MAIN STREET SHIFT LLC

Privacy Policy

Effective Date: September 3, 2026

This Privacy Policy explains how Main Street Shift LLC ("Main Street Shift," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with our websites, applications, software, and services, including SMS-enabled services such as CircleNext (collectively, the "Service").

The Service may include different customer-facing products or product names. Main Street Shift LLC remains the operator and policy owner unless a product-specific disclosure expressly states otherwise.

1. Information We Collect

The information we collect depends on how you use the Service.

Customer and Public-User Information

When a customer joins a participating business's waitlist, requests phone verification, interacts with an appointment opening, or otherwise uses a public feature, we may collect information such as:

• name;
• U.S. mobile phone number;
• a normalized version of the phone number used to consistently identify the number;
• desired service;
• limited staff preferences or eligibility, when applicable;
• limited appointment availability or scheduling preferences;
• minimum-notice preferences;
• phone-verification status and related verification records;
• SMS consent records;
• SMS opt-out and suppression status;
• waitlist requests;
• appointment-opening and offer records;
• responses to appointment offers, such as claiming or declining an opening; and
• booking-status information associated with the applicable recovery process.

Customers may use certain public features without creating a customer account.

Phone verification is not customer authentication.

Participating-Business Information

For participating businesses and their authorized users, we may collect information such as:

• business name and contact information;
• authorized-user information;
• account and authentication information;
• business settings;
• service and staff information needed to operate the applicable product;
• appointment-opening information; and
• records of waitlist, customer-communication, and appointment-recovery activity.

Mobile-Messaging and Consent Information

When a person requests or consents to an SMS-enabled service, we may collect and maintain:

• the submitted mobile number;
• the applicable participating business;
• the Main Street Shift product or service presented;
• the messaging purpose and message types disclosed;
• the consent or authorization language presented;
• the copy-version identifier;
• the date and time of the action;
• the method and page through which the action occurred;
• the Terms and Privacy URLs presented;
• phone-verification events;
• opt-in, opt-out, and suppression events;
• delivery-status information; and
• related records reasonably necessary to document permission and messaging history.

Technical and Security Information

We may collect limited technical information reasonably necessary to operate, secure, diagnose, and protect the Service, such as:

• request and error logs;
• security events;
• device or browser information generated by our systems or service providers;
• approximate network information such as IP address generated by ordinary service or security infrastructure; and
• records used to prevent abuse of phone verification, public forms, authenticated accounts, or other Service functionality.

We do not collect technical information merely to create advertising profiles.

2. How We Use Information

We use personal information to:

• provide and operate the Service;
• support Main Street Shift products, including CircleNext;
• process waitlist or service requests;
• verify control of submitted mobile phone numbers;
• determine eligibility for requested messaging;
• match requests with potentially relevant appointment openings;
• send messages that customers have requested or consented to receive;
• process responses to appointment openings;
• communicate appointment-recovery and booking-status information;
• allow participating businesses to manage relevant activity;
• honor SMS opt-outs and suppress messages that should no longer be sent;
• maintain records of messaging permission and customer choices;
• administer and secure participating-business accounts;
• provide customer and business support;
• prevent fraud, abuse, unauthorized access, and misuse;
• troubleshoot errors and maintain reliability;
• enforce our Terms and protect the Service; and
• comply with applicable legal, regulatory, telecommunications-provider, carrier, and service-provider requirements.

3. Main Street Shift Products and Participating Businesses

Main Street Shift operates the software and related infrastructure.

CircleNext is a messaging program operated by Main Street Shift LLC. For business-specific appointment-opening messages, Main Street Shift sends through CircleNext and clearly identifies the participating business to which the opening and consent relate.

When a customer affirmatively opts in, the customer gives consent to Main Street Shift LLC through the CircleNext program for the disclosed recovery messages concerning the specifically identified participating business and purpose. Main Street Shift processes and maintains evidence supporting that consent. This relationship is not a sale or transfer of consent to an unrelated business.

Participating businesses may separately maintain information about their customers in their own scheduling, payment, customer-management, or other systems. Those systems and the business's independent privacy practices are not controlled by this Privacy Policy.

Product-specific disclosures may provide additional information about the participating business, product, purpose, and data involved in a particular workflow.

4. Mobile Phone Numbers and Phone Verification

The Service may collect mobile phone numbers for phone verification and, when separately authorized, recurring communications.

Before a phone number becomes eligible for a particular messaging service, Main Street Shift may require verification that the customer controls the submitted number.

We currently use Twilio Verify to send SMS verification codes.

When you request an SMS verification code, your mobile number is provided to Twilio as necessary to send and process the verification message.

Successful verification confirms control of the submitted number for the stated purpose.

Phone verification does not create a customer account and does not, by itself, constitute consent to receive recurring appointment-opening, waitlist, recovery, marketing, or other ongoing text messages.

