Privacy Policy

Last updated: 8 April 2026

MyBiz is operated by CloudPro Digital Limited, a New Zealand company. We are committed to protecting your personal information in accordance with the New Zealand Privacy Act 2020 and the thirteen Information Privacy Principles (IPPs). This policy explains what information we collect, why we collect it, how we use and protect it, and your rights.

1. Who we are

MyBiz is a cloud-based business platform for invoicing, expense tracking, and financial management. Our services are provided by CloudPro Digital Limited. For privacy enquiries, contact us at info@cloudpro-dgital.co.nz.

2. Information we collect

We collect personal information only when it is necessary for the services we provide (IPP 1). This includes:

Account information

• Name, email address, and password (for authentication)
• Business name, address, phone number, GST number, and bank account details

Financial data

• Invoice details (client names, amounts, dates, line items)
• Expense records (amounts, categories, receipt images)
• Bank statement data (when you import CSV files)

Payment information

• Subscription plan and billing interval
• Stripe customer ID and subscription ID (we never store credit card numbers — our payment provider handles all payment card data)

Technical data

• Browser type, device information, and IP address (collected automatically for security and service improvement)

3. How we collect information

We collect information directly from you when you create an account, set up your company profile, create invoices, log expenses, or contact us (IPP 2). We will always tell you when we are collecting personal information and why. We do not collect information from third parties without your knowledge.

4. Purpose of collection

We collect and use your personal information for the following purposes (IPP 3):

• Providing and operating the MyBiz platform
• Generating invoices, tracking expenses, and producing financial reports
• Processing receipt images using optical character recognition (OCR)
• Sending invoice emails on your behalf
• Managing your subscription and processing payments via our payment provider
• Communicating with you about your account, service updates, or support requests
• Complying with legal obligations (e.g., IRD record-keeping requirements)

We will not use your personal information for any purpose other than those stated above without your consent.

5. Storage and security

We take reasonable steps to protect your personal information from loss, unauthorised access, modification, or disclosure (IPP 5). Our security measures include:

• Strong authentication with enforced password policies
• All data encrypted in transit and at rest
• Data isolation — your data is only accessible to your account, never visible to other users
• File storage scoped to your account
• No credit card data stored — all payment processing handled by our payment provider (PCI DSS compliant)
• Regular security reviews and updates

6. Where your data is stored

Your data is stored on secure cloud infrastructure hosted in the Asia Pacific (Sydney) region. Payment data is processed by our payment provider in accordance with PCI DSS standards. Both our infrastructure and payment providers maintain appropriate safeguards for cross-border data transfers as required by IPP 12 of the Privacy Act 2020.

7. Sharing and disclosure

We do not sell, rent, or trade your personal information (IPP 11). We share data only with:

• Our cloud infrastructure provider — for data storage, authentication, and processing
• Our payment provider — for subscription and payment processing
• Your clients — when you send invoices via email or share a client portal link (at your direction)

We may disclose information if required by law, court order, or to comply with a request from the New Zealand Privacy Commissioner.

8. Your rights

Under the Privacy Act 2020, you have the right to:

• Access the personal information we hold about you (IPP 6)
• Request correction of any inaccurate information (IPP 7)
• Know how your information is being used
• Request deletion of your account and associated data
• Complain to the Office of the Privacy Commissioner if you believe your privacy has been breached

To exercise any of these rights, email us at info@cloudpro-dgital.co.nz. We will respond within 20 working days as required by the Privacy Act.

9. Data retention

We retain your data for as long as your account is active. Financial records (invoices, expenses) are retained for a minimum of 7 years to comply with IRD record-keeping requirements under the Tax Administration Act 1994. If you delete your account, we will remove your personal information within 30 days, except where retention is required by law.

10. Privacy breaches

In the event of a privacy breach that poses a risk of serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, as required by Part 6 of the Privacy Act 2020.

11. Cookies and analytics

MyBiz uses essential cookies for authentication and session management. We do not use third-party tracking cookies or advertising cookies. We may use anonymised, aggregated analytics to improve our service.

12. Children

MyBiz is a business tool and is not intended for use by individuals under 16 years of age. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated via email or an in-app notification. The "Last updated" date at the top of this page reflects the most recent revision.

14. Contact us

If you have questions about this privacy policy or how we handle your personal information, contact us at:

You may also contact the Office of the Privacy Commissioner at privacy.org.nz or call 0800 803 909.