Data processing addendum
Version draft-2026-10-07
1. Parties, roles and scope
This addendum applies when [LEGAL ENTITY NAME AND STATE OF FORMATION — LEGAL DECISION D-01], doing business as Main Revenue (“Main”), processes personal information contained in Customer Data for a Customer under the Main Revenue Terms. The Customer is the controller/business; Main is the processor/service provider/contractor. It applies for as long as Main processes Customer Data.
2. Details of processing
| Item | Description |
|---|---|
| Subject matter and purpose | Reconciling the Customer’s project and financial records, identifying and reviewing findings, producing reports, exports and drafts, providing support, and securing the service. |
| Nature | Collection by upload, storage, parsing, normalization, comparison, review by Main personnel, AI-assisted mapping and summaries as described in the Privacy Notice section 6, reporting, export and deletion. |
| Duration | The term of the agreement plus the deletion periods in section 10. |
| Categories of personal information | Names and business contact details of the Customer’s personnel, and personal information that appears in the Customer’s project records (for example names of contacts, signers or project personnel in logs and pay applications). |
| Categories of data subjects | The Customer’s personnel and users; personnel of the Customer’s general contractors, owners, suppliers and subcontractors named in the records. |
| Special categories | None expected; the Customer must not upload the information listed in Privacy Notice section 13 unless agreed in writing. |
3. Instructions
Main processes Customer Data only on the Customer’s documented instructions: the agreement, the Customer’s use of the service and its written requests. Main will tell the Customer if it believes an instruction violates applicable law, or if it can no longer meet its obligations under applicable privacy law.
4. Service-provider and contractor terms (U.S. state privacy laws)
- Main will not sell or share Customer personal information, including for cross-context behavioral advertising or targeted advertising.
- Main will not retain, use or disclose it for any purpose other than performing the services for the Customer (the business purposes in section 2), or outside the direct business relationship between Main and the Customer, except as the law allows a service provider or processor to do.
- Main will not combine it with personal information Main receives from or on behalf of another person or customer, or collects from its own interactions with individuals, except as the law permits a service provider to do.
- Main will comply with the obligations applicable to it under the California Consumer Privacy Act and other U.S. state privacy laws, provide the same level of privacy protection they require, and notify the Customer if it can no longer meet them.
- The Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of its personal information, including on notice under section 9.
- Main certifies that it understands these restrictions and will comply with them.
5. Confidentiality of personnel
Everyone at Main who can access Customer Data is bound by confidentiality. Main staff access a customer workspace only through a logged access session with a stated reason, which the Customer can see in Settings.
6. Security
Main maintains reasonable security measures appropriate to the risk, currently including: encryption in transit; per-organization encryption keys for stored files, plus provider-managed encryption keys; malware scanning of every customer upload before it is read (in a separate scanning bucket protected by provider-managed encryption until the scan completes); organization separation enforced in the application and in the database (row-level security); optional two-factor authentication for every account, Main staff included; logged, reason-stated staff access sessions; an append-only activity log; and deletion certificates. Main holds no security certification.
7. Subprocessors
The Customer authorizes the subprocessors listed at /revenue/subprocessors. Main imposes data-protection terms on each subprocessor that are at least as protective as this addendum for the processing it performs, and remains responsible for their performance.
Main will give at least 30 days’ notice of a new or replacement subprocessor that will process Customer Data, by updating the list and emailing the Customer’s account owner. The Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve it, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees for it. [Draft default — attorney to confirm, D-22]
8. Assistance
Main will help the Customer, taking into account the nature of the processing, to: respond to requests from individuals exercising privacy rights (Main forwards such requests it receives to the Customer and does not respond on the merits without instruction); carry out data-protection or risk assessments where the law requires them; and meet its security and breach obligations.
9. Security incidents
Main will notify the Customer without undue delay, and within 72 hours [Draft default — attorney to confirm, D-14], after becoming aware of a security incident affecting Customer personal information, with the information reasonably available, and will cooperate in investigating, mitigating and notifying as required by law.
10. Return and deletion
Uploaded raw files are deleted automatically 30 days after delivery of the report for the assessment they belong to, unless the Customer authorized longer retention in writing. At the end of the services, or earlier on request, the Customer may export its data, and Main deletes the Customer organization’s data and issues a deletion certificate. Prior storage versions are permanently removed by the storage provider within 30 days, and database backups age out within the provider’s backup window. Main may keep, and continue to protect, information it must retain by law and its security and acceptance records (which contain no Customer financial records).
11. Compliance information and audits
On reasonable written request, Main will make available the information reasonably necessary to demonstrate compliance with this addendum, including a description of its controls. Once a year, on 30 days’ notice and under confidentiality, the Customer (or an independent auditor bound by confidentiality) may audit Main’s compliance at the Customer’s cost, by written questions first and on site only if they leave a material question open. [Draft default — attorney to confirm, D-23]
11A. AI
Main uses Anthropic’s API for the purposes in Privacy Notice section 6. Main has not arranged zero data retention with Anthropic. [LEGAL DECISION D-09 — state Anthropic’s training and retention terms only once the executed terms for Main’s account are on file]
12. Location and international transfers
Main stores Customer Data in the United States (AWS US East 1 per the subprocessor list). Main Revenue is offered to U.S. businesses. [LEGAL DECISION D-24 — EU/UK availability and transfer terms — not offered and no transfer mechanism is in place]
13. Liability and precedence
Liability under this addendum is subject to the limits in the Terms (section 16). [Draft default — attorney to confirm, D-04] For the processing of personal information, this addendum prevails over the Terms if they conflict.