Main Revenue privacy notice
Version draft-2026-10-07
1. Scope and who we are
This notice explains how [LEGAL ENTITY NAME AND STATE OF FORMATION — LEGAL DECISION D-01], doing business as Main Revenue (“Main”, “we”), handles personal information in connection with Main Revenue: the Revenue Control Assessment, the Main Revenue application and the Main Revenue website pages (for example /pricing, /start, /security and the Ask Main assistant). It does not cover Main AI’s consumer tools, which have their own policy (linked from /privacy).
Effective date: [LEGAL DECISION D-16 — effective date, set with counsel]. Mailing address: PO Box 3, Brooklyn, NY 11218. Privacy contact: mainaihelp@gmail.com (privacy requests: write “Privacy request” in the subject) or by mail to [LEGAL ENTITY NAME AND STATE OF FORMATION — LEGAL DECISION D-01], PO Box 3, Brooklyn, NY 11218.
It applies to: people who use the Main Revenue application on behalf of a customer organization; people who order an assessment or contact us; visitors to the Main Revenue pages; and business contacts we reach out to about Main Revenue.
2. Our two roles
Main decides how and why some information is processed (as a “controller” or “business”) and processes other information only for a customer (as a “processor”, “service provider” or “contractor”).
- Main is the controller/business for: account and contact information; order, acceptance and billing information; website, security and usage logs; support communications; and Main’s own business-to-business marketing and prospect information.
- Main is the processor/service provider for the project and financial records a customer uploads, and everything derived from them (findings, reports, exports, drafts, notes). We process that Customer Data only on the customer’s documented instructions, under the Data Processing Addendum (/revenue/dpa). Questions about Customer Data should normally go to the customer that provided it; we will help that customer respond.
3. Information we collect
| Category | What it includes |
|---|---|
| Account information | Name, work email, organization, role in the organization, Main staff role (for Main personnel); a password stored only as a one-way hash; two-factor sign-in settings (an encrypted authenticator secret) and “remember this device” records. |
| Order and acceptance information | At /start: company name, your role, trade, annual revenue band, number of active projects, systems used and preferred start; your name and work email; the exact documents (version and fingerprint) and acceptance wording you agreed to, when, and the IP address and browser that sent it; the price, project count and stated delivery date. |
| Payment information | Stripe customer, checkout and payment identifiers, amount, currency, payment date, receipt and invoice links, and refunds. Card details are entered on Stripe’s page; Main never receives or stores card numbers. |
| Customer Data (processed for the customer) | Files the customer uploads: change-order logs, schedules of values, payment applications, A/R aging or invoice registers, payments and retainage ledgers, and optional WIP or job-cost data (CSV, TXT or Excel, up to 4 MB each). Derived records: column mappings, parsed and normalized rows, project and general-contractor names, revenue items, findings with the source cells behind them, reports, exports, confirmations and dismissals with reasons, challenges, comments, readout answers and draft messages. These records can contain names of people that appear in the customer’s own files. |
| Upload attestations | Who confirmed they are authorized to upload a file, when, and from which IP address and browser. |
| Report sharing | Which report was shared with which member of the same organization, by whom and until when. Reports cannot be shared outside the customer organization from inside the application. |
| Security and audit logs | Sign-ins and failed sign-ins, actions taken in the application, IP address and browser on sessions and log entries, and Main staff access sessions with the stated reason. Rate-limit counters use a one-way hash of the IP address, account email or session. |
| Support and contact information | Contact-form and partner-form fields (name, work email, company, role, trade, revenue and project bands, tools used, message), “talk to a person” requests from Ask Main, and emails you send us. |
| Ask Main assistant | Questions you type. In the application, the assistant also uses your organization’s findings to answer (see section 6). Main stores a record of each AI call (purpose, model, size, outcome), not the question text, except a hand-off request, which is stored encrypted. |
| Business-contact (outreach) information | See section 14. |
We do not use advertising cookies, tracking pixels or third-party analytics on Main Revenue pages. Main counts page views and a few product steps itself, without cookies (section 15).
4. Where it comes from
- From you, and from your organization’s administrators (for example when they invite you).
- From the files your organization uploads, and from the records Main derives from them.
