--- title: "Privacy Policy (effective 2026-11-02)" --- > Documentation Index > Fetch the complete documentation index at: https://legal.middag.io/llms.txt > Use this file to discover all available pages before exploring further. # Privacy Policy (effective 2026-11-02) > Upcoming version 1.1.0. It takes effect on 2026-11-02. > > Until then, the [version in force](/privacy/) applies. > > Links to other documents lead to the versions in force on 2026-11-02. This Privacy Policy explains how MIDDAG, LLC, a limited liability company registered in Delaware, United States ("MIDDAG", "we" or "us"), collects, uses, shares and protects personal data, and the rights that people have over it. ## 1. Scope 1.1. This Privacy Policy applies to personal data that MIDDAG processes as controller: when you visit our websites, create or use an account in the MIDDAG Account, buy or use our products and services, contact us, take part in our partner program or receive our communications. 1.2. When you contract our services as an individual for personal use (a Consumer, as defined in our [Terms of Service](/terms/)), MIDDAG is the controller of your personal data, and this Privacy Policy applies. 1.3. When an organization uses our services and we process personal data on its behalf, such as the data of the users of a platform that we host for it, the organization is the controller, and we process that data as its processor under our [Data Processing Addendum](/dpa/); questions about that data should go to that organization first. 1.4. This Privacy Policy does not apply to the websites and services of third parties, even when our services link to them. ## 2. Personal data we collect 2.1. **Account and identification data:** name, user name, e-mail address, organization, job title, country and the type of contracting party you declare (organization, individual or public authority). 2.2. **Contact and communication data:** the content of your messages, support requests and calls with us, and your communication preferences. 2.3. **Transaction and billing data:** the products and services you buy, invoices, billing address and tax identifiers; card and payment details are collected and processed by our payment provider, and we do not store full card numbers. 2.4. **Usage and device data:** IP address, browser and device type, pages visited, dates and times of access, and logs of the use of our services, collected in part through cookies and similar technologies as described in our [Cookie Policy](/cookies/). 2.5. **Acceptance records:** the version of the terms and policies you accepted, the date and time of acceptance and the account that accepted. 2.6. **Partner data:** for partners, the contact details and the data needed to manage referrals and resale, and to pay commissions. 2.7. We collect personal data directly from you, automatically when you use our websites and services, and from third parties such as your organization (when it gives you access to an account), our partners (when they refer you or resell our services to you) and our payment provider. 2.8. Our services are not directed to children under 16, and we do not knowingly collect personal data of children under 16 as controller; if you believe we hold such data, contact privacy@middag.io and we will delete it. ## 3. How we use personal data and our legal bases 3.1. **To provide our services:** to create and manage your account, provide the products and services you contracted, give support and send service communications. Legal basis: performance of a contract with you, or our legitimate interest in serving the organization you represent. 3.2. **To bill and collect payments:** to invoice, collect payments and keep accounting and tax records. Legal basis: performance of a contract and compliance with legal obligations. 3.3. **To record the acceptance of our terms:** to keep proof of which terms and policies were accepted, when and by whom. Legal basis: our legitimate interest in proving our agreements, and compliance with legal obligations. 3.4. **To manage relationships with business customers, leads and partners:** to answer inquiries, follow up on proposals and manage the partner program. Legal basis: performance of a contract or steps before entering into one, and our legitimate interest in developing our business. 3.5. **To send marketing communications:** to send news and offers about our products and services. Legal basis: your consent where the law requires it, or our legitimate interest; you can opt out at any time through the link in each message or at privacy@middag.io. 3.6. **To keep our services secure:** to detect, prevent and respond to fraud, abuse, security incidents and technical errors. Legal basis: our legitimate interest in protecting our services and users, and compliance with legal obligations. 3.7. **To improve our services:** to understand how our websites and services are used and to fix and improve them. Legal basis: our legitimate interest, or your consent where the law requires it for cookies and similar technologies. 3.8. **To support our team's work with AI tools:** our team uses AI tools, provided by the service providers listed on our [Subprocessors](/subprocessors/) page, to help search, read and draft internal documents and communications that may include business contact data. Legal basis: our legitimate interest in working efficiently; these tools are used under agreements with their providers. 3.9. **To comply with the law and defend our rights:** to meet legal obligations, respond to lawful requests of authorities and establish, exercise or defend legal claims. Legal basis: compliance with legal obligations and our legitimate interest. 3.10. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. 3.11. Where we rely on your consent, you may withdraw it at any time, without affecting the lawfulness of the processing before the withdrawal. ## 4. How we share personal data 4.1. **Service providers:** we share personal data with the providers that process it on our behalf, such as hosting, payments, error tracking and work tracking, listed on our [Subprocessors](/subprocessors/) page, under agreements that limit their use of the data. 4.2. **Partners:** when you buy through a partner, or a partner refers you to us, we share with that partner the data needed to manage the resale or the referral. 