Legal

Midgard Suites Privacy Policy

Effective Date: September 25, 2026
Operator: Midgard Ledgers ("Midgard," "we," "us"), Orlando, Florida
Contact: jrm@midgardledgers.financial

This Privacy Policy explains how Midgard collects, uses, and protects information through Midgard Suites, including Midgard Practice Manager, Fixed Asset Manager, Amortization Calculator, and our related websites (the "Services").

1. Our Role

Account and website data: Midgard acts as the controller of information about firms and users who sign up, pay, or visit our website.
Customer Data: When a firm uploads information about its own clients (client records, documents, assets, loan schedules), the firm controls that data and Midgard processes it on the firm's behalf as a service provider/processor. Clients of our customers should direct privacy requests to their accounting firm.

2. Information We Collect

You provide:

Account details: name, email, firm name, role, password or sign-in credentials.
Billing details: billing contact and address. Card data is handled by our payment processor; we do not store full card numbers.
Customer Data: client names and contact details, tax identifiers (e.g., SSN/EIN) where entered, financial and tax documents, workflows, notes, fixed-asset registers, depreciation settings, and amortization schedules.
Support communications.

Collected automatically:

Log and device data: IP address, browser type, pages used, timestamps, and error logs.
Cookies and similar technologies needed for sign-in, session security, and preferences. We do not use advertising cookies within the application.

3. How We Use Information

Provide, operate, and maintain the Services and enabled Modules.
Authenticate users, enforce firm-level access, roles, and subscriptions.
Process payments and manage subscriptions.
Secure the Services, detect abuse, and troubleshoot issues.
Communicate about accounts, updates, security, and support.
Improve the Services using aggregated or de-identified usage information.
Comply with legal obligations.

We do not sell personal information, share it for cross-context behavioral advertising, or use Customer Data to train AI models for unrelated third parties.

Service providers (subprocessors) that help run the Services, bound by confidentiality and security obligations, including Supabase (database, authentication, and storage), Vercel (hosting), Stripe (payments), and Postmark (email delivery). A current list is available on request.
Within your firm: Authorized Users of the same firm may see data according to roles set by the firm.
Legal and safety: when required by law, subpoena, or to protect rights, security, and safety.
Business transfers: in a merger, acquisition, or sale of assets, subject to this Policy.
With your direction: integrations or sharing you choose to enable.

5. Tax Return Information

Where Customer Data includes tax return information, Midgard uses and discloses it only to provide the Services to the firm and as permitted under IRC §7216 and related regulations. Firms remain responsible for obtaining any taxpayer consents they require.

6. Data Security

We use safeguards appropriate to financial data, including:

Encryption in transit (TLS) and at rest through our hosting providers;
Tenant isolation with database-level Row Level Security tied to firm membership;
Separate production and staging environments; test systems do not use live customer data;
Role-based access and least-privilege administrative access;
Backups and monitoring.

No system is perfectly secure. We will notify affected customers of a security breach as required by law, including the Florida Information Protection Act (Fla. Stat. §501.171).

7. Data Retention

We keep account data while your account is active and as needed for legal, tax, and accounting obligations. After a subscription ends, Customer Data is available for export for 30 days and then deleted, except as retained in backups that expire on a rolling schedule of up to 90 days, or as required by law.

8. Your Choices and Rights

Access, update, or correct account information in your settings or by contacting us.
Request deletion of your account or export of your firm's data.
Opt out of non-essential emails via the unsubscribe link (service and security messages still apply).
Depending on where you live (e.g., California and other U.S. states, or the EU/UK), you may have rights to know, access, correct, delete, or port personal information and to not be discriminated against for exercising them. Contact us to make a request; we will verify your identity and respond within the time required by law. Requests about data a firm entered about you will be forwarded to that firm.

9. Children

The Services are for business use and are not directed to children under 16. We do not knowingly collect their information directly from them. Firms may enter dependents' information as part of professional services, which is handled as Customer Data.

10. International Users

Data is stored and processed in the United States. By using the Services from outside the U.S., you understand your information will be transferred to the U.S.

11. Changes

We may update this Policy. We will post the new version with a new effective date and notify account owners of material changes in advance.

12. Contact

Midgard Ledgers — Privacy
Orlando, Florida
jrm@midgardledgers.financial