- Generated by our systems as you use the service (logs, security events, delivery dates).
- From Stripe, about payments.
- For business contacts: company websites, public professional directories and association listings, a paid business-contact data provider (used for a limited number of records), and correspondence with you (section 14).
- From our service providers, about delivery and bounces of the emails we send.
5. How we use it
| Purpose | Information used |
|---|---|
| Provide the Revenue Control Assessment and the application: map columns, reconcile records, compute findings, have a person at Main review findings before release, produce reports and exports | Customer Data; account information |
| Sign you in, keep accounts and organizations separate, and secure the service (including malware scanning of uploads) | Account information; security logs; uploaded files |
| Take orders, collect payment, issue receipts and invoices, and keep a record of what was agreed | Order, acceptance and payment information |
| Answer support requests and contact forms | Support and contact information |
| Keep audit trails of what was done, by whom and why (including Main staff access) | Security and audit logs |
| Prevent fraud and abuse, and enforce our terms | Security logs; order information |
| Comply with law and respond to lawful requests | Any, as required |
| Contact business prospects about Main Revenue, answer their replies, and honor opt-outs | Business-contact information (section 14) |
We do not use personal information for unrelated purposes without telling you first and, where the law requires, getting your consent.
6. AI processing
Main Revenue uses one AI provider: Anthropic, through its API. AI is used to:
- suggest how the columns of an uploaded file map to Main’s fields (a person confirms every mapping)
- write a plain-language summary of a finding from its computed facts (rejected unless every number in it appears in those facts)
- answer questions in the Ask Main assistant, in the app and on the public website
AI is not used for:
- calculating amounts, dates, aging or reconciliation results (deterministic code does that)
- drafting messages to third parties (drafts are templates edited by people)
What is sent: for mapping suggestions, the column headers of an uploaded file and up to three sample values from each unmapped column; for finding summaries, the finding’s computed facts (amounts, dates, project name); for the in-app assistant, your question with up to five of your organization’s findings and up to six source cells each (file name, row, value, note); for the website assistant, the question only. A person at Main reviews every finding before it is released to a customer, except findings from a rule Main has approved for automatic release, which are labelled “machine-verified”. AI never calculates an amount, date or reconciliation result.
Retention by the AI provider: Main has not arranged zero data retention with Anthropic. The provider keeps API inputs and outputs under its commercial terms [LEGAL DECISION D-09 — state the verified retention period from the executed Anthropic terms, or remove].
7. AI model training
Main does not use Customer Data to train AI models, and does not permit its AI provider to do so [LEGAL DECISION D-09 — confirm the Anthropic account used by Main Revenue is under commercial API terms that exclude training; publish this sentence only then]. Main does not process Customer Data through consumer AI products.
8. Who receives information
We share personal information only with the service providers that run Main Revenue for us, under contracts that limit their use to providing their service, and as described in this notice. The current list, with what each receives:
| Provider | Function | Information it receives | Customer Data | Location |
|---|---|---|---|---|
| Netlify, Inc. | Website and application hosting, serverless functions, form handling, uptime-check storage | All requests and responses in transit (including uploaded files up to 4 MB and application data), contact-form submissions, error logs, uptime-check results (kept 8 days) | Yes | Not pinned to a region (UNKNOWN) |
| Neon (Databricks, Inc.) | Primary database (PostgreSQL) | Accounts, organizations, parsed and normalized project financial records, findings, reports metadata, audit and security logs, order records | Yes | AWS US East 1 (per our records) |
| Amazon Web Services, Inc. | File storage (S3) with encryption keys (KMS); malware scanning of uploads (GuardDuty Malware Protection for S3) | Uploaded files, generated reports and exports (encrypted by Main with a per-organization key before storage); each uploaded file is scanned in a separate quarantine bucket before Main encrypts it | Yes | US East 1 (configured default) |
| Anthropic, PBC | AI model API (mapping suggestions, finding summaries, the Ask Main assistant) | Column headers and up to 3 sample values per unmapped column; finding facts (amounts, dates, project names); in-app questions with up to 5 findings and their source cells; public website questions | Yes | UNKNOWN |
| Stripe, Inc. | Payment processing, receipts and invoices | Buyer email and company name, order amount and reference; card details are entered on Stripe’s page and never reach Main | No | UNKNOWN |
| Resend (Plus Five Five, Inc.) | Transactional email (sign-in links, invitations, order and report notices) | Recipient email address, subject and message text (which can include organization names, order totals and finding counts) | Limited (see data) | UNKNOWN |
| Google LLC (Gmail) | Main’s support inbox: contact-form copies, assistant hand-offs and operational alerts | Contact-form fields, support correspondence, and alert emails (which can include organization names and order or refund amounts) | Limited (see data) | UNKNOWN |
The same list is published at /revenue/subprocessors. We may also disclose information when required by law, to protect rights and safety, or as part of a merger, financing or sale of the business (subject to this notice).