4.3. **Your organization:** when your account belongs to an organization, the administrators of that organization can see and manage data related to its accounts. 4.4. **Authorities and legal process:** we disclose personal data when the law, a court order or a lawful request of an authority requires it, or when needed to protect the rights, safety and property of MIDDAG, our users or others. 4.5. **Business transfers:** in a merger, acquisition, financing or sale of assets, personal data may be transferred to the parties involved, under confidentiality obligations and subject to this Privacy Policy. 4.6. We do not sell personal data in exchange for money. 4.7. Where our use of cookies or similar technologies counts under a law as a sale or sharing of personal data, or as targeted advertising, our [Cookie Policy](/cookies/) describes it and how to opt out, including through a recognized opt-out preference signal such as Global Privacy Control, where the law requires us to honor it. ## 5. International transfers 5.1. MIDDAG is established in the United States, and our service providers may process personal data in the United States and in the other locations shown on our [Subprocessors](/subprocessors/) page. 5.2. When we transfer personal data subject to the GDPR to a country that is not subject to an adequacy decision of the European Commission, we use the standard contractual clauses approved by the European Commission, or another transfer mechanism that the GDPR recognizes. 5.3. You may ask for information about the safeguards we use for international transfers at privacy@middag.io. ## 6. Retention 6.1. We keep personal data only for as long as needed for the purposes described in this Privacy Policy. 6.2. Account, contract and relationship data are kept while the account or the relationship lasts and afterwards for the period needed to meet legal, accounting and tax obligations, resolve disputes and enforce our agreements. 6.3. Acceptance records are kept for as long as the accepted terms may be relevant to a claim. 6.4. Marketing data are kept until you opt out or withdraw your consent, after which we keep only what is needed to respect your choice. 6.5. When the retention period ends, we delete or anonymize the personal data. ## 7. Security 7.1. We use technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration and disclosure, such as access control, encryption in transit and at rest, logging and monitoring; the measures for data we process on behalf of organizations are described in Annex 2 of our [Data Processing Addendum](/dpa/). 7.2. No method of transmission or storage is completely secure. 7.3. If you believe your account or data is at risk, contact security@middag.io, as described on our [Security](/security/) page. ## 8. Your rights 8.1. Depending on where you live, and subject to the conditions and exceptions of the law that applies to you, you may have the rights described in this section. 8.2. **If the GDPR applies to you:** you have the right to access your personal data, to have it rectified, to have it erased, to restrict its processing, to data portability, to object to processing based on our legitimate interests, including profiling, and to object at any time to direct marketing, and to withdraw your consent. 8.3. **If you live in a state of the United States with a comprehensive consumer privacy law:** you may have the right to know and access the personal data we hold about you, to correct it, to delete it, to obtain a portable copy, and to opt out of the sale or sharing of personal data, of targeted advertising and of profiling in furtherance of decisions that produce legal or similarly significant effects. 8.4. **How to exercise your rights:** send your request to privacy@middag.io, or use the features of the MIDDAG Account where available. 8.5. **Verification:** we verify your identity before acting on a request, using information we already hold, and we may ask for additional information only for that purpose. 8.6. **Authorized agents:** where the law allows, you may use an authorized agent to make a request on your behalf, and we may ask the agent for proof of authorization and ask you to verify your identity directly. 8.7. **Response time:** we respond within the period that the law that applies to you sets. 8.8. **Appeal:** if we decline your request, you may appeal by replying to our decision or by writing to privacy@middag.io with the subject "Appeal"; we will tell you the result of the appeal and, where the law gives you that right, how to contact the competent authority. 8.9. **Complaints:** you have the right to lodge a complaint with a data protection supervisory authority, in particular where you live or work or where an alleged infringement took place. 8.10. **No discrimination:** we will not discriminate against you for exercising your privacy rights. 8.11. If your personal data was provided to us by an organization that uses our services as controller, we will forward your request to that organization, as described in section 1.3. ## 9. Changes to this Privacy Policy 9.1. We give notice of changes to this Privacy Policy 30 days before the effective date of the change. 9.2. We send the notice by e-mail through the MIDDAG Account to our customers, and publish the upcoming version on the [Updates](/updates/) page until its effective date. 9.3. A change required by law or by an authority, needed for security, or that only benefits you takes effect on its effective date, with notice as soon as possible. 9.4. A change to our list of service providers, published on the [Subprocessors](/subprocessors/) page, is an update of the information in this Privacy Policy. 9.5. We will not apply a material change in how we use personal data already collected to that data without your consent, where the law requires that consent. ## 10. Contact 10.1. The controller of the personal data described in this Privacy Policy is MIDDAG, LLC, attention Privacy, 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States. 10.2. Questions about this Privacy Policy, and requests about your personal data: privacy@middag.io. 10.3. Security issues: security@middag.io. 10.4. Legal notices: legal@middag.io. ## Changelog - **1.1.0 — 2026-11-01** — The postal address of MIDDAG, LLC is added to the contact section, after the legal review of the first version. - **1.0.0 — 2026-11-01** — First version of the Privacy Policy of MIDDAG, LLC. Source: https://legal.middag.io/updates/privacy-effective-2026-11-02/index.mdx