard delete: the messages, extracted document text, and uploaded original files are removed from our systems, not soft-hidden. Certain internal records (such as encrypted tool-audit content) are automatically purged after 30 days.
To close your account and erase everything across all matters, email privacy@sidebar-ai.com. We delete your data from our production systems within 30 days of your request. Backup copies expire in the ordinary course and are not restored except to recover the service.
Our position is that demands for your content belong with you, the account holder. Unless we are legally prohibited from doing so, we will notify you of any subpoena or legal demand for your data before responding and give you the opportunity to object. The full policy is in our Legal Process Policy.
We use a limited set of vendors to operate the service, including the AI providers, case-law and web-search services, hosting, authentication and billing. Each sees only what it needs to perform its function. The complete list is on our Subprocessor List. We update that list, and notify customers by email or in the service, when we add a subprocessor.
Inside the Sidebar workspace, we use only the cookies required to keep you signed in and to operate the service (set by our authentication provider). Our hosting provider supplies cookieless page analytics: page views and referrers, never workspace content. We do not use session-recording (“session replay”) tools.
Advertising. Our public website pages, and the step right after you create an account, use advertising cookies to measure our own ads. Workspace content is never used for advertising or shared with advertisers.
Your workspace is backed up by our database provider for reliability and disaster recovery, within the same United States region and inside the same isolation and encryption boundary as your live data. When you delete content or close your account, the deletion propagates to these copies as they cycle out; we do not maintain a separate long-term archive of deleted content.
If you contact us for support, a limited number of authorized personnel may access what is necessary to resolve your issue, and only for that purpose. Access to production systems is restricted, and our internal diagnostic tooling records its use in an access log.
Sidebar is operated from and stores all workspace content in the United States. We do not offer other data-residency regions today. If you access the service from outside the United States, you understand your information is processed in the United States.
You can access your data in the product, export conversations, delete conversations and matters yourself, and request full account erasure (Section 6). Depending on your state of residence, you may have additional statutory rights — such as the right to access, correct, delete, or obtain a copy of your personal information, and to be free from sale of it (we do not sell it) or its sharing for targeted advertising (opt out in Section 9). To exercise any of these, contact us and we will honor them; we do not discriminate against you for doing so.
Sidebar is a professional tool and is not directed to, or for use by, anyone under 18. We do not knowingly collect information from minors.
Sidebar is operated by Sidebar AI LLC, an Illinois limited liability company. How we protect your data is described in Section 3 and on our Security page. To report a security concern or vulnerability, email security@sidebar-ai.com. For any other privacy question, or to exercise your rights, contact privacy@sidebar-ai.com.
If we make material changes to this policy, we will notify account holders by email before the changes take effect, and update the “last updated” date above.