Privacy policy: the Mydas bank connection
What this connection is
Mydas is a finance automation service operated by Mydas LLC (Washington, USA) for promotional-products distributors. Each customer company has its own space in the service. A customer’s owner or administrator may connect the company’s own business bank, credit card and line-of-credit accounts to that space through Plaid, so that Mydas can show the company’s cash position beside its books, build its 13-week cash forecast and confirm that payments it recorded have cleared the bank. The connection serves that customer alone.
The role of Plaid
Mydas uses Plaid Inc. (“Plaid”) to connect to financial institutions. When a customer connects an account, they sign in to their institution through Plaid Link, Plaid’s own interface, and authorize Plaid to share account data with Mydas. Mydas never sees or stores banking usernames or passwords. By connecting an account the customer also agrees to Plaid’s end-user privacy policy, which governs how Plaid collects, uses and shares that data.
What we access
With the customer’s authorization, Mydas reads, for each connected account: the account’s name, type, masked number and institution; its current and available balance and, for credit accounts, the credit limit; and its transactions, which include the date, amount, description, merchant name, pending status and the category Plaid assigns. Balances are recorded once a day so the cash trend can be shown. The access is read-only: Mydas never initiates payments or transfers, never changes anything at the institution, and does not read account holder identity details or full account numbers.
How we use it
The data is used only to provide the service to the customer that connected it: to show the company’s cash in bank beside its QuickBooks book balance, to open the cash forecast from the real bank balance, to show daily cash activity and recent transactions, to list cards and lines of credit with what is owed and available, and to confirm that vendor payments the customer recorded in Mydas appear in the bank feed. The data is not used for advertising, not used to train models, and not used to make decisions about any individual.
How we store and protect it
Account data is stored in a database dedicated to that customer, hosted in the United States, and shown only inside Mydas to people of that customer who are signed in and hold a finance or administrator role. The access token Plaid issues for a connection is stored encrypted (AES-256-GCM) under a key that belongs to that customer and is itself encrypted under a key held outside the database; only the service’s bank sync can decrypt it. All traffic uses TLS. Signing in requires the Google Workspace or Microsoft 365 account the customer’s administrator invited. Balances and transactions are refreshed about once an hour by a scheduled job. Mydas LLC staff can open a customer’s space to support it; every such session is recorded and limited in time.
Sharing
We do not sell, rent or share bank account data with third parties. The only processors involved are Plaid, as the connection to the institution, and the infrastructure providers that host the service and its databases, acting on our instructions. One customer’s bank data is never shown to another customer, and it is never pooled with other customers’ data.
Retention and deletion
Account data is kept while the bank connection is in use and is refreshed on each sync. A customer administrator can disconnect an account at any time from the bank connections page in Mydas; disconnecting revokes the connection at Plaid and deletes the account, its balances and its transactions from the customer’s database. All bank data is deleted when the customer leaves the service, and earlier on request to the contact below. A customer can also withdraw Plaid’s access directly through Plaid Portal at my.plaid.com.
Changes
If this policy changes in a way that affects what we access or how we use it, we tell each customer’s administrator before the change takes effect and update the date above.
Contact
Questions about this policy, or a request to delete bank data: Mydas LLC, support@mydas.io.