Privacy Policy

1. Introduction

Welcome to SeenOnMain ("SeenOnMain," "we," "us," or "our"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains what information we collect, how we use it, and what rights you have in relation to it.

This policy applies to all information collected through our website at https://seenonmain.com, and/or any related services, sales, marketing, or events (collectively, the "Services").

SeenOnMain is operated by Work Stream Apps LLC. By using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies, please do not use our Services.

Our two roles. For information about your own account (such as your business and billing details), SeenOnMain is the "controller," and this policy explains how we handle it. For the leads, contacts, and customer information you collect and manage through the Service ("Lead Data"), SeenOnMain acts only as a "processor" (service provider) on your behalf and on your instructions. You are the controller of that Lead Data and are responsible for how it is collected and used, including obtaining any required consent. If an individual asks to access, correct, or delete information you hold about them, please direct that request to the business that collected it, and we will reasonably assist. We do not sell Lead Data or use it for our own purposes, and each customer's Lead Data is kept in a separate, isolated environment.

2. Information We Collect

2.1 Personal Data You Provide

We collect personal information that you voluntarily provide when registering for our Services. This includes:

• Account Information: Email address, password (encrypted), and business or organization name
• Google OAuth Data: If you choose to sign in or sign up using Google, we receive your name, email address, and profile picture from Google. We do not receive or store your Google password.
• Payment Information: When you purchase a workflow pack, your payment is processed securely through Stripe. We do not store your credit card numbers, bank account details, or other financial information on our servers. Stripe handles all payment processing.
• Communications: Any messages, feedback, or support requests you send to us
• DigitalOcean OAuth: If you connect your DigitalOcean account, we receive an OAuth access token to provision and configure your server. We do not store your DigitalOcean password. You can revoke this access at any time from your DigitalOcean account settings.
• Referral Information: If you tell us who referred you when subscribing, or identify who you referred when requesting a Referral Reward, we collect the name or email address you provide for that other business so we can attribute and administer the referral program. We use this information only for that purpose and do not use it to contact the referenced business independently of your own outreach.

2.2 Data Collected Automatically

When you visit our website, we may automatically collect certain information, including:

• Log Data: IP address, browser type, operating system, referring URLs, pages visited, and timestamps
• Cookies: Essential cookies for authentication and session management. Analytics and advertising-measurement cookies are set with your consent where the law requires it (for example in the EU and UK). For visitors in the United States they are on by default, and you can opt out at any time (see Section 6).
• Device Information: Device type, screen resolution, and language preferences

2.3 SMS Communications

If you or your customers provide a phone number through a lead form, quote form, or onboarding flow, we may send a series of up to four (4) SMS text messages over approximately 14 days related to your inquiry, using Twilio, Inc. as our SMS delivery provider. Message and data rates may apply. Message frequency varies. You may opt out at any time by replying STOP, or get help by replying HELP. We do not sell phone numbers collected for this purpose. See Twilio's Privacy Policy for how Twilio processes message content and metadata on our behalf.

2.4 Missed Call SMS Consent

If you call SeenOnMain's toll-free business line, you will hear a recorded notice before the call connects, offering the option to receive a one-time text message if your call goes unanswered. Pressing 1 during that notice is what grants consent to receive that single text; the call connects normally either way, whether or not you press 1. If you do not press 1, you will not receive any text message. This results in a single, one-time SMS per missed call, never a recurring or marketing sequence. This verbal, phone-based consent is separate from, and does not enroll you in, the multi-message lead follow-up sequence described in Section 2.3 above. Message and data rates may apply.

3. How We Use Your Information

We use your personal data for the following purposes:

• Account Management: To create, maintain, and secure your account
• Service Delivery: To provide, operate, and maintain our workflow deployment platform
• Payment Processing: To process your one-time workflow pack purchase via Stripe
• Workflow Deployment: To use your DigitalOcean OAuth token to provision your server, install workflow software, and configure your sales funnel automation on your behalf
• Communication: To send you service-related notifications, deployment status updates, and support responses
• Improvement: To understand how our Services are used and improve them (analytics cookies are used by default in the United States and with your consent elsewhere; you can opt out at any time)
• Legal Compliance: To comply with legal obligations and protect our rights

4. Legal Basis for Processing (GDPR)

If you are a resident of the European Economic Area (EEA), our legal basis for collecting and using your personal data depends on the specific context:

• Contractual Necessity: Processing your account data to provide you with our Services
• Consent: Where you have given us explicit consent (e.g., for analytics cookies outside the United States, marketing emails)
• Legitimate Interests: To improve our Services, prevent fraud, and ensure security
• Legal Obligations: To comply with applicable laws and regulations

5. Data Sharing & Third Parties

We do not sell your personal data. We share your data only with:

• Google (OAuth Authentication): If you choose to sign in with Google, your authentication is handled through Google's OAuth 2.0 service. Google provides us with your name, email address, and profile picture. We do not share any of your data back with Google beyond what is required for the authentication process. See Google's Privacy Policy.
• Stripe: Our payment processor, which handles all financial transactions securely. See Stripe's Privacy Policy.
• DigitalOcean: Your workflow packs are deployed to your own DigitalOcean account using an OAuth token you authorize. We use this token solely to provision infrastructure and deploy your workflow software. We do not share your personal data with DigitalOcean. See DigitalOcean's Privacy Policy.
• Twilio: We use Twilio, Inc. as our SMS delivery provider to send text messages related to leads and inquiries submitted through a customer's lead form, quote form, or onboarding flow. Phone numbers and message content necessary to deliver these messages are shared with Twilio for that purpose. See Twilio's Privacy Policy.
• Anthropic: We use Anthropic's Claude AI models to help personalize the content of certain emails and SMS messages using lead and customer information provided for that purpose. Claude does not make any automated decision that produces legal or similarly significant effects about you. See Anthropic's Privacy Policy.
• Neon: We use Neon (a managed PostgreSQL provider) to host our control-plane database, which stores account, configuration, and messaging metadata.
• Resend: We use Resend to deliver transactional and notification emails (such as account, billing, and alert emails).
• Legal Requirements: We may disclose your information if required by law, court order, or governmental regulation.

These providers act as our subprocessors. If you are a business customer using the Service to message your own leads and customers, our processing of that data on your behalf is governed by our Data Processing Addendum, which lists our subprocessors and the data-protection terms that apply.

6. Cookies & Tracking Technologies

We use the following types of cookies:

You can opt out of analytics and advertising-measurement cookies at any time: choose Decline on the cookie banner, use the Cookie settings link in the page footer, or turn on Global Privacy Control in your browser, which we treat as an opt-out. Declining stops those tools from loading on later pages and on the page you are on after it reloads. You can also manage cookies in your browser settings.

7. Your Rights Under GDPR

If you are located in the EEA, you have the following data protection rights:

• Right of Access: You can request a copy of the personal data we hold about you. Use the "Export My Data" feature in your dashboard settings.
• Right to Rectification: You can update or correct your personal data through your account settings.
• Right to Erasure ("Right to be Forgotten"): You can request deletion of your account and all associated data. Use the "Delete My Account" feature in your dashboard settings.
• Right to Restrict Processing: You can ask us to limit the processing of your data.
• Right to Data Portability: You can request your data in a commonly used, machine-readable format (JSON).
• Right to Object: You can object to our processing of your personal data for certain purposes.
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at privacy@workstreamapps.com or use the self-service tools in your account dashboard.

8. U.S. State Privacy Rights

If you are a resident of California or another U.S. state with a comprehensive consumer privacy law (such as the CCPA/CPRA and similar state statutes), you may have the following rights with respect to your personal information:

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you, and the purposes for which it is used.
• Right to Delete: You may request deletion of your personal information, subject to certain legal exceptions.
• Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising, and we do not otherwise sell or share personal information as defined under these laws.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

To exercise any of these rights, please contact us at privacy@workstreamapps.com. We will verify your request and respond within the timeframe required by applicable law.

9. Data Retention

We retain your personal data only for as long as necessary to provide our Services and fulfill the purposes described in this policy. When you delete your account, we will delete or anonymize your personal data within 30 days, unless we are legally required to retain certain information.

Lead Data Retention. Lead Data submitted through a customer's lead form, quote form, or onboarding flow is retained in our active operational database for up to 60 days, then moved to encrypted backup storage for an additional 30 days, and permanently deleted no later than 90 days after initial collection, unless the business customer instructs otherwise or a longer period is required by law.

Message Records Retention. Records of automated messages we send on a business customer's behalf, including the recipient's contact details, the message content that was sent, and its delivery status, are retained for up to 90 days so the business can review what was sent, then permanently deleted, unless a longer period is required by law.

DigitalOcean OAuth tokens are stored only as long as needed to manage your deployed workflow infrastructure. You may revoke access at any time from your DigitalOcean account, after which we will delete the associated token.

10. Data Security

We implement appropriate technical and organizational security measures to protect your personal data, including:

• HTTPS/TLS encryption for all data in transit
• Password hashing using argon2 (industry-standard algorithm)
• Payment data handled exclusively by PCI-compliant Stripe
• Regular security reviews and access controls
• OAuth tokens stored encrypted and scoped to the minimum permissions required for deployment

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your data, we will notify you without undue delay as required by applicable law.

11. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside. These countries may have data protection laws that are different from your country. We ensure that appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable law.

12. Children's Privacy

Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us immediately and we will take steps to delete such information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this page periodically.

14. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:

If you are in the EEA and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection supervisory authority.