Privacy Policy

MARGIN is provided by Margin Analytics Limited, a company incorporated in New Zealand. Margin Analytics Limited is the agency responsible for the personal information described in this policy under the New Zealand Privacy Act 2020. You can contact us at any time at support@marginnz.com.

When you create an account we collect your name, your email address and a securely hashed version of your password. We never see or store your password itself. We also keep records of your sign-ins, your acceptance of these legal documents (the version accepted and the date and time), and your membership of a business within MARGIN.

To produce your figures, MARGIN stores the information you enter about your business: business name, trade, country, region and city, employee numbers, revenue band, charge-out rates, target margins and markup, owner and director remuneration details, and your labour profile (hours, weeks, wage rates, KiwiSaver, ACC and other employment costs).

It also stores the operating information you enter or confirm: profit & loss figures and expense lines, quotes, jobs, charge-up jobs, labour hours, material, subcontractor and other cost entries, variations, variance notes and the client or site details you record against a job. Some of this information — such as your customers' names, addresses, email addresses and site addresses — is personal information about other people. You are responsible for the information you enter about third parties; we process it on your behalf to run your account.

You can upload profit & loss reports, estimates and supplier or subcontractor invoices (PDF, XLSX, XLS or CSV, up to 10 MB) so MARGIN can read the figures out of them instead of you typing them in.

The uploaded file itself is not retained by MARGIN. It is read once in memory, the text is extracted, and the file is discarded when the request finishes. It is not written to any file store, database, backup or log, we cannot re-open a file you uploaded earlier, and there is nothing for you to delete later.

What may be retained is only the extracted information you review and save — for example profit & loss totals and expense lines, estimate figures, or an invoice's date, number, supplier, description and amount. Nothing is saved to your account until you confirm it on screen.

To identify figures in an uploaded document, the extracted text (up to 24,000 characters) and the file name are sent to an artificial-intelligence service: Google Gemini, accessed through the Lovable AI Gateway. The same service is used to interpret published market-rate sources. The original file is never sent, and AI is never used to calculate your MARGIN figures — all calculations are performed by MARGIN itself.

AI extraction and analysis can be wrong or incomplete. Results are always shown to you to check and correct before anything is saved. MARGIN does not store the requests or responses sent to the AI service. The AI providers process this information under their own terms, and we cannot guarantee how they log or retain requests on their own systems.

Subscription payments are processed by Stripe. Card details are entered on Stripe's own payment pages, and MARGIN never receives or stores your full card number, expiry or security code. We store only what Stripe reports back — subscription status, mode, trial and renewal dates, cancellation state and Stripe's customer and subscription references — so your access can be determined correctly. Stripe processes your payment information as an independent processor under its own privacy terms.

When MARGIN looks up published market rates, it sends only a general search phrase built from your trade and your city, region or country — for example “electrician hourly rate Christchurch” — to the Tavily search service. Your profit & loss figures, quotes, jobs, customers, rates, margins and account details are never sent to a search service.

When you send a message through Help & Feedback, we store your name, email address, business name, subject, message and any job reference you include, so we can respond and track the issue. If you email support@marginnz.com directly, your message passes through our email provider. Support messages are retained as part of our support records.

Your business data is visible to you and to any other person who has been given access to your business in MARGIN. Access is enforced at the database level for every request, so one business cannot read another business's data.

In addition, authorised MARGIN administration staff can access account, business and billing information where necessary to operate the service — for example to resolve a support request, investigate a fault, manage billing or meet a legal obligation. Administrative access is authorised on the server against a restricted administrator list and is logged.

We also use service providers who process information on our behalf, listed below. We do not sell your information and we do not use it for advertising.

Because MARGIN is a cloud service, your information is stored and processed outside New Zealand. Our providers are:

Supabase (hosted on Amazon Web Services, Asia Pacific — Seoul, South Korea): the database and authentication service where your account, business, quote, job, cost, benchmark-consent and billing records are stored.
Lovable (application hosting and AI gateway): runs the application and routes AI extraction requests.
Google (Gemini AI, United States and other regions): AI-assisted document extraction and source interpretation.
Stripe (United States and other regions): payment processing and subscription management.
Tavily (United States): public web search for market-rate sources; receives search phrases only.
Cloudflare (global network): hosting delivery, security and server logs.
Our email provider: account emails such as confirmation, email change and password reset, and support correspondence.

We take reasonable steps to ensure these providers protect your information with safeguards comparable to those required under the New Zealand Privacy Act 2020. By using MARGIN you acknowledge that your information is stored and processed overseas as described here.

MARGIN does not use advertising, marketing or third-party analytics tracking. The only browser storage we use is functional: your signed-in session, an activity timestamp used for the inactivity sign-out, your “stay signed in” choice and interface preferences. Our hosting and database providers keep technical server logs, which may include IP addresses and error details, for security and fault diagnosis.

Settings includes a benchmarking consent switch, which is off unless you turn it on and can be turned off again at any time. Your consent choice is recorded against your business.

At present no customer information is contributed to, or used in, any shared industry benchmark, and market comparisons in MARGIN are produced only from published public sources found by search. If we later use consented information for anonymous, aggregated industry benchmarking, it would be limited to anonymised measures such as trade, broad location, labour rates and job performance metrics. Client names, addresses, supplier names, invoice numbers and free-text project notes would never be included, and we will update this policy before any such use begins.

Information is transmitted over encrypted connections and stored with database-level access rules that scope every request to your own business. Passwords are hashed by our authentication provider, leaked-password checking is enabled and email addresses must be confirmed. Administrative functions are authorised on the server, not in your browser.

You are signed out automatically after 60 minutes without activity, across every open tab. “Stay signed in on this device” keeps you signed in between visits on that device only — leave it unticked on a shared or public computer. The inactivity sign-out applies either way. No security measure is perfect, and you are responsible for keeping your login details confidential.

Your business information is kept while your account remains open, including after a subscription ends, so nothing is lost if you return. Uploaded files are never retained. If you delete a quote, job or cost entry, it and its related cost records are permanently removed and cannot be recovered by us.

You can ask us to close your account and delete your data by emailing support@marginnz.com or using Help & Feedback. We will action deletion requests within a reasonable time, normally 30 days. Some records must be kept after closure where we are legally required to do so — in particular billing and tax records, which are retained for the period required by New Zealand law, and support correspondence.

Under the Privacy Act 2020 you have the right to ask for access to the personal information we hold about you and to ask for it to be corrected. Most of your information can be viewed and updated directly in MARGIN. For anything else, email support@marginnz.com and we will respond as soon as we can, and within 20 working days of your request.

If you are not satisfied with how we have handled your information or your request, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

If a privacy breach occurs that we believe has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and the affected people as required by the Privacy Act 2020.

MARGIN is a business decision-support and pricing intelligence tool. It produces calculations, analysis and indicative guidance from the information you supply and from public information. It is not accounting, tax, legal, financial or quantity-surveying advice, and your pricing and business decisions remain yours.

We may update this policy as MARGIN develops. The effective date and version shown at the top of this page will change, and where a change is material we will tell account holders.

Privacy enquiries, access and correction requests and complaints can be emailed to support@marginnz.com, or sent through Help & Feedback inside the app. Margin Analytics Limited, New Zealand.