Privacy Policy

This policy covers two groups: (1) visitors and prospects who use our marketing site or contact us, and (2) our customers — local businesses who subscribe to Mainstay Systems. It addresses requirements under U.S. state privacy laws, including those of California, Colorado, Connecticut, Virginia, Texas, Oregon, and Missouri, where applicable.

When we provide services to a customer, that customer's own customers' data is handled on the customer's behalf. For that data we act as a service provider / processor, and the business is the controller — see our Data Processing Addendum.

If you give us a mobile number — on a form, during onboarding, or by texting us — you consent to receive SMS/MMS messages related to the service you requested (for example, a reply to your inquiry, account or appointment notifications, or service updates). Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time and HELP for help. See our SMS Terms for full details.

Separately, when our customers send messages to their own customers through Mainstay Systems, the business is responsible for obtaining prior express consent from each recipient. We provide the tools to capture consent, honor opt-outs, and respect quiet hours.

Depending on how you interact with us, we may collect:

• Identifiers — name, business name, email, phone number, mailing/service area, and account login details.
• Commercial information — the plan you have, billing records, and the services we provide.
• Communications — texts, emails, and call content or recordings between you (or your customers) and the service.
• Internet & device activity — pages viewed, approximate (city-level) location from IP, browser and device type, and similar analytics — subject to your privacy choices.
• Inferences drawn from the above to operate and improve the service.

We do not intentionally collect precise geolocation, biometric data, or information from children.

• Provide, set up, and run the website, texting, and review services.
• Respond to inquiries and send service and account messages.
• Process billing and prevent fraud and abuse.
• Improve our services, security, and support.
• Comply with law and enforce our agreements.
• Send marketing about our own services where permitted — you can opt out anytime.

We use cookies and similar technologies that are strictly necessary to run the site, and — only with your permission — analytics and advertising technologies. You can set your preferences any time using Cookie settings in the footer, and we honor Global Privacy Control (GPC) browser signals as a valid opt-out of sale/sharing where required.

We share personal information only as described here:

• Service providers / subprocessors that run the service on our behalf under contract — see the current list in our DPA (for example Twilio for messaging, Vercel for hosting, and Neon for our database).
• Advertising and analytics partners, only where you have allowed it (see below).
• Professional advisors (legal, accounting) and in a business transfer (e.g., merger or acquisition).
• Authorities when required by law or to protect rights and safety.

As stated above, we never share mobile opt-in or SMS consent data with third parties for their marketing.

We do not sell personal information for money. We may share online identifiers and activity with advertising partners for measurement and targeted advertising, which some state laws treat as a “sale” or “sharing.” You can opt out at any time using Your Privacy Choices or by enabling GPC in your browser.

• Customer account records — for the life of the account.
• Prospect/marketing leads — until you opt out or request deletion.
• Billing records — as required by law (generally 7+ years).
• Message and call logs — for as long as needed to operate, support, and document consent, then deleted or anonymized.

Depending on where you live, you may have the right to access, delete, correct, or port your personal information, to opt out of sale/sharing/targeted advertising, to limit the use of sensitive information, and to appeal a denied request. We do not discriminate against you for exercising these rights.

Submit a request through our Privacy Request form or email hello@mainstaysystems.co. We respond within the timeframe your state law requires (generally 45 days). We may need to verify your identity before acting; authorized agents may submit requests with proof of authorization.

Our services are for businesses and are not directed to children under 16. We do not knowingly collect their personal information. If you believe a child provided us information, contact us and we will delete it.

We use appropriate technical and organizational measures — access controls, encryption in transit, and logging — to protect personal information. No method of transmission or storage is perfectly secure, but we work to protect your data and to notify you of incidents as required by law.

We may update this policy as our services or the law change. We will revise the “Last updated” date above and, for material changes, provide additional notice.

Questions about this policy or your data? Contact: