Privacy policy
Draft for counsel review: this text has not yet been reviewed by Mydas's attorney and may change.
What this policy covers
Mydas is a finance automation service operated by Mydas LLC (Washington, USA) for promotional-products distributors. Each client company has its own space in the service, with its own database and its own encryption key. This policy describes what Mydas collects from a client, how it is used, and how it is protected. The QuickBooks connection and the bank connection have their own policies, linked below, which this policy does not replace.
What we collect
From the client's intake and its staff: the company's names, timezone, email domains and address; the names, work email addresses and roles of its people; which of them sign in and with which identity provider; and the name, email address and IP address of the person who accepts these documents, with the time of acceptance and the version accepted.
From Syncore: purchase orders, jobs, suppliers, sales orders, payments and the people assigned to them, read through the client's own API key and automation user.
From the mailboxes the client connects: the vendor invoices and statements those mailboxes receive, and enough of each message to file it. Mydas reads those mailboxes only to pick up vendor documents; it never sends mail from them, never deletes or archives anything, and labels what it has processed.
From QuickBooks Online and the client's bank, where those modules are in the plan: the accounting and account data the QuickBooks privacy policy and the bank connection privacy policy describe.
From use of the service: who signed in, when, and what they approved, so that every action in a client's books can be attributed to a person.
How we use it
To provide the service to that client: matching invoices to purchase orders, preparing pay runs, drafting month-end entries, forecasting cash, and routing questions to the right person. To support the client, where its own people ask. To keep the service secure and to meet legal obligations.
Mydas uses a large language model (Anthropic's Claude, through Anthropic's API) to read vendor documents and draft entries. Data sent to the model is used only to produce that client's drafts, is not used to train models, and is not shared with any other client or party.
Aggregated vendor data
Mydas pools numeric facts about how suppliers behave across its clients, as the terms of service describe: lead times, invoice timing and discrepancy rates, keyed by the supplier's name and shown only where at least three clients contribute. No prices, amounts, documents, reference numbers, names, email addresses or client identities enter the pool. A client may opt out at any time by writing to support@mydas.io.
How we store and protect it
Each client's data lives in a database dedicated to that client, hosted in the United States, and is shown only inside Mydas to people of that client who are signed in and hold a role that covers it. Credentials and tokens are stored encrypted (AES-256-GCM) under a key that belongs to that client and is itself encrypted under a key held outside the database. All traffic uses TLS. Signing in requires the Google Workspace or Microsoft 365 account the client's administrator invited. Mydas LLC staff can open a client's space to support it; every such session is recorded and limited in time.
Who else sees it
Mydas LLC does not sell, rent or share a client's data. The processors involved are the infrastructure providers that host the service and its databases, the email provider that delivers its notifications, and Anthropic for the automated drafting described above, each acting on Mydas LLC's instructions. One client's data is never shown to another client.
Retention and deletion
Mirrored data is kept while the connection that supplies it is in use and is replaced on each sync. When a client disconnects a mailbox, QuickBooks or a bank, the tokens are revoked with the provider and deleted. When a client leaves the service, its data is returned on request within thirty days and deleted afterward, except for the pooled vendor facts, which carry nothing that identifies the client, and records the law requires Mydas LLC to keep.
Your choices and contact
A client's owner or administrator may disconnect any connection, remove any person, opt out of the aggregated vendor data, or ask for a copy or deletion of the client's data at any time. Questions about this policy: Mydas LLC, support@mydas.io.