Privacy Policy
Last Updated: October 28, 2026
"Your privacy is foundational to the trust built across 35+ years successfully running IT and security for businesses"
Table of Contents
1. Information We Collect
1.1 Information You Provide
- Contact Information: Name, email address, phone number, company name
- Account Information: Username, password (encrypted), business details
- Service Information: Details about your security needs, IT infrastructure, compliance requirements
- Payment Information: Credit card details processed via Authorize.net (PCI DSS compliant)
- Communication Records: Emails, support tickets, phone call records (for quality and training)
1.2 Information We Collect Automatically
- Technical Information: IP address, browser type, operating system, device information
- Usage Information: Pages visited, time spent, features used, security tools accessed
- Analytics Data: Google Analytics data (anonymized where possible)
- Button and Link Counts: We count which situation, button or link a visitor uses on our own pages (for example, which page the homepage box matched, or that the phone number was tapped), together with the site that referred you. These counts use no cookies, contain nothing you type, and are skipped if your browser sends Do Not Track or Global Privacy Control
- Security Assessment Data: results from no-charge security tools (HIBP checker, SSL analyzer)
ℹ️IP Address and Location Data Collection
When you submit a contact form or assessment on our website, we collect your IP address and approximate location (country-level) for the following purposes:
- Fraud Prevention: Detect and prevent spam, abuse, and fraudulent submissions
- Service Delivery: Provide location-appropriate service information and compliance guidance
- Security Analysis: Identify suspicious patterns and protect our systems
- Legal Compliance: Meet regulatory requirements for business communications
Location Precision: We collect country-level location data (e.g., "United States") via Cloudflare, not precise geographic coordinates. IP addresses are stored securely and retained for 3 years or until deletion request.
1.3 Information From Third Parties
- ActiveCampaign: Email engagement data (opens, clicks, automation triggers)
- Authorize.net: Payment processing confirmations
- Business Verification Services: Company information for B2B validation
2. How We Use Your Information
2.1 Primary Business Purposes
- Service Delivery: Provide managed security services, monitoring, and support
- Account Management: Create and maintain your service account
- Communication: Send service updates, security alerts, and support responses
- Billing: Process payments and maintain billing records
- Compliance: Meet regulatory requirements (HIPAA, PCI DSS, SOC 2, NIST 800-171)
2.2 Marketing Purposes (With Consent)
- Email Marketing: Send educational content, security tips, service updates via ActiveCampaign
- Lead Nurturing: Behavior-based automation sequences based on tool usage and engagement
- Newsletter: Weekly cybersecurity insights (10,000+ subscribers - opt-in required)
- Webinar Invitations: Training opportunities and educational events
2.3 Service Improvement
- Analytics: Understand how visitors use our website and security tools
- Product Development: Improve services based on usage patterns and feedback
- Security Research: Analyze threats and develop better protection methods
- Quality Assurance: Review support interactions for training and improvement
2.4 Legal Obligations
- Compliance: Meet legal and regulatory requirements
- Fraud Prevention: Detect and prevent fraudulent activity
- Legal Requests: Respond to subpoenas, court orders, or legal processes
3. How We Protect Your Information
3.1 Technical Safeguards
- Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
- Access Controls: Role-based access, multi-factor authentication, principle of least privilege
- Network Security: Firewall protection, intrusion detection, continuous monitoring
- Regular Audits: Penetration testing, vulnerability assessments, security reviews
- Backup Systems: Encrypted backups with geographic redundancy
3.2 Organizational Safeguards
- Staff Training: Regular security awareness training for all employees
- Background Checks: Pre-employment screening for all staff with data access
- Confidentiality Agreements: All staff sign NDAs and confidentiality agreements
- Incident Response: 24/7 monitoring with documented breach notification procedures
- Vendor Management: Third-party security assessments and contract reviews
3.3 Compliance Certifications
- NIST 800-171: Government contractor cybersecurity requirements
- CMMC-2: Cybersecurity Maturity Model Certification
- CIS-18: Center for Internet Security controls
- PCI DSS: Payment Card Industry Data Security Standards (via Authorize.net)
- HIPAA: Healthcare information privacy and security compliance
4. Sharing Your Information
4.1 Service Providers (Data Processors)
We share information with trusted third parties who help us provide services:
ActiveCampaign (Email Marketing & CRM)
- Purpose: Email campaigns, lead nurturing, behavior tracking
- Data Shared: Email, name, company, engagement data
- Location: United States
- Privacy Policy: ActiveCampaign Privacy
