Privacy Policy

Effective date: September 21, 2026

Who we are

Mydas LLC ("Mydas", "we") provides finance automation software for promotional-products distributors. Questions about this policy go to privacy@mydas.io or Mydas LLC, 122 French Branch, Madison, MS 39110, United States.

What we collect and why

• Account information: your name and work email address, received from Google or Microsoft when you sign in. We use it to identify you and to send service messages such as invitations and alerts.
• Your company's business data: purchase orders, supplier records, invoices, statements and payment records that your company connects from Syncore, QuickBooks Online and its bank accounts. We use it only to provide the service your company subscribed to.
• Mailbox data: when your company connects an accounts-payable mailbox, we read messages in that mailbox to find vendor invoices and statements, and we apply labels so your team can see what was processed. We do not read other mailboxes, and we never send mail from the connected mailbox.
• Usage and support data: logs of actions taken in the app, kept so your company can audit its own records and so we can support you.

Google user data

Mydas's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (Google API Services User Data Policy), including the Limited Use requirements. In particular, Gmail data is used only to identify and process vendor invoices and statements for the company that connected the mailbox. It is not sold, not used for advertising, and not used to train artificial-intelligence models. Humans at Mydas read it only when you ask for support, for security investigations, or where the law requires.

Who processes data on our behalf

We use a small number of providers to run the service: Vercel (hosting), Neon (database, United States), Anthropic (automated reading of invoices and statements), Resend (transactional email), and Google and Microsoft (sign-in and mailbox access). Each customer's data is stored in its own database, encrypted in transit and at rest, and credentials are encrypted with a key unique to that customer.

Retention and deletion

We keep your company's data for as long as it is a customer. When a company ends its subscription, we delete its database within 30 days of the request, after providing an export on request. Your company can disconnect a mailbox at any time from the app; you can also revoke Mydas's access from your Google Account's "Third-party apps" page or your Microsoft account's app permissions.

Security

Access is restricted to the people your company invites and to Mydas staff for support, and staff access is logged. If we learn of a breach affecting your data, we will notify your company without undue delay.

Changes

We will post changes here and update the effective date. Material changes are announced by email to company administrators.