Privacy Policy

1. Who We Are

Mainstay is a software platform operated for Business Improvement Areas and similar place-management organizations. This Privacy Policy explains what data we collect, why we collect it, and how we protect it.

2. Data We Collect

Account Data

• Name and email address (used for authentication via Auth0)
• Role and workspace assignment within your organization
• Onboarding status

Content Data

• Documents you upload (governance docs, policies, meeting minutes)
• Meeting transcripts and AI-normalized summaries
• Member directory information (business names, categories, contact details)
• Project data, milestones, budget items, and survey responses
• Messages sent to the AI Copilot and its responses

Usage Data

• IP address and browser type (collected automatically by our hosting provider)
• Feature usage patterns (which pages you visit, actions you take)

3. How We Use Your Data

• To provide and improve the Service's features
• To authenticate you and manage workspace access
• To power the AI Copilot (your documents are used to answer your questions — never to train models for other customers)
• To communicate with you about your account and the Service
• To detect and prevent abuse, fraud, and security incidents

4. Data Sharing

We do not sell your data. We share data only with the following service providers, under contracts that limit their use of your data:

• Auth0 — handles user authentication and session management
• Supabase — hosts our PostgreSQL database and file storage
• Vercel — hosts the web application
• Backboard — provides AI processing (document RAG, meeting normalization, image generation)
• Stripe — processes subscription payments (coming soon)

We may disclose data if required by law, court order, or to protect the rights, property, or safety of Mainstay, our users, or others.

5. Data Isolation

Each organization's data is isolated at the database level. Users in one workspace cannot access another workspace's documents, members, or settings. The platform founder (super admin) can switch between workspaces but all access is logged and auditable.

6. AI & Your Data

When you use the AI Copilot or governance drafting assistant, your documents and questions are sent to our AI provider (Backboard) for processing. Key protections:

• Each workspace has its own isolated AI assistant — documents from one BIA are never accessible to another
• Your data is not used to train AI models for other customers
• All AI inputs are sanitized with prompt-injection protections
• The AI is instructed to answer only from your own documents and to never fabricate information

7. Data Retention

Your data is retained for as long as your account is active. When you delete a document, meeting, or member record, it is permanently removed from the database. If you cancel your subscription, your data is retained for 30 days, then permanently deleted.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Delete your account and associated data
• Export your data in a portable format
• Object to certain processing of your data

To exercise these rights, contact privacy@mainstaybia.com.

9. Cookies

We use essential cookies for authentication (via Auth0) and session management. We do not use advertising or tracking cookies. The cookies we set are:

• Session cookie — encrypted, httpOnly, required for login
• Workspace cookie — httpOnly, used by super admins to switch workspaces
• Role preview cookie — httpOnly, used by super admins to preview the app as different roles

10. Security

We take security seriously. See our Security page for details on our technical and organizational safeguards.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email at least 30 days before they take effect.

12. Contact

Questions about privacy? Email privacy@mainstaybia.com.