Privacy Policy

In short

The long version is below and it is the one that binds us. This is what it says:

• We collect what the product needs to work — your business details, your customers, your jobs and invoices — and nothing for advertising.
• We run no advertising software anywhere, and no analytics on this website. The app measures how it is used through one provider, PostHog, so we can see what is broken and what is worth building. No ad network has ever been given your data, and we do not sell it.
• Speaking a job sends what you said to four named companies — clause 7 lists them. The app asks your permission before the first recording leaves your phone, and you can withdraw it in Settings › Voice & AI at any time.
• Voice recordings are transcribed and then discarded. We keep the text, not the audio.
• We never see your card number. Stripe handles payment; we hold only the identifiers that let us recognise your subscription.
• We never sell personal information, and we never market to your customers.
• You can ask for a copy of your data, or ask us to delete it, by emailing support@mrmore.ai.

1. Who we are

Mr More is operated by Zuki Tech Pty Ltd (ABN 73 670 099 340), an Australian company. We are bound by the Australian Privacy Principles in the Privacy Act 1988 (Cth), and this policy is our APP 1.4 policy.

It covers the Mr More mobile app, the website at www.mrmore.ai, and the invoice, receipt and review pages we host on merchants’ behalf. It sits alongside our Terms of Service.

Throughout, “you” means the tradesperson or business using Mr More, and “your customer” means the person you send an invoice to. The distinction matters — clause 6 is about them.

2. What we collect

Your account

• Email address. This is how you sign in — we send a six-digit code to it. It is the only credential the account has.
• Your name, if you give it.

Your business

• Trading and legal name, trade, ABN, whether you are registered for GST, phone, email, timezone, currency, payment terms, and the language you speak.
• Your logo, if you upload one, and the Google review URL you want customers sent to.

Your work

• Your customers — name, phone, email, address and any notes you write about them. See clause 6.
• Jobs, invoices, receipts and payments — line items, amounts, tax, dates, status, and the transcript of anything you spoke.
• A timeline of events — that an invoice was sent, that a link was opened, that a job was marked paid. This is what drives the review request and the repeat-work reminder, and it is append-only.

Billing

• Your plan, its status, when the current period ends, and the identifiers Stripe gives us for your customer and subscription records.

Technical

• Ordinary server logs from our infrastructure provider, which include IP addresses and request details, kept for security and troubleshooting.
• Sign-in tokens held on your own device, so you are not asked to sign in every time you open the app.

How you use the app

• Which screens you open and which actions you take — that an invoice was created, that a recording failed, that an upgrade screen was closed. Events, with the app version, your device model and operating system, and an identifier for your account so a sequence can be followed through rather than read as unrelated taps.
• This is the app only. The website measures nothing — no analytics runs on the pages you are reading, or on the invoice, receipt and review pages your customers open.
• What is never sent: the content of your work. No customer names or contact details, no invoice line items or amounts, no voice transcripts, no note text, and no keystrokes or screen recordings. The measurement is that a thing happened, not what was in it.

3. What we do not collect

Stated as plainly as we can, because these are the usual suspects:

• No cross-site tracking, and no session recording. There is no Google Analytics, no Meta pixel, no advertising SDK and no session or screen recorder, in the app or on this website. The one measurement tool we do run is PostHog, in the app only, and clause 2 says exactly what it is given.
• No advertising. We run no ads and we have never given your data, or your customers’, to an ad network. We do not sell personal information.
• No third-party cookies. This website sets no analytics or advertising cookies at all — the analytics in the paragraph above is in the app, which uses no cookies. The app keeps sign-in tokens in your device’s secure storage, and our back-office panel — which only our own staff can reach — uses a session cookie.
• No card numbers. They go to Stripe from the payment form; they never reach our servers.
• No location tracking. The app does not ask for or collect your location.
• No contacts import. Your customer list is what you typed or spoke. We do not read your phone’s address book.
• No stored audio. See the next clause.

4. Voice recordings

Speaking a job is the fastest way to use Mr More, so it is worth being exact about what happens to your voice.

The app records while you talk and uploads the audio in short pieces. Each piece is sent to a speech-to-text service, converted to text, and the audio is discarded. We store the transcript. We do not keep a recording of your voice, and there is no archive of them to hand over or leak.

The transcript is then sent to a large language model, which turns it into a draft invoice or job note for you to check. That draft is never acted on by itself — nothing is sent, created or charged until you have read it and tapped.

We ask first, and you can take it back

Before your first recording ever leaves the phone, the app shows you the companies below by name and asks you to agree. Nothing is uploaded until you do, and the box is never pre-ticked. If you decline, voice is off and the rest of the app works normally — every part of Mr More can be typed.

You can withdraw that permission at any time in Settings › Voice & AI, which also shows the same list and when you agreed to it. Withdrawing stops any further recording immediately. It does not delete the drafts and notes already made from earlier recordings — those are your work records, and you delete them the same way you delete anything else.

If we ever add a company to that list, the old permission stops counting and the app asks you again. We do not quietly extend an agreement you gave about one set of recipients to a different one.

None of them is permitted to use what we send to train their models, and our agreements say so. Separately from all of this, iOS and Android ask for microphone access in their own dialog, which you can revoke in your phone’s settings — that is your device’s permission, and it is not the same thing as the agreement above.

5. Why we hold it

Each thing we collect maps to something the product does. We do not collect information on the basis that it may be useful later.

The last row is the only thing here we collect for our own benefit rather than to deliver something you asked for, so it is worth being straight about it. We rely on our legitimate interest in keeping the app working and improving it, we hold it to the shape described in clause 2 — that a thing happened, never what was in it — and we read it in aggregate. If you would rather not be counted, email us and we will exclude your account.

6. Your customers’ information

When you add a customer, you are the one collecting their information. We hold it on your behalf and act on your instructions.

That means you are responsible for having a proper basis to hold their details and, if the Privacy Act applies to your business, for telling them what you do with them. It is your relationship with them, not ours.

What we commit to on our side:

• We never contact your customers on our own initiative. Every message they receive from Mr More is one you sent.
• We never market to them, and we never add them to a list of ours.
• We never use one business’s customers for anything to do with another. Every query we run is filtered to a single business.
• The public invoice, receipt and review pages show only that document and your business details — nothing about your other customers or your account.

If one of your customers asks us directly for their information, we will normally refer them to you, because you hold the relationship and we cannot verify their identity. If you ask us to delete a customer’s details, we will.

7. Who else sees it

We use a small number of service providers to run Mr More. Each receives only what it needs, and each is bound to use it only to provide its service to us.

OpenAI and Anthropic are the voice chain, and they are the same list the app shows you before your first recording — one source, so what you agreed to and what is published here cannot come apart. They only ever receive anything if you gave that permission, and clause 4 covers how to take it back.

The arrangement is also built so that no voice credential ever ships inside the app — the audio and the transcript go from our servers, not from your phone, which is what stops a third party being handed a direct line to your device.

Otherwise, we disclose personal information only where:

• you ask us to, or it is obvious from what you are doing;
• the law requires it, or it is needed to prevent a serious threat to someone’s life, health or safety;
• it is necessary to investigate suspected unlawful activity or a serious breach of our terms;
• our business is sold or transferred — in which case the buyer is bound by this policy, and we will tell you before anything moves.

8. Overseas storage

Your core records — your business, your customers, your invoices — are held in Australia.

Some of the providers in the table above are, or operate from, overseas: principally the United States, and in Cloudflare’s case a global network that may route or cache requests through other countries. That means information covered by this policy may be disclosed to overseas recipients, which is a disclosure we are required to make under Australian Privacy Principle 8.

Before using a provider we take reasonable steps to satisfy ourselves it handles information consistently with the Australian Privacy Principles, and our agreements with them require it. Two details are worth stating rather than leaving to the table.

What you speak is processed in the United States — the audio as well as the transcript, by the companies named in clause 7. An earlier version of this policy said the audio was transcribed in Australia and never crossed a border; that changed when the speech-to-text provider changed, and this clause changed with it. The audio is still discarded once it has been turned into text, and there is still no archive of your voice. This is the disclosure the permission in clause 4 is asked against, so if you decline it, none of this leaves the country because none of it leaves your phone.

