Privacy policy

DataMaker, operated by Mono-Tek.com LLC · effective 2026-11-12

Who this covers

DataMaker is a business application. Mono-Tek.com LLC ("Mono-Tek", "we") runs it for business customers (each a "brand") and the people those businesses give an account to. This policy covers the DataMaker web application at datamaker.mono-tek.com: the people who sign in to it, the billing records it keeps for each brand, and the bank transaction data a brand chooses to connect through Plaid. There is no public sign-up; every account is created by an administrator.

What we collect

• Account details: name, work email address, a salted password hash, and, when turned on, the secret for a one-time sign-in code. We record sign-ins and administrative actions (time, IP address, what changed) for security.
• Billing records: a brand's customers, invoices and payments. Card and bank payments are processed by Stripe; we never receive or store full card or bank account numbers.
• Bank transaction data (Plaid), only for brands that opt in: when a brand's administrator connects the brand's own business bank account through Plaid, we receive the incoming transactions on that account: amount, date, the payer name and memo the bank shows, the payment channel, the account name and last four digits, and the bank's name. We never see or store the bank sign-in; it is entered in Plaid's own window. Plaid's handling of that data is described in the Plaid End User Privacy Policy.
• Files that account holders upload to share with their own recipients.

How we use it

Only to run the service for the brand it belongs to. Bank transaction data has one use: matching money a brand received (wires, ACH transfers, deposited checks) to the invoices that brand issued, so the invoices can be marked paid. It is used internally for that brand only. We do not sell any of this data, use it for advertising or marketing, or use one brand's data for another.

Who we share it with

Only the service providers that run the service on our behalf, each limited to its part: Plaid (bank connections), Stripe (card and bank payments), Amazon Web Services (email delivery and container storage), and our own hosting. We disclose data if the law requires it. Nothing else.

How we protect it

• All traffic is encrypted in transit with TLS 1.2 or higher.
• Plaid access tokens are encrypted before they are stored, and the encryption key is kept separately from the database.
• Access is role-based and scoped to each brand: a person sees only the brands they belong to, and only the areas they were granted.
• Every account signs in with its own password, and a one-time sign-in code is available to every account.

How long we keep it

• When a brand disconnects a bank, its Plaid access is revoked with Plaid and the stored access token is deleted at once. No further data is read from that bank.
• A new bank connection asks Plaid for 90 days of history and no more.
• Bank transactions are kept only to match them to invoices. Once a transaction is matched or set aside, it is deleted automatically 180 days after its date. One that nobody has matched yet is kept until someone does.
• The payments recorded from matched transactions are financial records, kept with the invoices for seven years.
• When a brand stops using DataMaker, we delete its bank transaction data within 30 days of a written request, except where the law requires us to keep it longer.
• Account details are kept while the account exists. Deleting an account removes the person's sign-in; the security log of what that account did is kept for seven years.

Your choices

A brand's administrator can disconnect its bank at any time from the brand page in DataMaker. To see, correct or delete information about you, email support@mono-tek.com. We answer within 30 days.

Changes

When this policy changes, the effective date above changes with it. Material changes are announced to each brand's administrators before they take effect.

Contact

Mono-Tek.com LLC · support@mono-tek.com