5. SMS-Enabled Services and Recurring Consent

Main Street Shift operates SMS-enabled services, including CircleNext.

Consent to receive recurring messages is collected separately from phone-verification authorization.

The applicable disclosure will identify:

• Main Street Shift LLC and the CircleNext messaging program as sender;
• the specifically identified participating business to which messages relate;
• the messaging purpose;
• the types of messages;
• expected or variable message frequency;
• message and data rate information;
• HELP and support options;
• STOP or other opt-out instructions; and
• whether consent is optional.

When CircleNext uses an initially unchecked checkbox or comparable electronic action, the customer's completion of that action may serve as the customer's electronic signature and prior express written consent to receive the recurring automated messages described in the disclosure from Main Street Shift LLC through CircleNext at the mobile number provided, concerning the specifically identified participating business and purpose.

For appointment-opening services, messages may include appointment openings, offer information, waitlist updates, claim updates, booking-status information, appointment confirmations, and notices that an opening was released or is no longer available.

Message frequency varies based on the applicable service, customer activity, and events such as appointment-opening availability.

Message and data rates may apply.

Consent to receive recurring messages is not a condition of purchasing goods or services from a participating business.

We do not treat any of the following, by themselves, as recurring-message consent:

• providing a mobile phone number;
• completing phone verification;
• being an existing customer of a participating business;
• previously booking goods or services; or
• having information imported from another system.

When consent is provided, we may retain information showing when, where, and how it was obtained, the sender and product involved, and the version of the consent language presented.

An initial recurring-message confirmation may identify the applicable participating business and product, restate message-frequency and rate information, and provide HELP and STOP instructions.

6. SMS Opt-Outs and Suppression

You may opt out of applicable recurring messages by replying STOP.

You may also revoke consent through another reasonable method communicated to you or by contacting support@mainstreetshift.com and clearly requesting that the applicable messages stop. We may treat ordinary language that a reasonable person would understand as a request to stop texting as an opt-out request.

When we receive an applicable opt-out, we may record information such as:

• the mobile number;
• the participating business or messaging relationship involved;
• the product or service involved;
• the date and time of the opt-out;
• the method by which the opt-out was received; and
• the resulting suppression status.

We use this information to prevent additional messages covered by the opt-out.

We may send one final non-promotional message confirming that the opt-out has been processed.

After that confirmation, additional messages covered by the opt-out will remain suppressed unless the customer later completes a new affirmative opt-in that satisfies the consent requirements then applicable to those messages.

Phone verification, a new appointment or purchase, an update to waitlist preferences, or continued use of the Service does not, by itself, clear a suppression status or restore recurring-message consent.

We may apply broader suppression when reasonably necessary to honor the customer's request or satisfy applicable law, carrier rules, or provider requirements.

We may retain opt-out and suppression records after other information is no longer actively used when reasonably necessary to prevent unwanted messages, document messaging history, or satisfy legal or service-provider requirements.

7. How We Disclose Information

We disclose personal information only as reasonably necessary for the purposes described in this Policy.

Participating Businesses

When you use a service associated with a particular participating business, that business may receive information reasonably necessary to operate the applicable workflow.

This may include relevant customer information, service and preference information, appointment-opening information, and responses to offers.

For business-specific CircleNext messages, Main Street Shift LLC is the sender through the CircleNext messaging program. The consent screen identifies the participating business to which the appointment-opening messages relate, and Main Street Shift maintains the supporting consent evidence.

We do not use a customer's consent for one participating business as permission to send messages for unrelated participating businesses.

Service Providers

We use service providers to operate the Service.

These may include:

• Twilio, including Twilio Verify, for phone verification and communications infrastructure;
• Supabase for application, database, business-user authentication, and related infrastructure; and
• hosting, deployment, security, communications, and operational providers that help us operate and protect the Service.

These providers may process information only as reasonably necessary to perform services for us and are subject to their own contractual and legal obligations.

Service providers are not treated as customer-facing message senders merely because they process or transmit a message.

Legal, Security, and Safety Purposes

We may disclose information when we reasonably believe disclosure is necessary to:

• comply with applicable law, regulation, subpoena, court order, or lawful process;
• respond to lawful requests from government authorities;
• investigate fraud, abuse, security incidents, or unlawful activity;
• enforce our Terms or other agreements;
• establish, exercise, or defend legal claims; or
• protect the rights, property, security, or safety of Main Street Shift, participating businesses, customers, service providers, or others.

Business Transactions

If Main Street Shift is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, information may be disclosed or transferred as part of that transaction, subject to applicable law.

Any transfer of company information does not, by itself, transfer or expand a customer's SMS consent. Messaging may continue only when the applicable permission and other requirements remain satisfied.

8. Mobile Information, Messaging Consent, and Marketing

Main Street Shift does not sell personal information.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

We do not sell or rent mobile phone numbers, text-messaging originator opt-in data, or SMS consent records.

