Privacy Policy
Version 1.2
mySOPPLAN Privacy Statement
Version: 1.2
Effective from: 16 September 2026
Covers: the mySOPPLAN application and the mysopplan.com website
The short version
We collect the personal information we need to run mySOPPLAN and nothing more. Your organisation's planning data stays in your own private area of the system — we hold it for you, we do not sell it, and we do not use it to train AI models. It is stored in Sydney, Australia. You can ask us at any time what we hold about you and ask us to correct it.
The rest of this statement is the detail.
1. Who we are
mySOPPLAN is supplied by Norman John Chase, trading as Sopplan, based in New Zealand.
Privacy contact: [email protected]
Postal address:
77 Pemberton Ave
Bayview
Auckland 0629
New Zealand
We are an "agency" under the Privacy Act 2020 (New Zealand) and we follow the information privacy principles in that Act, including the principle on indirect collection (IPP 3A) that took effect on 1 May 2026.
2. Two different kinds of information
This is the part people usually find confusing, so we will be clear about it.
Information about you, as a user of mySOPPLAN. Your name, your email address, your sign-in history, what you did in the system. We are responsible for this information and this statement explains what we do with it.
Your organisation's planning data. The materials, forecasts, plans, customers, suppliers and sales history your organisation loads into its tenant. Some of that may be personal information about real people — a customer contact's name, a salesperson's name against a forecast.
For that second kind, your organisation is the agency responsible under the Privacy Act, and we hold it on your organisation's behalf. Under section 11 of the Privacy Act 2020, information we hold as your agent is treated as being held by your organisation, not by us. We only use it to run the service for your organisation. If you want to know what your employer holds about you in mySOPPLAN, or want it corrected, ask them — they control it.
3. What we collect, and why
| What | Why we need it | Where it comes from |
|---|---|---|
| Name, email address, username | To create your account and identify you | You, or your Tenant Administrator |
| Password (hashed, never readable) | To sign you in securely | You |
| Timezone and display preferences | To show dates and numbers the way you expect | You |
| Roles and permissions | To control what you can see and do | Your Tenant Administrator |
| Sign-in records, including failed attempts, date, time and IP address | Security — detecting and stopping unauthorised access | Automatically |
| Audit trail of what you created, changed or deleted | So your organisation can see who changed what. This is a core feature of a planning system | Automatically |
| Terms of Use acceptance record — version, name, email, timestamp, IP address and browser identification | To prove who agreed to what, and when | The onboarding form |
| Support emails and their contents | To answer your question | You |
| Billing contact and subscription details | To invoice your organisation | Your Tenant Administrator |
| Application logs — pages requested, errors, performance | To keep the service working and diagnose faults | Automatically |
| Cookies — a session cookie and a security token | To keep you signed in and protect forms. We do not use advertising cookies | Your browser |
We do not collect payment card details. Payments are handled by a third-party payment provider. Card numbers never reach our systems.
4. Where your information is stored
mySOPPLAN runs on DigitalOcean infrastructure in the Sydney, Australia region — the application server, the PostgreSQL database and its backups. Traffic passes through Cloudflare, which provides our DNS, TLS certificates and protection against attacks.
Storing information with an overseas service provider that holds it for us is not, under the Privacy Act 2020, a disclosure to that provider — we remain responsible for it, and they are not allowed to use it for their own purposes. We choose providers who protect information to a standard comparable to New Zealand's.
If you need your data held in New Zealand or in a specific country for your own compliance reasons, talk to us before you subscribe.
5. Who else touches it
We keep this list short deliberately, and we keep it current.
| Provider | What they do | Where |
|---|---|---|
| DigitalOcean | Hosts the application, database and backups | Sydney, Australia |
| Cloudflare | DNS, TLS, protection against attacks | Global network |
| Mailgun | Sends system emails — password resets, notifications, invitations | United States |
| Sentry | Records application errors so we can fix them. Configured not to send us your identity, IP address or cookies | United States |
| Stripe | Will process subscription payments when paid subscriptions begin | United States |
| DigitalOcean AI | Will support AI-assisted features when those are released, and only if your organisation enables them. See section 6 | United States |
Two smaller flows you should know about:
- Error reports to us. If the application hits an unexpected error, it emails a technical report to our own administrators. That report can contain fragments of the request that caused it.
- Webhooks you set up. If your organisation configures a webhook, mySOPPLAN sends business events to the address you nominate. We do not control that destination — you do.
Apart from these, we share your information only when:
- you ask us to, or your Tenant Administrator does;
- the law requires it — a court order, a statutory demand. If that happens we will tell you unless we are not permitted to; or
- we sell or transfer the business. As explained in our Terms of Use, we intend to move this business into a New Zealand company. Your information moves with it, protected by this same statement.
We never sell your information, and we never share it for anyone else's advertising.
6. AI-assisted features
These features are not yet available. This section describes how they will work when they are released, so you know what to expect before you decide to turn them on.