App usage events go to PostHog in the United States. They carry no customer information, no invoice figures and no transcripts — clause 2 sets out what they do carry.

9. How it is protected

We take reasonable steps to protect information from misuse, interference, loss and unauthorised access. Specifically:

• Everything travels over encrypted connections, and the database is encrypted at rest.
• Sign-in codes are hashed, expire quickly, and are deleted automatically after they expire. A code cannot be read back out of our database, by us or by anyone who reached it.
• Every query is scoped to one business. Which business you are is taken from your verified sign-in token, never from anything the app sends us — so a modified client cannot ask for someone else’s data.
• Public document links use long, cryptographically random addresses with no sequential numbers, so they cannot be guessed or walked.
• Your logo uploads straight from your device to storage using a short-lived, single-purpose permission that is tied to your business and to the file type — it cannot be reused to overwrite anyone else’s.
• Our staff back-office is a separate system with separate credentials and its own sign-in, and it is not reachable from the public site.

No system is perfectly secure. If a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

Your part: your email inbox is your account. There is no password to steal, which is the point, but it also means anyone who can read your email can sign in as you.

10. How long we keep it

• Voice audio — discarded as soon as it is transcribed, within seconds.
• Sign-in codes — minutes. They expire and are then deleted automatically.
• Your account and business records — while your account is open, and then as described below.
• Invoices, receipts and payment records — kept for as long as Australian tax and record-keeping law requires, which is generally five years from the transaction, even after an account closes. This is a legal obligation on both of us and we cannot delete them earlier on request.
• Server logs — a short operational window, generally no more than 90 days.
• App usage events — 12 months, after which they are deleted or kept only as counts that identify nobody.
• Backups — deleted data disappears from backups as those backups age out on their normal cycle, generally within 90 days.

When you close your account we delete or de-identify your personal information, except what we must keep under the paragraph above. Public invoice and receipt links stop working at that point — download anything you or your customers still need first.

11. Access, correction and deletion

Under the Australian Privacy Principles you can ask for access to the personal information we hold about you, and ask us to correct it if it is wrong.

Most of it you can already reach and edit yourself, in the app: your business details, your customers, your jobs and invoices, and your invoice PDFs.

You can delete your account from inside the app, and you do not need to ask us. It is under Settings › Account, at the bottom, behind typing your own email address to confirm. It closes the account and deletes your business, your customers and your jobs — everything except the invoice and payment records Australian tax law requires us to keep, and clause 10 says how long that is. It cannot be undone, and the public invoice and receipt links stop working immediately.

For anything else — a full copy of your data, a correction you cannot make yourself, or help with a deletion that failed — email support@mrmore.ai. We will:

• acknowledge within 5 business days;
• respond substantively within 30 days, which is the timeframe the Privacy Act sets;
• not charge you for making the request.

We may need to verify your identity first, and we will normally do that by writing to the email address on the account. If we refuse a request — which is rare, and generally only where the law requires us to keep something or where releasing it would reveal someone else’s information — we will tell you why in writing and how to complain.

12. If you are outside Australia

Mr More is built for Australian businesses and this policy is written to Australian law. If you are in the European Economic Area or the United Kingdom and the GDPR applies to you, we act as controller of your account information and as processor of the customer details you enter, and you additionally have the rights of access, rectification, erasure, restriction, portability and objection.

Where we rely on a lawful basis, it is performance of our contract with you for running the service, our legitimate interests in keeping it secure and improving it, and legal obligation for tax records. Write to support@mrmore.ai to exercise any of these — we use the same process as clause 11.

13. Children

Mr More is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, write to us and we will delete it.

14. Changes

We may update this policy. The date at the top always shows the current version.

If a change materially affects how we handle your information — a new category collected, a new provider that sees it, a new purpose — we will notify you by email or in the app before it takes effect, rather than quietly editing this page.

15. Complaints

If you think we have mishandled your personal information, tell us first. Email support@mrmore.ai with “Privacy complaint” in the subject and what happened. We will acknowledge within 5 business days and respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

Website: www.oaic.gov.au
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001

Our details, for any of the above:
Zuki Tech Pty Ltd
ABN 73 670 099 340
support@mrmore.ai