Privacy policy

1. What we collect

We collect the following categories of information:

Identity and contact

• Full name
• Email address
• Phone number (if provided)

Business information

• Business name and city
• Industry and business type
• Years in business
• Employee count
• Revenue range
• Business Tax ID (EIN), if you choose to add one to your profile
• Which vendors you currently use or have used (POS, payroll, insurance, lenders, etc.)
• Ownership tags you choose to add to your profile, such as woman-owned or veteran-owned
• Google Places place_id (used for verification, see Section 2)

Content you create

• Profile description and answers to onboarding questions
• Posts, responses, and votes in the network
• If you applied via the Elder path: your invite code or referral source

If you become an Elder

• Payout and bank account details, collected and held directly by Stripe, our payment processor. We do not see or store your full bank account or routing number ourselves.

Technical data

• IP address at the time of signup and login
• Device type and browser type
• Pages visited, timestamps, and referrer URL
• Push notification subscription details, if you turn on browser notifications

2. How we collect it

We collect information when you:

• complete the signup form at mainstep.ai/join
• fill out additional profile details after your account is created
• post, respond, or interact in the network
• contact us by email

For business verification, we use the Google Places API to confirm that your business exists and matches the information you provided. We store the resulting Google Places place_id. We do not store a GPS pin or precise address beyond what you submitted in the form.

We do not purchase data from data brokers. We do not collect data from social media profiles without your explicit action.

3. How we use your information

We use your information to:

• verify your identity as a real small business owner
• operate your account and personalize your experience in the network
• match you with peers whose business context is similar to yours
• generate aggregated, anonymized insights for vendors (never identified rows, see Section 4)
• send transactional messages: signup confirmation, account updates, and network announcements
• send marketing messages, only if you opted in at signup
• improve the service through usage analytics
• investigate abuse or potential Terms of Service violations

We do not use your data to serve advertising. We do not participate in third-party advertising networks or behavioral tracking programs.

4. Who we share information with

We do not sell your personal information. Full stop.

Vendors

Vendors who pay for Mainstep's intelligence product receive aggregated, anonymized data only. They see patterns across the owner community, such as industry-wide vendor satisfaction trends, never a row tied to you. Your name, email, business name, phone number, and any other identifying information are never shared with vendors under any circumstances.

Service providers

We use third-party services to operate the product: hosting infrastructure, transactional email delivery, payment processing for Elder payouts, and analytics. These providers access only the data necessary to perform their function and are bound by data processing agreements that prohibit them from using your data for any other purpose.

Legal requirements

We may disclose information if required by law, court order, or subpoena, or if we believe in good faith that disclosure is necessary to protect the safety of a member or the public, prevent fraud, or protect Mainstep's legal rights.

Business transfers

If Mainstep is acquired by or merged with another company, your information may be transferred as part of that transaction. We will notify members by email before any such transfer and give you the opportunity to delete your account before the transfer completes.

5. Data retention

We keep your information for as long as your account is active or as needed to operate the service.

If you request account deletion:

• We remove your name, email, phone number, and business name within 7 days.
• We retain aggregated, anonymized counts derived from your data (for example, benchmark figures) with no identifying link to you.
• We retain records required by law (for example, records of financial transactions, if any) for the legally required retention period.
• Content you posted may persist in aggregated or anonymized form for benchmark integrity, but it will no longer be attributed to your account.

We do not retain data longer than necessary for the purposes described in this policy.

6. Your rights

You have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: ask us to correct inaccurate or incomplete information
• Deletion: request that we delete your account and personal information
• Portability: receive a machine-readable copy of your data
• Opt out: withdraw consent for marketing communications at any time (transactional messages cannot be opted out of while your account is active)

To exercise any of these rights, email aj@mainstep.ai. We respond within 30 days.

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what categories of personal information we collect and to opt out of the sale of personal information. We do not sell personal information. We extend CCPA-equivalent rights to all members as a baseline, regardless of state.

If you believe your privacy rights have been violated and we have not resolved the issue to your satisfaction, you may file a complaint with your state's Attorney General or, for California residents, the California Privacy Protection Agency.

7. Cookies and tracking

We use essential cookies to keep you logged in and to remember your session preferences. We do not use third-party advertising cookies or cross-site tracking pixels.

We use first-party analytics to understand how members use the product: which features are used, where people get stuck, and what to improve. This data is not shared with third-party ad networks.

You can disable cookies in your browser settings. Essential cookies are required for the service to function; disabling them may prevent you from logging in or using key features.

8. Security

We use industry-standard security measures to protect your information, including encryption in transit (TLS) and at rest, access controls limiting who on our team can view member data, and regular security reviews.

No system is perfectly secure. We cannot guarantee that unauthorized third parties will never be able to circumvent our security. If you believe your account has been compromised, email aj@mainstep.ai immediately.

In the event of a data breach that affects your personal information, we will notify affected members as required by applicable law.

9. International data transfers

Mainstep is currently available only in the United States. Your data is stored and processed in the United States.

If we expand internationally, we will update this policy and implement appropriate transfer safeguards (such as Standard Contractual Clauses for transfers to or from the European Economic Area) before processing data from new regions.

10. Children

Mainstep is for adults only. You must be at least 18 years old to create an account. We do not knowingly collect personal information from anyone under 18.

If we learn that we have collected information from a minor, we will delete it promptly. If you believe a minor has created an account, email aj@mainstep.ai.

11. Changes to this policy

We may update this policy from time to time. When we do, we will update the “Last updated” date at the top of this page and notify members by email at least 14 days before the changes take effect.

Your continued use of Mainstep after the effective date of any update constitutes your acceptance of the revised policy. If you do not agree to the updated policy, you must stop using the service and may request account deletion. Changes that materially reduce your privacy protections will not apply retroactively to data we already hold without your explicit consent.

12. Contact

Privacy questions, data requests, or concerns? Reach us at:

Email: aj@mainstep.ai

Mailing address: 362 Euclid Ave, Apt 101, Oakland, CA 94610