How we handle your customers' data.

“Applicable Privacy Laws” means U.S. state privacy statutes that apply to the processing, such as the CCPA/CPRA, VCDPA, CPA, CTDPA, and similar laws. “Personal Information,” “Controller,” “Processor” (or service provider), and “Process” have the meanings given in those laws. “Services” means the Mainstay Systems offering.

For personal information about a customer's own customers, the customer is the controller and Applied Ego Software LLC acts as a service provider / processor. We process that information only to provide the Services and on the customer's documented instructions, which include these Terms and the use of the product.

We will not:

• sell personal information, or share it for cross-context behavioral advertising;
• retain, use, or disclose it outside the direct business relationship or for any purpose other than providing the Services;
• combine it with data from other sources, except as permitted by Applicable Privacy Laws (for example, for security or to provide the Services).

We certify that we understand and will comply with these restrictions.

Personnel authorized to process personal information are bound by appropriate confidentiality obligations and receive role-appropriate guidance on handling it.

We engage the subprocessors below to deliver the Services. Each is bound by data-protection terms no less protective than this Addendum. We will give notice of material changes so the customer can object.

We maintain appropriate technical and organizational measures appropriate to the risk, including access controls, encryption of data in transit, network protections, logging, and incident response. We will notify the customer without undue delay after becoming aware of a personal-data breach affecting their data.

We provide reasonable assistance to help the customer respond to consumer rights requests (access, deletion, correction, portability, and opt-out). If a consumer contacts us directly, we will direct them to the customer unless we are legally required to respond.

We retain personal information only as long as needed to provide the Services or as required by law. On termination or written request, we will delete or return the customer's personal information, subject to legal retention obligations and standard backup cycles.

Personal information is processed in the United States. Where data crosses borders, we apply safeguards required by Applicable Privacy Laws.

Each party's liability under this Addendum is subject to the limitations in the Terms & Conditions, except where Applicable Privacy Laws prohibit such limitation.

To request a signed copy of this Addendum or to ask about it: