This Privacy Policy explains how myLFR Limited ("myLFR", "we", "us", "our") collects, uses, stores, and shares personal information when you use the myLFR website and application (the "Service").
This Service is intended for use in New Zealand by authorised staff of Licensed Fish Receivers (LFRs).
If you have questions or want to exercise your privacy rights, contact us at: admin@mylfr.co.nz
Scope
This policy applies to personal information we collect through the Service, including when you create an account, create or join an LFR workspace, and use the dashboard features.
What personal information we collect
We collect personal information you provide directly and information generated when you use the Service.
2.1 Account and authentication information
- Email address (used for your account login and account communications such as password resets)
- Account identifiers (such as your Supabase user ID)
- Passwords are processed by our authentication provider (Supabase). We do not store your password in plain text.
2.2 LFR workspace and business information you enter
Depending on how you use the Service, you may provide:
- LFR/workspace details (for example: LFR or business name, client number)
- Business address details (including street address components, suburb, city, postcode, and a formatted address)
2.3 Operational record-keeping information you enter
The Service is a record-keeping and return-preparation tool. Within your workspace, you may enter and manage:
- Permit holder ("fisher") details (for example: names and permit numbers)
- Vessel details (for example: vessel names and numbers)
- Landing and return-preparation records (for example: landing dates, invoice numbers, fishstock codes, greenweight totals, monthly summaries)
2.4 Team and access management information
If you manage access to a workspace, we collect:
- Team member details (workspace roles such as owner/editor/viewer, and member email addresses)
- Invite information (invited email, role, invite status, expiry information)
2.5 Version history and audit information
To support integrity of records, troubleshooting, and accountability, the Service maintains:
- Version history for certain records (for example, snapshots of landing records saved over time)
- Audit information about changes made in a workspace (which may include who made a change and when, and the "before/after" values of certain records)
2.6 Address search (Geoapify)
If you use address autocomplete, the text you type to search for an address is sent to our address lookup provider (Geoapify) to return suggestions. The selected address details you confirm are stored in your workspace profile.
How we use personal information
We use personal information to:
- Provide and operate the Service (including creating accounts, authenticating users, and enabling workspace features)
- Maintain and improve the Service (including troubleshooting and ensuring data integrity)
- Manage workspaces, invites, and role-based access controls
- Support record-keeping, summaries, and exports requested by you
- Communicate with you (for example, password reset emails, important service messages, and responding to support/privacy requests)
- Protect the Service from abuse and fraud (for example, bot detection during sign-up)
How we share personal information
We do not sell your personal information.
We share personal information with service providers that help us operate the Service, including:
- Supabase (authentication and database hosting)
- Netlify (website hosting and serverless functions used by the Service)
- Cloudflare Turnstile (bot protection used during sign-up)
- Geoapify (address autocomplete/search)
- Zoho and ZeptoMail (email services for support and transactional email)
These providers process information on our behalf to provide their services to us.
We may also share personal information where required by law, or where it is necessary to protect people's safety, prevent serious wrongdoing, or enforce our legal rights, in accordance with the Privacy Act 2020.
Data storage and location
Your Service data is stored in Supabase. We do not store user data on our own separate servers other than within the Service and providers listed above. Exports (such as excel spreadsheets and PDF files) are generated for you to download and are stored locally on your device once downloaded.
Data retention
Workspace owners can permanently delete a workspace from within the Service, which deletes all workspace data.
Your rights and choices
You can access and update much of your information through your account within the Service (for example, workspace details and operational records).
You may also contact us at admin@mylfr.co.nz to request:
- Access to personal information we hold about you and your workspace (note: the information we hold is generally available to you through your account)
- Correction of personal information
- Deactivation of your account or removal of your access to a workspace
- Deletion of personal information
Identity verification: to protect your information, we may require that requests come from the email address associated with your account and/or ask you to verify account details before we act on a request.
Security
We take reasonable steps to protect personal information, including:
- HTTPS encryption in transit
- Role-based access controls within workspaces (owner/editor/viewer)
- Row-level security controls in our database
- Password reset via email through our authentication provider
You are responsible for keeping your login credentials confidential and for using the Service in a secure manner.
Cookies and local storage
The Service uses essential storage (such as browser local storage) to support core functionality (for example, keeping you signed in and improving performance through caching). We do not use advertising cookies.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will update the "Effective date" at the top and, where appropriate, provide additional notice within the Service.
Contact us
If you have questions, concerns, or requests about privacy, contact:
myLFR Limited
Email: admin@mylfr.co.nz