Privacy Policy

We collect the following categories of information:

• Account information: Your email address, used to authenticate you via a passwordless verification code.
• Business profile: Business name, industry, number of employees, annual revenue, location (city, state, ZIP), legal structure, certifications (e.g. veteran-owned, woman-owned), and years in operation — provided during onboarding. Some business profile information may relate to or identify an individual, especially for sole proprietors, small businesses, or owner-operated businesses. We treat such information as personal information where required by applicable law.
• Usage data: Pages visited, features used, match interactions, and feedback submissions within the Service.
• Payment information: If paid plans or paid features are introduced and you choose to purchase them, billing details are collected and stored directly by Stripe or another payment processor. We do not store your payment card information on our servers.

We use the information we collect to:

• Authenticate your account and maintain your session;
• Match your business profile against publicly available business opportunities, programs, incentives, certifications, contracting opportunities, and related resources;
• Surface relevant opportunity recommendations;
• Send you digest emails summarizing your top matches, if enabled;
• Improve the accuracy and usefulness of our matching algorithms;
• Respond to feedback and support requests;
• Process payments and manage paid features, if any;
• Monitor, secure, and improve Service performance and reliability.

We do not sell your personal information to third parties. You can opt out of non-essential emails at any time.

We may share limited information with trusted third-party providers that help us operate, secure, and improve the Service, including:

• Stripe — payment processing, if paid features are introduced. We do not store your payment card information on our servers. Governed by the Stripe Privacy Policy.
• Resend — transactional and digest email delivery.
• OpenAI — used to help analyze, summarize, classify, and match opportunity information and business profile information. We may send relevant business profile and opportunity data to OpenAI as needed to provide matching, summarization, recommendation, and data-structuring features. We do not intentionally send payment card information or authentication codes to OpenAI. Governed by the OpenAI Privacy Policy.
• Sentry — error monitoring and diagnostics.

These providers may process information on our behalf subject to their applicable terms, privacy policies, and data protection commitments. We may also disclose information if required by law, legal process, or government request, or if we believe disclosure is necessary to protect the rights, safety, security, or integrity of MainStreet Lift, our users, or others.

We use a session cookie to keep you signed in. This cookie contains a signed session token and does not track you across other websites. We do not use advertising or third-party tracking cookies.

We retain your account and business profile data for as long as your account is active. If you deactivate your account or request deletion, we will delete or anonymize your account and business profile information within a reasonable period, unless we need to retain certain information for legal, security, fraud prevention, backup, or legitimate business purposes. You may request deletion by contacting us.

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update inaccurate or incomplete information via Account Settings.
• Deletion: Request deletion of your account and associated data. You can initiate this from the Account Settings page or by contacting us.
• Opt out of emails: Manage your email preferences from Account Settings at any time.

California residents may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and the right to opt out of the sale of personal information. We do not sell personal information.

We use industry-standard security measures — including HTTPS, signed JWT session tokens, and restricted database access — to protect your information. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.

If MainStreet Lift is involved in a merger, acquisition, financing, reorganization, sale of assets, or transition to a formal legal entity, your information may be transferred as part of that transaction, subject to this Privacy Policy.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by a prominent notice on the Service. Your continued use of the Service after the effective date means the updated policy applies to your use of the Service.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at service@talx2me.com.