Text-messaging originator opt-in data and consent will not be shared with third parties or affiliates. We may disclose that information only to messaging service providers, aggregators, mobile carriers, and other vendors solely as necessary to provide the applicable messaging service, maintain security, prevent fraud or abuse, honor customer choices, or comply with law.

For business-specific CircleNext messages, the customer gives consent to Main Street Shift LLC through the CircleNext messaging program for the disclosed purpose concerning the participating business identified on the consent screen. Main Street Shift maintains or processes the supporting evidence, and that consent is not used for unrelated participating businesses.

All other information-sharing categories described in this Privacy Policy exclude text-messaging originator opt-in data and consent unless a disclosure is necessary for the limited messaging-service, security, customer-choice, or legal purposes stated above.

Service providers may not use mobile information or messaging-consent data for their own marketing or promotional purposes.

Mobile information may also be disclosed when reasonably necessary to maintain security, prevent fraud or abuse, comply with law, or honor customer choices.

Consent for messages associated with one participating business does not authorize messages from unrelated participating businesses.

Consent to receive informational or appointment-recovery messages does not authorize unrelated marketing or promotional messages.

9. Imported Information

Participating businesses or integrations may provide the Service with customer or operational information needed to provide requested functionality.

The fact that information was imported into the Service does not establish SMS consent.

Imported customer information becomes eligible for recurring messaging only when the applicable consent, verification, suppression, and provider requirements have been satisfied.

10. Retention

We retain personal information for as long as reasonably necessary for the purposes for which it was collected, including to:

• operate the Service;
• maintain waitlist, communication, and appointment-recovery records;
• provide support;
• maintain security and prevent abuse;
• document messaging permissions and customer choices;
• enforce agreements and resolve disputes; and
• comply with applicable legal, carrier, or service-provider obligations.

Different categories of information may be retained for different periods.

Consent, policy-version, opt-out, and suppression records may be retained longer than active waitlist information when reasonably necessary to document messaging permissions or prevent unwanted messages.

We may preserve historical policy and consent-language versions so that earlier consent events remain reconstructable.

When information is no longer reasonably needed, we may delete or de-identify it, subject to applicable legal, operational, backup, evidence-preservation, and security requirements.

11. Your Choices

SMS Choices

You may reply STOP to an applicable recurring message to opt out of the messages covered by that opt-out.

You may also contact support@mainstreetshift.com or use another reasonable method communicated to you to request that applicable messages stop. A clear ordinary-language request to stop texting will be treated as an opt-out request when reasonably understood as such.

For SMS HELP, phone-verification assistance, waitlist questions, or ordinary product support, contact:

support@mainstreetshift.com

Privacy Requests

Depending on where you live and the circumstances, applicable law may give you rights concerning personal information about you, such as rights to request access, correction, or deletion.

You may submit a privacy or data-rights request to:

legal@mainstreetshift.com

We may take reasonable steps to verify your identity or control of the relevant mobile number before fulfilling certain requests.

When information is maintained through the Service on behalf of or in connection with a participating business, we may coordinate with that business when reasonably necessary to respond.

Applicable law may provide exceptions or limitations, including when information must be retained for security, fraud prevention, legal compliance, dispute resolution, consent evidence, or suppression of unwanted messages.

12. Security

We use reasonable administrative and technical measures intended to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

No website, application, database, communications system, or method of transmitting or storing information can be guaranteed to be completely secure.

Accordingly, we cannot guarantee absolute security.

13. Cookies and Online Tracking

The Service may use cookies or similar technologies when reasonably necessary for authentication, security, fraud prevention, session management, or other core functionality.

We do not use the Service to build advertising profiles about customers or track customers across unrelated websites for targeted advertising.

We do not permit third-party advertising networks to use the Service to collect personal information for cross-site behavioral advertising.

Because we do not currently engage in this type of cross-site advertising tracking, we do not currently alter the Service's behavior in response to browser "Do Not Track" signals.

If our online tracking practices materially change, we will update this Privacy Policy and provide additional choices or disclosures when required.

14. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13.

If you believe a child under 13 has provided personal information through the Service, contact legal@mainstreetshift.com.

15. Changes to This Privacy Policy

We may update this Privacy Policy as our products, practices, or applicable requirements change.

When we make changes, we will update the effective date at the top of this Policy.

If a change materially affects how we handle personal information, we will provide additional notice when required by applicable law.

Product-specific disclosures may also be updated when a particular product or workflow changes.

A change to this Privacy Policy or to a product name does not, by itself, expand the scope of messaging consent previously provided.

16. Contact Us

For privacy questions, data-rights requests, or formal privacy/legal correspondence, contact:

legal@mainstreetshift.com

For product assistance, waitlist questions, SMS HELP, or phone-verification support, contact:

support@mainstreetshift.com

Main Street Shift LLC