What we keep,
and where it goes.

Who is responsible

• Mainmark is operated by Fairview Software Inc. o/a Mainmark. We are based in Alberta, Canada. This notice covers our public website, accounts and the service we provide to businesses.
• We handle account, billing, support and operational information for our own service purposes. When a business uses Mainmark to collect customer information, we generally process those records to provide the service on its instructions. The business is responsible for its own collection, uses and privacy notice. Mainmark remains responsible for its own obligations under applicable privacy law.
• Our privacy contact is Sufyan, responsible for privacy requests at sufyan@mainmark.io. You can ask about this notice, our service providers and their practices, including processing outside Canada.

Information from account holders

• Account and profile information: your name, email address, account identifier, profile details and images you supply, team invitations and permissions, and communications with us.
• Terms acceptance: your account identifier, the terms version and exact document, when we recorded your agreement, how you gave it (at sign up, in your account or at Stripe checkout) with the account or checkout reference, and, for agreement in your browser, its user agent and the country your connection came from. We do not keep your IP address for this. We keep this evidence to administer the agreement and resolve disputes. It is separate from permission to send marketing.
• Website information: business details, prompts and answers, text, photographs, files, drafts, published versions and connected services. Content you publish, including the first automatic preview, is publicly accessible and can be copied or indexed by others.
• Billing and domains: plan, currency, subscription status, payment and transaction references, and registration or contact details supplied for a domain. Stripe handles card entry. We do not receive your full card number or security code.
• Payments from your customers: when you connect Stripe, we keep your Stripe account's identifier and whether it can take payments and pay out. Your identity and bank details go to Stripe, not to Mainmark.
• Service activity: pages visited and actions taken on the public website and dashboard, event names, account and website identifiers, categories and times. These records can be linked to an account; they are not necessarily anonymous. Our dashboard event fields are intended for activity categories, not message content.
• AI conversations: what you send to Mainmark Agent and the information it reads to answer, including website details, enquiries, appointments and settings within its available tools and your permissions.

Information from business website visitors

• Enquiries and appointments: names, email addresses, phone numbers, messages, booking details, changes and cancellation history. We make these available to the business and send the relevant operational messages.
• Orders and invoices: contact and fulfilment details, items, amounts, tax details, payment status and transaction history entered by the visitor or business. The business decides how to use its customer records.
• Payments to a business: what was paid for (a booking, an invoice or an order), the amount and the payment's reference. The card is entered on Stripe's page, under Stripe's privacy policy. Stripe is told only a general description of the payment, such as Appointment deposit, Invoice payment or Order payment, never the service or treatment, so that health details stay with the business.
• Website activity: page views, how long each page was in view and how far down it was scrolled, button, phone, email and map link presses, links pressed to other websites and files downloaded, forms, bookings and orders, with page paths, referral sources and campaign tags, the kind of device (phone, tablet or desktop), the browser and operating system, the language the browser asks for, the approximate place the connection came from (country, region and city, as our network provider estimates it from the network address) and a daily visitor identifier. This identifier is made by hashing the website, network address, browser information, the business's date and a random value for that day, which is deleted from the live service after three days and from our database's point in time recovery within thirty, after which the identifier can no longer be tied to an address. The raw network address is not stored with website activity records, and a business sees a city only once several visitors share it. When a visitor sends an enquiry or books, where they came from and the pages they opened that day are kept with that enquiry. Website activity records are kept seven days; after that only daily totals for the website are kept, without any visitor identifier, and a place is named in them only once three visitors share it. This does not mean all infrastructure or security processing is anonymous.
• Technical information: network addresses, browser and device information, request paths, timing, status codes and error information may be processed by our infrastructure and service providers to deliver, secure and troubleshoot the service.

Why we use information

• To create and secure accounts, build and host websites, process payments, register and manage domains, handle business records, deliver requested messages and connections, and provide support.
• To understand service use, diagnose problems, maintain availability, prevent fraud or abuse, enforce our agreements and meet legal requirements. We limit collection, use and disclosure to reasonable purposes and use consent or another basis permitted by applicable law.
• We do not sell personal information. Information is not made available to other customers merely because they use Mainmark. Public website content and information you send through your chosen connections are shared as described in this notice.

Cookies and browser storage

• Mainmark uses cookies or browser storage for sign in, security and preferences such as your theme and selected website. Hosted shops use a cart cookie. Some website features also remember choices in browser storage.
• Our built in website activity measurement does not set an analytics cookie. A business can connect services such as Google Analytics, Google Ads or a Meta Pixel, which have their own cookies, identifiers and privacy practices. The business is responsible for disclosing these and obtaining any required consent before they run.
• You can control cookies and storage in your browser, but blocking essential storage may stop sign in, carts or other features from working. Removing a connection stops its future use after the website updates; it does not erase information already received by that provider.