Authorize.net (Payment Processing)
- Purpose: Secure payment processing
- Data Shared: Payment card information (we never store card numbers)
- Location: United States
- Compliance: PCI DSS Level 1
Anthropic (Homepage Page-Matching Box)
- Purpose: Choose which page on our site best fits what you describe in the “What are you seeing?” box, when our own software cannot tell
- Data Shared: The text you type in that box (up to 300 characters). Nothing else from your visit. See section 7.3
- Location: United States
- Retention: Anthropic states that it deletes inputs and outputs of its commercial API within 30 days of receipt, with exceptions for legal compliance and for enforcing its usage policies, and that it does not use commercial API inputs or outputs to train its models by default
- Privacy Policy: Anthropic data retention
Google Analytics (Website Analytics)
- Purpose: Understand website usage and improve user experience
- Data Shared: Anonymized usage data, IP addresses (anonymized)
- Location: United States
- Privacy Policy: Google Privacy
4.2 We DO NOT
- ❌ Sell your personal information to third parties
- ❌ Share mobile information with third parties or affiliates for marketing or promotional purposes — SMS/text messaging opt-in data and consent are never shared with or sold to anyone
- ❌ Share your data with advertisers without consent
- ❌ Use your data for purposes unrelated to our services without permission
4.3 SMS / Text Messaging
Mainstream Technology Group (a d/b/a of Watchful Solutions, Inc.) sends text messages only to people who have given us permission for the specific phone number we text. We collect your mobile number, the date, time and manner of your consent, and the content of the messages we exchange with you, and we use them only to carry on the conversation you agreed to and to keep a record of your consent and any opt-out.
We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. Our messaging provider (Twilio) processes messages on our behalf and may not use your number for any other purpose.
Message frequency varies with the conversation and is typically no more than a few messages per week. Message and data rates may apply. Reply STOP at any time to opt out and HELP for help. Our SMS Terms are at https://mainstream.net/legal/sms-terms and how we collect permission is described at https://mainstream.net/legal/sms-consent.
5. Your Privacy Rights
5.1 All Users
- Access: Request a copy of your personal information
- Correction: Update or correct inaccurate information
- Deletion: Request deletion of your personal information (subject to legal retention requirements)
- Opt-Out: Unsubscribe from marketing emails (service emails may still be sent)
- Data Portability: Receive your data in a machine-readable format
5.2 California Residents (CCPA Rights)
Under the California Consumer Privacy Act (CCPA), you have the right to:
- • Know what personal information we collect, use, and share
- • Request deletion of personal information
- • Opt-out of the sale of personal information (Note: We do not sell personal information)
- • Non-discrimination for exercising your rights
To exercise these rights, call (•••) •••-•••• x5050
5.3 European Economic Area Residents (GDPR Rights)
Under the General Data Protection Regulation (GDPR), you have the right to:
- • Access your personal data
- • Rectification of inaccurate data
- • Erasure ("right to be forgotten")
- • Restriction of processing
- • Data portability
- • Object to processing
- • Withdraw consent at any time
- • Lodge a complaint with a supervisory authority
Legal basis for processing:
- Contract Performance: Processing necessary to provide our services
- Legitimate Interests: Fraud prevention, security, service improvement
- Consent: Marketing communications, optional features
- Legal Obligations: Compliance with laws and regulations
5.4 How to Exercise Your Rights
Phone: (•••) •••-•••• x5050
Include: Your name and specific request
Response Time: Within 30 days
6. Cookies and Tracking Technologies
6.1 What Are Cookies?
Cookies are small text files stored on your device that help websites function and provide analytics.
6.2 Cookies We Use
Essential Cookies (Required)
- • Session management and authentication
- • Security features and fraud prevention
- • A short-lived security cookie (about 10 minutes) set after you pass the Cloudflare Turnstile check on our forms and homepage box, so our server knows the check was passed
- • Load balancing and performance
- • Cannot be disabled without affecting site functionality
Analytics Cookies (With consent)
- • Google Analytics: Page views, user behavior, traffic sources
- • Helps us understand how visitors use our security tools
- • Data is anonymized where possible
Marketing Cookies (With consent)
- • ActiveCampaign tracking: Email campaign engagement
- • Behavior-based automation triggers
- • Lead scoring and nurturing sequences
6.3 Managing Cookies
- Browser Settings: Most browsers allow you to refuse or delete cookies
- Opt-Out Tools: Use Google Analytics opt-out browser add-on
- Do Not Track: We respect Do Not Track signals where possible
- Cookie Banner: Manage preferences via our cookie consent banner
Note: Disabling cookies may affect website functionality and prevent access to some features.
7. Third-Party Services
7.1 Security Assessment Tools
We offer no-charge security tools that may query third-party services:
- Have I Been Pwned (HIBP): Checks if email appears in data breaches
- SSL Labs: Analyzes website SSL/TLS configurations
- Shodan: IP reputation and exposure scanning
When you use these tools, your query may be sent to third-party APIs. Review their privacy policies for details on how they handle data.
7.2 Third-Party Links
Our website may contain links to third-party websites (e.g., security resources, industry news). We are not responsible for their privacy practices. Review their privacy policies before providing information.
7.3 Homepage “What are you seeing?” Box
The box on our homepage matches what you describe to the page on our site that fits best. Our own software first compares your words with the titles and summaries of our pages. When that does not find a clear match, and you pass a Cloudflare Turnstile check, the text you typed (up to 300 characters) is sent to Anthropic’s AI service, which can only answer with the number of one page from a fixed list of our pages.
- • We do not save what you type in the box, and we do not use it for marketing or add it to any contact record.
- • Please do not type names, passwords, account numbers or other personal information.
- • What Anthropic does with the text is described in section 4.1 and in Anthropic’s own privacy documentation.
8. Data Retention
8.1 How Long We Keep Your Data
Active Clients
- • Service data: Duration of service relationship + 7 years
- • Communication records: 7 years (legal and compliance requirements)
- • Billing records: 7 years (tax and accounting requirements)
- • Security logs: 2 years (incident investigation and compliance)
Former Clients
- • Account information: 7 years after service termination
- • Communication records: 7 years (legal requirements)
- • Marketing data: Until opt-out or 3 years of inactivity
Prospects and Leads
- • Marketing database: Until opt-out or 3 years of inactivity
- • Website analytics: 26 months (Google Analytics default)
- • Form submissions: 3 years or until deletion request
- • IP addresses & location data: 3 years or until deletion request (for fraud prevention and compliance)
8.2 Requesting Data Deletion
You may request deletion of your personal information, including IP addresses and location data, at any time by calling (•••) •••-•••• x5050. We will process deletion requests within 30 days, subject to legal retention requirements.
9. Children's Privacy
Our services are not directed to children under 16 years of age. We do not knowingly collect personal information from children.
If we discover we have collected information from a child under 16, we will delete it immediately. Parents who believe we may have information about a child should call: (•••) •••-•••• x5050
10. International Users
10.1 United States Operations
Mainstream Technology Group operates primarily in the United States. Information collected is processed and stored in the United States.
10.2 International Data Transfers
If you access our services from outside the United States:
- • Your information may be transferred to and processed in the United States
- • United States privacy laws may differ from your country's laws
- • By using our services, you consent to this transfer
- • We implement appropriate safeguards for international transfers
10.3 GDPR Compliance (EEA Users)
For users in the European Economic Area:
- • We provide GDPR-compliant data processing
- • Standard Contractual Clauses (SCCs) for data transfers
- • Right to lodge complaints with supervisory authorities
- • Designated contact for GDPR inquiries: (•••) •••-•••• x5050
11. Changes to This Policy
We may update this Privacy Policy to reflect:
- • Changes in our services or business practices
- • New legal or regulatory requirements
- • Improvements to privacy protections
- • Technology changes affecting data processing
We will notify you of material changes:
- • Email notification to active clients and newsletter subscribers
- • Website banner for 30 days after updates
- • "Last Updated" date at top of this policy
Continued use of our services after changes constitutes acceptance. If you disagree with changes, you may terminate your account.
12. Contact Us
12.1 Privacy Questions
Phone: (•••) •••-•••• x5050
Response Time: Within 2 business days
Mail:
Mainstream Technology Group
(a d/b/a of Watchful Solutions, Inc.)
Attn: Privacy Officer
Portsmouth, New Hampshire
12.2 Data Protection Officer
For GDPR-related inquiries or to exercise your rights, call (•••) •••-•••• x5050
12.3 Security Concerns
If you believe your data has been compromised:
- Immediate Contact: (•••) •••-•••• x5050
- Phone: (•••) •••-•••• x5050 for security issues
- 24/7 Response: We monitor security incidents around the clock
Your Privacy is Our Priority
With 35+ years successfully running IT and security for businesses and clients stay 20+ years across all clients, we understand the importance of protecting your data. Our security-first approach means your privacy is built into everything we do.
Questions About This Policy?
We're here to help. Contact our team with any questions or concerns.