Main does not sell personal information, does not share it for cross-context behavioral advertising, and does not use it for targeted advertising.
Location: Main stores Main Revenue data in the United States (database and file storage in AWS US East 1). Some providers in the list above do not state a processing region; where that is the case the table says so.
9. How long we keep it
| Information | How long |
|---|---|
| Uploaded files (raw exports) | Deleted automatically 30 days after the report for that assessment is delivered, unless the customer authorized longer retention in writing. The storage provider permanently removes prior versions within a further 30 days. A deletion certificate is issued. |
| Copies held for malware scanning | Deleted as soon as the scan finishes. A storage lifecycle rule removes any copy left behind; that rule’s period is not yet documented. [LEGAL DECISION D-11 — fixed period] |
| Parsed copies of each uploaded row | Cleared at the same time as the uploaded file. |
| Normalized records, findings, evidence excerpts, reports and exports | Kept while the customer’s workspace exists, so findings stay traceable; deleted when the customer deletes its organization or asks Main to. [LEGAL DECISION D-12 — fixed period] |
| User accounts (name, email, sign-in and two-factor data) | Kept while the account is active. There is no self-service account deletion yet: Main deletes an account on request. [LEGAL DECISION D-12 — fixed period] |
| Security and audit logs (sign-ins, IP address, browser, actions, staff access reasons) | Kept, append-only, including after an organization is deleted, to secure the service and to evidence what was done. A fixed period has not been set. [LEGAL DECISION D-12 — fixed period] |
| Order, acceptance and payment records | Kept for accounting, tax and contract-evidence purposes. A fixed period has not been set. [LEGAL DECISION D-12 — fixed period] |
| Sent-email copies kept by the application | Kept; a fixed period has not been set. [LEGAL DECISION D-12 — fixed period] |
| Support and contact-form messages | Kept in Main’s database (encrypted) and support inbox until no longer needed to answer or follow up; a fixed period has not been set. [LEGAL DECISION D-12 — fixed period] |
| Business-contact (outreach) records | Kept while relevant to Main’s outreach; a fixed period has not been set. [LEGAL DECISION D-13 — fixed period] |
| Opt-out (suppression) records | Kept permanently, limited to the email address, domain, reason and date, so Main never contacts that person again. |
| Database backups | Point-in-time history kept by the database provider for the window of Main’s plan; deleted data leaves backups when that window passes. [LEGAL DECISION D-11 — fixed period] |
When a period is not fixed, we delete or de-identify information once it is no longer needed for the purpose it was collected for, unless the law requires us to keep it. After an opt-out we keep a minimal record so that we do not contact that person again.
10. Your privacy rights
Depending on applicable law, you may have the right to: know or access the personal information we hold about you; correct it; delete it; receive a portable copy; opt out of sale, sharing or targeted advertising (Main does none of these); appeal our decision on your request; and not be discriminated against for using these rights.
To make a request, email mainaihelp@gmail.com with “Privacy request” in the subject, or write to the mailing address above. We will verify your identity in a way that fits the request (usually by confirming control of your account email). An authorized agent may act for you with your written permission. If we cannot do what you ask, we will tell you why and, where the law provides one, how to appeal.
If your request is about Customer Data we process for a customer organization (section 2), we will refer you to that organization and help it respond.
10A. California residents
Notice at collection: the categories of personal information we collect are those in section 3 (identifiers and contact details; commercial information about orders; internet and network activity in security logs; professional information; and personal information that appears in Customer Data). We use them for the purposes in section 5 and keep them for the periods in section 9. We collect them from the sources in section 4.
