MC Plus Privacy Policy

Last updated: 29 October 2026. This explains how First Light Movers Limited (trading as MC Web Studio) handles personal information in MC Plus, under the New Zealand Privacy Act 2020.

Two kinds of information

• Your account and billing information (name, email, business name, plan, payment status). We are responsible for this.
• Your business's records (customers, quotes, jobs, invoices, photos, staff hours, pay rates, leave). Your business is responsible for deciding what goes in and for telling its own customers and staff what it collects; we store and process it on your behalf and only to provide MC Plus.

What we collect, and why

• Account: name, email, password (stored hashed by Firebase Authentication), the businesses you belong to and your role. We collect it to create your account, sign you in and contact you about the service.
• Usage and device: sign-in times, error logs, and a push-notification token if you turn alerts on. We collect it to keep the service secure, fix problems and send alerts you asked for.
• Business records you or your team enter, including customer names, phones, emails, addresses, photos, signatures, clock-in and clock-out times, where the phone was at the moment someone clocked in or out (only if they allow location on their phone; it is not tracked at any other time), pay rates and leave balances. We store them so MC Plus works for your business.
• Website enquiries sent to your business from your own website form, including where the visitor came from (for example a Google Ads click).
• Payments: handled by Stripe, Apple or Google. We do not see or store full card numbers.
• Imported history: if the business owner imports old jobs, quotes, invoices, costs, timesheets or payments from another system, we store them as a read-only archive for that business only. They are not used for billing, are not sent to Xero, and are not read by the AI helper. The owner can export them and they are deleted with the business.
• AI helper: when someone in a business uses the Ask MC+ box, the words they type or say (voice is turned into text by their own browser or phone), and any photo or PDF they attach such as a receipt or supplier invoice, are sent to Anthropic, which runs the Claude AI models, so the request can be understood. For some requests we also send a short list of the business's own price-library item names, job numbers and customer or staff names needed to match what was said, or plain figures such as totals owed. We do not send whole customer records, passwords or card details. An attached file is used to read it once; MC Plus does not keep it unless the person chooses to keep a receipt photo with an expense. Anthropic processes this in the United States. The AI only suggests; nothing is saved, sent or charged until a person approves it, and the AI cannot send messages, issue invoices or take payments. What people type is not used by us to train AI.

We use personal information only to run MC Plus, bill for it, keep it secure, send service messages, give support, meet legal duties and improve the product. We do not sell personal information, we do not show advertising in MC Plus, and we do not use your customers' details for our own marketing. MC Plus does not use advertising cookies or tracking. It stores sign-in and display settings in your browser or phone so the app works.

Who it is shared with

Only service providers that help us run MC Plus: Google (Firebase and Google Cloud, hosting in Sydney, Australia), Stripe (payments), Apple and Google (store billing), RevenueCat (subscription status), ClickSend (texts, if used), an email delivery provider, Anthropic (the AI helper, as described above), and Xero, Google Ads or Meta Ads (only if you connect them: Xero receives the invoices you send and we read back your Xero figures; Google and Meta are read-only for advertising results). Some of these are outside New Zealand, in Australia and the United States. Before information goes overseas we take reasonable steps to make sure the provider protects it in a way comparable to the Privacy Act, usually through their contract terms. We may also disclose information where the law requires it.

Advertising accounts you connect (Google Ads, Meta Ads)

Only a business owner can connect these, and only for their own business. MC Plus asks for read-only access: it reads spend, clicks, conversions and campaign results so the business can see them next to its leads and jobs. It cannot create, change or pause ads, budgets or billing.

We keep the sign-in token from Google or Meta (encrypted), the names and numbers of the ad accounts you can choose from, and the latest results for up to six hours, so we do not ask Google or Meta again on every visit. The results are shown only inside that business. We do not sell this information, use it for our own advertising or marketing, or share it with anyone else.

Disconnecting (Connections, then Disconnect), or deleting the business, tells Google or Meta to cancel MC Plus’s access and deletes the stored token and results straight away. You can also remove MC Plus in your Google Account (Third-party apps and services) or your Facebook settings (Business Integrations); when Meta tells us you did, we delete the link automatically.

MC Plus’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who inside a business can see what

Owners and managers see business records. Workers see only the jobs they are on and their own hours, leave and safety checks. Pay rates are visible to the owner only. People who administer MC Plus can open a business's data only when the owner gives temporary support access, and that is logged.

Indirect collection

When your business adds details about its own customers or staff, your business is collecting that information and is responsible for telling those people, as the Privacy Act requires. We hold it for you and do not use it for our own purposes.

How long we keep it

While your business is active. If it stops being paid for we keep it about 150 days, send a final notice, and delete it 30 days later. You can export or delete your business at any time in Settings, and delete your own login in Account. Backups expire after a short period. We keep a small record of billing and account events as long as the law requires for tax and accounting.

Security and breaches

Data is encrypted in transit and at rest by our hosting provider, access is controlled by rules that check your login and role on every request, and we log administrative access. No system is perfectly secure. If a privacy breach is likely to cause serious harm we will tell the affected business owner and, where the law requires, the Office of the Privacy Commissioner, as soon as we reasonably can.

Your rights

You can ask to see or correct the personal information we hold about you, and we will respond within 20 working days. If you are a customer or worker of a business using MC Plus, please ask that business first, because it holds your records. Contact our privacy officer, Ryan McKie, at info@mcwebstudio.co.nz. If you are not happy with our response you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

Children

MC Plus is for businesses and is not aimed at children.

Changes

We will update this page when our practices change and tell you about material changes.

Contact

First Light Movers Limited, Hamilton, New Zealand (we operate online only). Email info@mcwebstudio.co.nz.