Mimir privacy policy

Prepared for Specialist ID, Inc., November 3, 2026

Mímir is Specialist ID's private staff workspace for reviewing storefront product context, opening product or cart quote drafts, and coordinating storefront problem reports. It is intended for authorized Specialist ID staff. Installation does not grant access to restricted company information.

Information handled

  • Staff identity and settings: signed-in staff email, staff names and assignment/mention information, module choices, dock layout, report-view preferences, read markers and optional voice preference. Some preferences are stored in the Chrome profile; Chrome may synchronize sync-area preferences when the user enables Chrome sync. Account-level settings are stored by Specialist ID's staff service.
  • Product and page context: the supported storefront page URL, product/variant identifiers, SKU, authorized stock and bin information, enabled product insights including prices, and cost/margin information only for accounts with that grant. Current-page context is used to display the dock and retrieve relevant reports. Mímir does not collect a general history of unrelated websites.
  • Reports and discussion: titles, descriptions, issue type, priority, responsible staff/helpers, comments, mentions, selected page text or structural element position, and user-selected evidence. Technical context can include browser/operating-system details, viewport/screen dimensions, theme information and bounded script-error metadata. Reports do not include a general raw console or error-stack feed.
  • Screenshots, video and audio: an explicit report action can capture the visible supported storefront. A Record action can capture a short current-tab demonstration, including page audio. Optional microphone voice is controlled by the user and is off by default. Evidence is prepared for review before the user sends a report. Draft evidence is held temporarily by extension/review processes rather than persisted as a Chrome-storage report archive.
  • Cart quote drafts: after the user chooses Quote this cart, Mímir reads that storefront's current cart response, then projects SKU and whole quantity for at most 50 lines into a link to Specialist ID's Quodin quote screen. Create quote uses the selected product SKU and quantity. Cart responses may contain prices and totals, but the quote link contains SKU/quantity, not card details, customer addresses or payment credentials. Opening this link does not itself save or send a quote or submit an order.
  • Authentication and request metadata: browser-managed authentication sessions support HTTPS access to the protected staff service. Mímir does not ask for passwords or embed business API keys. Hosting and authentication providers necessarily process normal network/security metadata, which may include IP address, request timing and browser information.

Why information is used

Information supports the disclosed staff workflow: show the correct authorized product context; prepare and coordinate reports, assignments and discussion; remember preferences; open user-requested product/quote destinations; and maintain security and reliable operation. Mímir does not include advertising, data-sale, unrelated profiling, credit-rating or lending functionality.

Where information goes and who can see it

Reports, staff settings and related workflow data are sent over HTTPS to Specialist ID's staff API. Access is controlled by company authentication, staff authorization and report visibility rules. People granted report access can read report content to investigate and resolve the reported issue.

The server has a configured internal Discord collaboration delivery path for report text, reporter email, page URL, screenshot and eligible recording attachments. Participant notifications may also be delivered through configured company collaboration services. Email notifications depend on separate server enablement and user preferences; a preference alone does not guarantee delivery. Do not submit evidence you do not want the authorized report audience or company collaboration processors to receive.

Cloudflare and Google provide infrastructure and authentication services. Discord processes company collaboration messages and attachments. Chrome sync can process synchronized preferences if enabled by the user. These providers apply their own applicable service/privacy terms.

When the user opens product, source-sheet, profitability or quote links, the browser navigates to the named service and may convey product/search context in the URL. Quodin links include selected SKU and quantity. Other links may open company tools or the associated Finale, ShipStation, Shopify, Google Merchant/Sheets or Amazon product page. Each destination has its own authentication and data handling. Mímir does not directly invoke those vendors' authenticated business APIs from the extension.

Specialist ID limits use and transfer of Mímir user data to providing or improving this staff workflow and applicable security/legal needs. Mímir user data is not sold, transferred for unrelated advertising or profiling, or used to determine creditworthiness or lending eligibility. Specialist ID's use of information received through Mímir complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

Your controls and sensitive content

You choose whether to start capture, enable microphone voice and send report evidence. Review the complete screenshot/recording and text before sending. Capture routes reject named account, cart, checkout, order, app and admin path families, and selection helpers avoid form-text extraction. These checks are not a guarantee that every visible pixel or public URL query is free of sensitive information. Do not include passwords, customer/payment details, health information or unnecessary confidential information in reports. Closing or removing the extension does not delete reports already sent or collaboration copies already delivered.

Security, retention and requests

The extension uses HTTPS for staff-service requests and relies on company access controls. It does not provide end-to-end encryption of reports to individual recipients. This policy does not claim that every infrastructure log, stored report, attachment or backup is encrypted at rest.

This release has no automatic expiry for saved reports. Report content, media, audit history and preferences can remain in company systems and backups until administratively removed under company operational or legal requirements. Delivered collaboration copies are separate from the staff API. We do not promise an automatic deletion period or immediate removal from every backup or processor.

For access, correction, deletion or privacy questions, contact odin@specialistid.com or simon@specialistid.com. Specialist ID will review requests against operational, access and legal requirements; a request is not itself a confirmed deletion receipt.

Changes

Specialist ID will update this policy when the information-handling practices change. Material changes requiring consent will be disclosed through an appropriate user-facing notice before the new handling begins.