Main does not sell or share personal information (as those terms are defined in the California Consumer Privacy Act), and has not done so in the past 12 months. Main does not use or disclose sensitive personal information for purposes other than those the law allows.
For Customer Data, Main is the customer’s service provider (section 2 and the Data Processing Addendum).
Whether the California Consumer Privacy Act applies to Main directly depends on thresholds Main is reviewing with counsel; Main provides this section and honors the rights in section 10 regardless. [Draft default — attorney to confirm, D-29]
Main Revenue does not use automated decision-making technology to make significant decisions about individuals: its customers are businesses, and a person at Main reviews findings before release. [Draft default — attorney to confirm, D-29]
11. Security
Main uses reasonable safeguards appropriate to the information. They include: encryption in transit; files encrypted by Main with a key specific to each organization before they are stored, after malware scanning; organization separation enforced in the application and again in the database; optional two-factor sign-in for every account, Main staff included; Main staff access to a customer workspace only through a logged session with a stated reason that the customer can see; and an append-only activity log.
Main holds no security certification (for example SOC 2 or ISO 27001). Stripe processes card payments under its own certifications; that does not make Main certified. No system is perfectly secure.
12. Security incidents
If a security incident affects personal information, Main will notify affected customers under the Data Processing Addendum, and will notify affected individuals as the law requires, including under New York’s SHIELD Act: in the most expedient time possible and without unreasonable delay, and no later than 30 days after Main discovers the incident [Draft default — attorney to confirm, D-14], and will notify the New York Attorney General, the Department of State and the Division of State Police, and consumer reporting agencies, where the law requires.
13. Children and information you must not upload
Main Revenue is a business service for adults acting for an organization. It is not directed to children and we do not knowingly collect children’s information.
Unless agreed in writing, do not upload: full payment-card numbers; Social Security or other government identification numbers; bank account credentials, passwords or other authentication credentials; health information; or other specially regulated sensitive information. Main Revenue needs project financial records, not these.
14. Business contacts and our outreach
Main contacts finance professionals at construction companies, accounting firms and related businesses about Main Revenue. For this we process professional contact information: name, employer, role, work email, relevant information from the company’s own website or public professional listings, our correspondence, and opt-out status.
Sources: company websites, public professional directories and association listings, a paid business-contact data provider for a limited number of records, and your replies. We use it to send short business emails, answer replies and keep track of who asked not to be contacted. Emails are sent through Brevo or Resend; replies arrive in Main’s Gmail inbox.
To object or opt out: reply “no thanks” (or use the unsubscribe link your email program shows), or email the privacy contact above. We stop contacting you and keep only the minimal record needed to make sure we never email you again. You can also ask us to access or delete the rest of your information as described in section 10.
15. Cookies and browser storage
Main Revenue pages use only strictly necessary storage. Cookies: __Host-mr_session, the sign-in session (secure, HTTP-only, same-site; 12 hours, ended after 30 minutes of inactivity), and __Host-mr_device, set only if you choose “remember this device” (same protections; 30 days). Browser storage: your last-used organization and staff-workspace state in the application, your /start answers in that browser tab (never your password), an order reference to finish checkout, and an Ask Main conversation id for the tab. No third-party analytics, advertising or third-party scripts, fonts or pixels are loaded on Main Revenue pages. First-party usage counts: Main records, in its own database, each page view and five steps (landing, request sent, invitation accepted, file uploaded, report viewed) with only the step, the page path (no query string), a random id kept in that browser tab’s session storage and, for steps inside the app, your organization. No cookie is set for this, and no name, email, IP address, amount, file name or file content is stored with it. The counts are used only to see where people get stuck, are shown to Main staff as daily totals, and are deleted with your organization’s data.
16. Changes and contact
We will post changes here with a new version and date, and tell customers about material changes before they apply; for a material change, customers accept the new version the next time they sign in. Version draft-2026-10-07. Contact: mainaihelp@gmail.com (privacy requests: write “Privacy request” in the subject) or by mail to [LEGAL ENTITY NAME AND STATE OF FORMATION — LEGAL DECISION D-01], PO Box 3, Brooklyn, NY 11218.