Privacy policy

Who we are

Margn is run by [Margn's legal entity name and NZBN], [registered office address]. You can contact us about anything on this page at [privacy contact email].

What we collect

• Your account: your name, email address, a scrambled (hashed) version of your password, and when you agreed to our terms. We never see or store your actual password.
• Your business: its name, GST number, sites, team members and settings.
• Invoice data: the supplier invoices you upload or import from Xero, the original files, and what Margn works out from them (prices, flags, notes you add, purchase orders and agreed prices or quotes). Invoices can include personal information about other people, such as a sales rep's name or email.
• Xero connection: if you connect Xero, an access token that lets Margn read your bills and supplier contacts. It is encrypted, read-only, and you can disconnect at any time.
• Technical information: a session cookie that keeps you logged in, your IP address for security limits (for example, to slow down password guessing), and error reports when something breaks.

We don't use advertising or tracking cookies, and we don't sell or rent anyone's information.

Why we use it

• To check your invoices, show you flags and reports, and help you raise them with suppliers.
• To run your account: logging in, password resets, confirming your email, and team invites.
• To send the weekly summary of new flags, if your business has it turned on.
• To keep Margn secure and working, and to fix problems.

We only use invoice data to provide Margn to your business. We don't use one business's data to show anything to another business.

Information we hold for your business

The invoice data in your account belongs to your business. Under section 11 of the Privacy Act, personal information we hold only to provide Margn to you is treated as held by your business, so you remain responsible for it in the same way as if it were on your own computer. We look after it on your behalf, only use it to provide Margn to you, and delete it when you ask.

Who else sees it

We use a small number of service providers to run Margn. They only process data for us:

• Vercel (hosting and file storage)
• Neon (the database)
• Resend (sending email)
• Sentry (error reports, which can include the page you were on but not your invoices)
• Xero, if you choose to connect it

Some of these providers store data outside New Zealand, for example in the United States or Australia. We choose providers that protect information in a way comparable to the Privacy Act. We may also share information if the law requires it.

How long we keep it

We keep your data while your business uses Margn. An owner can delete the business at any time from Settings, which permanently deletes its invoices, files, flags and settings straight away. Backups that contain it are overwritten within about 30 days. Demo businesses made from "Try the demo café" are deleted after 24 hours.

Keeping it safe

Data is encrypted in transit, passwords are hashed, Xero tokens are encrypted, and every business's data is kept separate. Only people you invite can see your business. If a privacy breach is likely to cause serious harm, we will tell you and the Privacy Commissioner as soon as we can.

Your rights

• You can see and correct your account details in Margn, or ask us for a copy of what we hold about you.
• An owner can download all of the business's data from Settings at any time.
• You can ask us to correct or delete information. We'll respond within 20 working days.

Email [privacy contact email]. If you're not happy with our response, you can complain to the Office of the Privacy Commissioner.

Changes

If we change this policy in a way that matters, we'll tell account owners by email before it applies. See also our terms.