Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how Main Street Assist, operating the Propel platform ("Main Street Assist," "Propel," "we," "us," or "our") at mypropel.ca, collects, uses, and shares information through the Propel dashboard and the client-facing websites we host on your behalf.

It applies to Propel account holders and their staff. It also applies, as noted below, to the visitors and customers of the websites we host for you — but you, as the business running that website, are the one who decides what those visitors' information is used for; see Section 3.

2. Information you give us directly

When you create a Propel account, we collect the information you provide: your name, email address, password, phone number (optional), and business name.

If you sign in with Google, we receive the basic profile information Google shares with us (name, email address, profile photo). If you connect Google Calendar, we access calendar data only as needed to sync your bookings and appointments — we don't read calendar data for any other purpose.

We don't currently process payments. When paid plans launch, any payment details you provide will be sent directly to our payment processor; we don't store your full card number, and only receive limited metadata (such as card brand and last four digits) needed to display your payment method to you.

3. Information collected on your behalf, about your customers

Propel is a tool you use to run your business, so it also stores information about your own clients and customers ("Customer Data"), including:

• CRM contacts you add or import yourself — names, emails, phone numbers, notes, and interaction history.
• Leads submitted through your website's contact form, which we turn into CRM records on your behalf.
• Calendar bookings and appointment details entered by your visitors.
• Conversations between your website visitors and your chat or voice assistant.

We process Customer Data only on your instructions, to provide the Service to you. For this data, you're the one who decides what to collect and why — you act as the controller of that information, and we act as a processor / service provider on your behalf. We don't use Customer Data for our own marketing, we don't sell it, and we don't use it to improve or train anything for the benefit of other customers.

Because you're the one deciding what to collect from your own customers, you're responsible for having a lawful basis and any consents required in your jurisdiction, and for maintaining your own privacy notice to the people you serve. If one of your customers contacts us directly about their data, we'll typically direct them to you, but we'll also assist you in responding where reasonably possible.

4. Information collected automatically, and cookies

We collect standard technical information needed to operate and secure the Service, such as IP address, browser type, device information, and request logs.

We use a small number of essential, first-party cookies — an authentication/session cookie that keeps you signed in, and a security cookie used to protect against cross-site request forgery. These are required for the Service to function and can't be turned off without breaking login.

We don't use third-party analytics, advertising, or tracking cookies on the Propel platform itself. We do count visits to our own public pages (such as the mypropel.ca homepage and sign-up page) so we can see how many people visit. This count doesn't use cookies, doesn't store your IP address, and can't be used to identify you or follow you across days. If you choose to add your own tracking pixel, analytics script, or embed to your business website through the website builder, that's a tool you've added to your own site — it's governed by your own settings and disclosures to your visitors, not by this policy. See our Terms of Service.

5. Legal bases for processing (where applicable)

Where data protection law requires a legal basis for processing (for example, under the GDPR), we rely on: performance of our contract with you (to provide the Service you signed up for); our legitimate interests (to secure and improve the Service); your consent, where we ask for it specifically; and compliance with legal obligations, where applicable.

6. How we use information

• To provide and maintain the Service, including your dashboard, CRM, calendar, and hosted website.
• To send transactional email — booking confirmations, contact-form notifications, and account-related email — through our email provider.
• To generate responses from the chat and voice assistant, based on the information you give it about your business.
• To sync your calendar when you choose to connect one.
• To provide customer support and respond to your questions.
• To detect, prevent, and address fraud, abuse, and security issues.

We don't use your data, or your customers' data, to train models for the benefit of other customers, or for any purpose unrelated to providing you the Service.

7. Who we share information with

We share information with the service providers ("sub-processors") that help us run Propel. Each is bound by contract or terms of service limiting their use of the data to providing their part of the Service to us. As of the date above, these include:

• Resend — for sending transactional email on your behalf.
• Language-model providers such as OpenAI and Anthropic — to generate chat and voice assistant replies for your business. Which provider is used for a given account depends on configuration.
• Google — if you sign in with Google or connect Google Calendar.
• Our cloud hosting and infrastructure providers — to run our servers and store data.

We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, financing, or sale of business assets (in which case we'll take reasonable steps to ensure the receiving party honors this policy, and will notify you where required by law). We do not sell personal information, and we don't share it with third parties for their own advertising purposes.

8. Data retention

We keep Account Data for as long as your account is active, and for a reasonable period afterward in case you reactivate or as needed for legal, security, or accounting reasons.

Customer Data is kept for as long as it remains in your account — you can delete individual records yourself at any time. If you close your account, we'll delete or anonymize your Account Data and Customer Data within a reasonable period, except where we're required to retain it longer by law. Backups that include deleted data are purged on a rolling basis and aren't kept indefinitely.

9. Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections (HTTPS), hashed and salted passwords, and never storing full payment card numbers. No method of transmission or storage is 100% secure, and we can't guarantee absolute security. If we become aware of a breach affecting your data, we'll notify you as required by applicable law.

10. Your privacy rights

Depending on where you or your customers are located, you may have rights over personal information, which can include the right to access, correct, delete, or export it, restrict or object to certain processing, and withdraw consent where processing is based on consent.

If you're a California resident, the CCPA/CPRA gives you the right to know what personal information we collect, to request deletion or correction, and to opt out of the "sale" or "sharing" of personal information — we do not sell or share personal information for cross-context behavioral advertising.

If you're in the EU/UK/EEA, you also have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights about your own Account Data, or Customer Data you've asked us to help manage, contact us using the details in Section 15. We'll respond within the timeframe required by applicable law.

11. Do Not Track

Our visit count on the public mypropel.ca pages respects browser "Do Not Track" signals: if your browser sends one, your visit isn't counted. Elsewhere, our systems don't respond to these signals, since no common industry standard for interpreting them has been adopted.

12. Children's privacy

Propel is a business tool intended for business owners and isn't directed at children. We don't knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we'll take appropriate steps to delete it.

13. International data transfers

We're based in Canada, and some of our service providers are located in the United States or elsewhere. As a result, your information may be processed in a country other than the one where you or your customers are located. Where required, we rely on appropriate contractual safeguards with our service providers for these transfers.

14. Third-party links and embeds

Content on a Propel-hosted website — embedded videos, social links, or content you add — may link to or load resources from third-party sites and services. We aren't responsible for the privacy practices of those third parties; review their own policies before interacting with them.

15. Contact us

Questions about this policy, or requests about your data? Reach us at info@mypropel.ca.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal or operational reasons. If we make material changes, we'll let you know — for example, by email or an in-app notice — before they take effect. The "Last updated" date at the top of this page shows when it was last revised.