Service providers and connections

• Cloudflare hosts websites, application records, files and recovery backups, and supplies network and security services. For domains bought through Mainmark, it also receives registrant contact details. Domain mail forwarding sends messages through Cloudflare to the destination address you choose.
• OpenRouter receives business details and writing requests and passes them to the provider running the selected language model. It also receives Mainmark Agent conversations and the enquiries, appointments and settings it reads to answer you. Provider processing and retention depend on the model and provider terms and settings. Do not put secrets or unnecessary sensitive information in prompts. We do not send visitor activity events to the model as part of these features.
• Firebase, Google's identity service, processes sign in details, including your email and password or Google sign in. Mainmark stores an account identifier and email, not your password.
• Resend receives the recipient address and message for emails it sends, including enquiry, booking, order or invoice details when present. Stripe receives billing and payment information to process charges and manage subscriptions. When a business takes payments from its own customers, Stripe processes them in that business's own Stripe account and receives the amount, the currency, the customer's email address when given and a reference.
• Pexels receives stock photograph search requests. Grafana Cloud receives page addresses and monitoring results, technical logs and traces such as request paths, timing, status codes and error details. Our log export removes query strings from request URLs; this is not a promise that all logs contain no personal information.
• GitHub runs our scheduled recovery backup workflow and temporarily stores its backup artifact. The backup covers application records and files and excludes configured sign in tokens, sessions and stored model credentials.
• When you enable a webhook or connect an external assistant or other tool, information permitted by that connection can be sent to its operator. Check its access and privacy terms. Providers may also handle information for their own lawful security, billing or compliance purposes under their notices.

Processing outside Canada

• Mainmark and its providers may process and store information in Canada, the United States and other countries where their infrastructure and personnel operate. Hosting and model routing do not provide a guarantee that information stays in Canada. The purposes are the services described above.
• Information processed abroad may be accessible to courts, law enforcement and other authorities under local law. Privacy protections can differ from those in your location. Mainmark remains accountable for information under its control as required by applicable law.
• Contact our privacy contact at sufyan@mainmark.io for information about our policies and practices for providers outside Canada, including available country and processing details for the service you use. Do this before supplying information if you have a location or regulatory requirement.

Other disclosures

• We may disclose information where required or permitted by law, including responding to valid legal process, protecting legal rights, investigating fraud or security incidents, and preventing serious harm, subject to applicable legal limits.
• Information may be disclosed in a proposed or completed business sale, financing or reorganisation only with the safeguards and notices required by applicable law. Other new purposes require notice and consent where the law requires it.

Retention and deletion

• We keep personal information only as long as reasonably needed for the stated purposes or legal requirements. Cancelling a subscription or removing a site does not automatically erase its records. Customer records remain available for the business unless deleted or otherwise removed under our retention processes.
• Website activity records have a seven day cleanup threshold in active application storage once their day is added to the website's daily totals, and thirty days at most; the daily totals, which hold no visitor identifier, stay with the website. Dashboard activity and inactive Agent conversations have a ninety day cleanup threshold. The source and pages kept with an enquiry stay as long as the enquiry. Webhook delivery records have a thirty day threshold. Cleanup runs periodically and in batches, so these are retention settings rather than promises of deletion at an exact moment.
• Email delivery payloads are retained while needed to send or retry a message. Completed delivery records are scheduled for cleanup after thirty days. Related enquiries, orders, appointments and invoices have their own lifetime.
• Website history keeps a bounded set of recent published versions for restoration, currently twenty. This history is not an archive of every version.
• Scheduled recovery backups are configured for retention of ninety days on Cloudflare and thirty days on GitHub. Deletion from the live service does not immediately remove a record from an existing backup. Provider records may have different retention periods.
• We may retain necessary billing, tax, security, legal and dispute records for longer where justified or required by law. We will explain relevant exceptions when handling a deletion request. Account closure and permanent deletion are different from cancelling payment renewal.

Security and sensitive information

• We use access controls and other safeguards intended to protect information. No system or transmission method can guarantee complete security. Protect your account, review team and integration access, and contact us promptly about suspected misuse.
• Do not submit medical records, identity documents, full card details, passwords or similarly sensitive records unless we have expressly agreed to support that use. Booking or enquiry details can themselves be sensitive; businesses must minimise what they request and provide the notices and consent their use requires.
• Mainmark accounts are intended for adults acting for businesses. Our public website and account service are not directed to children. A business collecting information about children through its website is responsible for the additional permissions and protections required by law.
• If a privacy breach requires notification, we will notify the relevant regulator and affected people as required by applicable law. This notice does not remove any legal protection or remedy.

Your choices and rights

• You can update account details, manage team access and integrations, download available website records from Account, and remove or permanently delete a website using its settings. The export contains data and image references, not original image files or every operational record.
• You may request access to or correction of your personal information, ask about its use or disclosure, request deletion, or withdraw consent where applicable. Rights and exceptions depend on the law that applies. We may need to verify identity or authority and will respond within the applicable legal time limit, including any lawful extension.
• Withdrawing consent may prevent a feature or the service from working. We will explain relevant consequences and any legal limits. You can also ask us to close your account and arrange any billing or domain changes.
• For records held for a business whose website you visited, contact that business first. You can also contact us; we will assist or direct the request as appropriate to our role and legal obligations. This does not prevent a request or complaint about Mainmark's own handling of information.

Changes to this notice

• We update this notice when our practices change and show the revision date. We will provide additional notice or seek consent for a material change where required by law. Publishing an updated notice does not by itself authorise a new use that requires consent.

Privacy questions and complaints

Write to Sufyan, Mainmark privacy contact, at sufyan@mainmark.io. You may also contact the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada, or another regulator with jurisdiction. You do not have to waive a legal right to raise a concern with us.

For the service contract, read the terms of use.