Privacy policy
myMSP Limited (company number 9463862, NZBN 9429054006881) ("myMSP", "we", "us") runs the website mymsp.io and the myMSP platform, a control centre for managed service providers (MSPs). This policy explains what personal information we collect, why, who we share it with, and the choices you have.
We are a New Zealand company and we follow the Privacy Act 2020 (New Zealand). Where we deal with people in Australia, we also follow the Australian Privacy Principles in the Privacy Act 1988 (Cth) to the extent they apply to us.
1. Who this policy covers
| You are | What this policy covers |
|---|---|
| A visitor to mymsp.io | What you send us through the website and how we measure visits |
| Someone who asks for a Billing Leak Audit or applies for early access | Your enquiry, your application and the audit itself |
| A user at an MSP that subscribes to myMSP | Your account, sign-in and how you use the platform |
| A customer or employee of an MSP that uses myMSP | Information the MSP puts into the platform about you. See section 6. |
2. What we collect
From the website forms. Your name, work email, your MSP's name, the PSA you use, roughly how many customers you manage, when your PSA or RMM contract renews, whether you want launch emails, and anything you type in a message.
From applications and subscriptions. Company details, your workspace name, billing contact, country, and the plan you choose. Card payments are taken by Stripe. We never see or store your full card number.
From platform users. Your name, email, role and the sign-in details your identity provider sends us (for example Microsoft Entra ID), a record of what you do in the platform (an audit log), and support conversations.
Automatically. The page you landed on, the referring site, campaign tags in the link (for example utm_source=instagram), your browser type, an approximate country, and server logs including IP addresses. The website does not set advertising or tracking cookies. It keeps campaign tags in your browser's session storage for the current visit only. The platform uses essential cookies to keep you signed in.
From the tools you connect. When an MSP connects its PSA, RMM, Microsoft 365, security, backup or accounting tools, the platform reads data from them, which can include names, email addresses, phone numbers, job titles, device names, sign-in names and ticket content about the MSP's own customers and staff. See section 6.
You don't have to give us any of this, but we can't reply to an enquiry without an email address, and we can't provide the platform without account and billing details.
3. How we use it
- To reply to you, run your Billing Leak Audit, review your application and set up your subscription.
- To provide, secure, support and improve the platform.
- To bill you and keep financial records.
- To send launch news and tips, only if you opted in. Every email has an unsubscribe link.
- To understand which channels bring people to the website.
- To meet our legal obligations and to protect our rights.
We do not sell personal information, and we do not use it for third-party advertising.
4. AI features
Some platform features use AI models to draft text, summarise information and research errors. When they run, the relevant data is sent to our AI providers (Anthropic, and OpenAI or Microsoft Azure OpenAI) only to perform that task. Under their commercial terms these providers do not use API data to train their models. AI output is a suggestion: changes to billing, contracts or customer-facing messages wait for a person to approve them.
5. Who we share it with
We share personal information only with service providers who help us run myMSP, under contracts that limit what they can do with it:
| Provider | What they do for us | Where |
|---|---|---|
| Microsoft Azure | Hosts the website and its form storage, key storage and some platform services | Australia and other Azure regions |
| Cloudflare | Delivers the website and domain, protects against attacks | Global network |
| Stripe | Payments, subscriptions and invoices | United States and other locations |
| Resend | Sends transactional email such as sign-in links and payment links | United States |
| Anthropic | AI model provider | United States |
| OpenAI / Microsoft Azure OpenAI | AI model provider | United States, Australia |
| Google Fonts | Serves the website's fonts (sees your IP address) | United States |
We may also share information with our professional advisers, if the law requires it, or with a buyer of our business (who would have to keep this policy's promises).
6. Information MSPs put into the platform
When an MSP uses myMSP, the information it connects or enters about its own customers and staff belongs to the MSP. We hold and process it as the MSP's agent, only to provide the service to that MSP, under our Terms of Service. Under section 11 of the Privacy Act 2020 that information is treated as held by the MSP, and the MSP is responsible for telling the people concerned (including under information privacy principle 3A) and for answering their requests.
If you are a customer of an MSP and want to see or correct information about you, please contact the MSP directly. If you contact us, we will pass your request to them.
7. Where it is stored and sent overseas
Platform data is stored in New Zealand. Website form entries are stored in Microsoft Azure. Some of the providers in section 5 are overseas, mainly in Australia and the United States.
When an overseas provider stores or processes information for us as our agent, we remain responsible for it under New Zealand law. Where we disclose personal information to an overseas organisation in its own right, we do so only where information privacy principle 12 allows it: for example, where the recipient is subject to comparable privacy safeguards or has agreed to protect it.
8. How we protect it
- Encryption in transit (TLS) between your browser, our services and the tools you connect.
- Each MSP's data is kept separate from every other MSP's data.
- Integration credentials are encrypted (AES-256), and every time one is read it is logged.
- Staff access is limited to what their role needs, with multi-factor sign-in and an audit log.
- Changes our software proposes to an MSP's systems wait for a person to approve them.
No system is perfectly secure. If a privacy breach is likely to cause anyone serious harm, we will notify the Office of the Privacy Commissioner and the affected people as soon as practicable, as the Privacy Act 2020 requires, and we will tell affected MSPs without undue delay.
9. How long we keep it
| Information | Kept for |
|---|---|
| Website enquiries and applications that don't become customers | Up to 2 years after our last contact, then deleted |
| Billing Leak Audit data, if you don't go ahead | Deleted within 30 days of the audit |
| Platform data, after a subscription ends | Available for export for 90 days, then deleted from live systems within 60 days and from backups within a further 180 days |
| Billing and tax records | 7 years, as New Zealand tax law requires |
10. Your rights
You can ask to see the personal information we hold about you and ask us to correct it. You can also ask us to delete it or stop sending marketing emails. We will respond within 20 working days. We may need to confirm your identity first, and in limited cases the law allows us to refuse a request; if so, we'll tell you why.
If you're not happy with how we've handled your information, please tell us first. You can also complain to the Office of the Privacy Commissioner in New Zealand (privacy.org.nz) or, if you're in Australia, the Office of the Australian Information Commissioner (oaic.gov.au).
11. Changes to this policy
We'll update this policy when our practices change. The date at the top shows when it last changed. If a change significantly affects how we use information we already hold, we'll tell affected customers by email before it takes effect.
12. Contact us
Privacy officer: Jonathan Prentice Email: [email protected] myMSP Limited, Auckland, New Zealand