- They will be off unless your Tenant Administrator turns them on, and that administrator will be able to turn them off again for the whole organisation at any time.
- When they run, the relevant planning data is sent to our AI provider to produce a suggestion, and the answer comes back. Your data will never be used to train or fine-tune any model.
- We will strip out personal details where we can — using product codes rather than customer names, for example.
- Every suggestion and every decision a person makes about it will be recorded in the audit trail.
- Suggestions will always need a person to approve them. The system will never act on its own.
We will update this statement, and tell you, before these features are switched on.
7. How long we keep it
| Information | How long |
|---|---|
| Your organisation's tenant data | For as long as the subscription is active |
| Tenant data after cancellation | 90 days (the retention period), then permanently destroyed — the database schema, uploaded files, exports and audit logs. We record that the destruction happened |
| Security logs — sign-ins and failed sign-in attempts | 2 years, then deleted |
| Billing records | 7 years, as New Zealand tax law requires |
| Support emails | 2 years |
If you leave an organisation that uses mySOPPLAN, your account is deactivated but your name stays attached to the records you created — an audit trail with names removed is not an audit trail. That is part of your former employer's data, and they control it.
8. How we protect it
- All traffic between your browser and mySOPPLAN is encrypted using TLS.
- Our database is DigitalOcean's managed PostgreSQL service, which encrypts data at rest and requires TLS for connections to it. Its daily backups are held by the same service.
- Files uploaded to the service, and our application logs, are held on the application server, reachable only over an administrative network that is not exposed to the internet.
- Passwords are hashed using PBKDF2-SHA256 with a per-password salt. Nobody, including us, can read them.
- Each organisation's data lives in its own separate database schema. Every request is checked against the signed-in user's organisation, and session cookies are scoped so that one organisation's session can never be sent to another's address. Preventing one customer from seeing another's data is the single most important rule in the system.
- Accounts lock after repeated failed sign-in attempts.
- Access is controlled by role — people see what their job needs and not more.
- We keep our software patched, and we apply critical security patches quickly.
No system is perfectly secure, and we will not pretend otherwise. What we can promise is that we take it seriously and that we will tell you promptly if something goes wrong.
9. If there is a privacy breach
If personal information is accessed, disclosed or lost in a way that is likely to cause serious harm, we will:
- contain it and work out what happened;
- notify the Office of the Privacy Commissioner as the Privacy Act 2020 requires;
- tell the affected organisations and, where required, the affected people, as soon as practicable; and
- tell you what we are doing about it, and what you should do.
10. Your rights
Under the Privacy Act 2020 you can:
- ask what we hold about you and get a copy (IPP 6);
- ask us to correct it if it is wrong, or attach a statement of correction if we disagree (IPP 7);
- withdraw consent for anything you have given consent to; and
- complain if you think we have got it wrong.
Email [email protected] and we will respond as soon as we can, and within 20 working days at the latest. We do not charge for this. We may need to confirm who you are first.
If the information you are asking about is your employer's tenant data rather than your account, we will tell you and point you to them — we are not allowed to hand over their data.
11. When information comes from someone else
Sometimes the information we hold about a person did not come from that person. Two cases:
Your account. If your Tenant Administrator created your account, your name and email came from them, not from you. This statement is how we tell you what we hold and why — as IPP 3A requires.
Your organisation's planning data. When your organisation uploads information about its customers, suppliers or staff, that information is about people who never dealt with us. Your organisation is responsible for telling those people what it collects and why, including that it uses a system like ours to hold it. We rely on you to have done that. If you would like wording to put in your own privacy statement, ask us and we will help.
12. Website visitors
If you just visit mysopplan.com without signing in, we collect standard web server logs — IP address, browser, pages visited, time — to keep the site working and secure. We do not use analytics, advertising or tracking cookies of any kind, and there is no third-party tracking script anywhere on the site.
13. Customers outside New Zealand
If your organisation is in the European Union or the United Kingdom, the GDPR may apply to you as the controller of your data, with us as your processor. We can enter into a data processing agreement — ask us.
If your organisation is in Australia, note that your data is stored in Australia and this statement gives you the same protections.
14. Changes to this statement
We may update this statement. Every version is numbered and dated. If we make a change that materially affects how we handle your information, we will email Tenant Administrators and show a notice in the system at least 30 days before it takes effect.
15. Complaints
Please talk to us first — [email protected]. Most things are easier to fix directly, and we would rather know.
If you are not satisfied with how we have handled it, you can complain to:
Office of the Privacy Commissioner
Freephone 0800 803 909
privacy.org.nz/your-rights/making-a-complaint
Document control
| Document | mySOPPLAN Privacy Statement |
| Version | 1.2 |
| Effective | 16 September 2026 |
| Agency | Norman John Chase, trading as Sopplan |
| Governing law | Privacy Act 2020 (New Zealand) |