Privacy policy
Effective: 23 August 2026 · Last updated: 22 August 2026 · Version 1.1
1. Who we are
PMAXIS is project management software operated by Jean Fourie, a sole trader based in New Zealand ("PMAXIS", "we", "us"). We are the data controller for the personal information described in this policy.
Contact us about privacy: https://pmaxis.co/pages/contact
This policy covers:
- the storefront at
pmaxis.co - the application at
app.pmaxis.co - copies of PMAXIS modules you run on your own device or your own server
2. The short version
We collect very little, and most of what PMAXIS handles never reaches us at all.
- Your project data never leaves your device. Work breakdown structures, schedules, costs, risks, registers, and every document you generate are stored locally in your browser. We cannot see them, and we do not receive, transmit, or back them up.
- We collect your name and email once, when you activate a licence. This is stored against your licence key so we can validate it and so documents you export can be attributed to you.
- We do not sell, rent, or share your personal information with anyone for advertising, profiling, or any other commercial purpose.
- We do not use tracking cookies, analytics, or advertising technology in the application.
- The application contacts no third party. No fonts, scripts, or resources are loaded from anyone else's servers — so simply using PMAXIS reveals nothing about you to any outside company.
3. What we collect, and why
3.1 When you buy
Purchases are processed by Shopify, which collects your name, email address, billing address, and payment details. Card details go directly to the payment processor — we never see or store them. We receive your name, email, and order reference so we can issue your licence key.
Lawful basis (EU/UK): performance of a contract.
3.2 When you activate a licence
To unlock PMAXIS on a device you enter:
| Field | Required | Why |
|---|---|---|
| First name | Yes | Licence identity and document attribution |
| Surname | Yes | Licence identity and document attribution |
| Email address | Yes | Licence identity, support, and account recovery |
| Company / organisation | No | Optional, used only for document attribution if you choose it |
These are sent to our licensing service and stored against your licence key in Cloudflare Workers KV. Every later device must enter details matching that record.
Lawful basis (EU/UK): performance of a contract, and our legitimate interests in preventing unauthorised copying (see §5).
3.3 Device information
Each activated device generates and stores a random identifier (a UUID). It is not derived from your hardware and cannot identify you outside PMAXIS. We also record a device label derived from your browser's user-agent string — for example "Chrome on Mac" — plus first-seen and last-seen timestamps.
This lets you see and remove your own activated devices, and lets us cap a single licence at 25 devices. Devices not seen for 90 days are automatically removed.
Lawful basis (EU/UK): legitimate interests — limiting the impact of a leaked licence key.
3.4 Technical data
When your device contacts our licensing service, your IP address is processed by Cloudflare to route and secure the request. We do not use it to build a profile of you and we do not retain it in our own records.
3.5 What we do not collect
- No analytics, telemetry, or usage tracking in the application.
- No advertising or third-party marketing cookies.
- No project content of any kind.
- No location data, contacts, or device sensors.
4. Attribution on exported documents — please read this
PMAXIS is sold with a document attribution feature. Documents you export or print carry a line identifying the person the licence is registered to — for example "Prepared by Jane Smith" — and the same name is shown in the application sidebar.
Two things follow from this, and we want them stated plainly:
- Your name may reach people you send documents to. If you export a report and email it to a client, that client sees the attribution line. You control who receives your documents.
- You can choose the form it takes. In the application's Document attribution settings you can display your name, your email address, or your name with your company. You can edit the company field at any time.
The purpose is accountability: because every copy of PMAXIS is registered to a named person, a leaked or unlicensed copy is traceable. We consider this a legitimate interest, balanced by the fact that the information shown is limited to what you provide, is under your control as to form, and appears only on documents you choose to create and share.
5. Why your name and email cannot be changed in the app
Your registered name and email are deliberately locked once a licence is activated. That is what makes the attribution above meaningful — a copy that can be re-registered to anyone is not traceable.
This does not remove your right to correct your information. If your details are wrong — a typo, a legal name change, a new email address — contact us and we will correct the record for you. We simply do not allow it to be done silently, from inside the app, by whoever happens to be holding the software.
6. Who your information is shared with
We use a small number of service providers ("processors"). They act on our instructions and may not use your information for their own purposes.
| Provider | Role | Where |
|---|---|---|
| Shopify | Storefront, orders, payment processing | Canada / United States / global |
| Cloudflare | Application hosting, licensing service, licence-record storage | Global edge network |
We do not sell or share personal information, and we do not disclose it to anyone else except where we are legally required to (for example, a valid court order), or to establish or defend legal claims.
PMAXIS makes no third-party requests at all. Fonts and every code library the application uses are served from our own application, so using PMAXIS discloses your IP address to no one but us and our hosting provider. This applies to documents you export as well — an exported report is a self-contained file that contacts nothing when opened.
7. International transfers
We are based in New Zealand. Our providers operate globally, so your information may be processed outside your country, including in the United States.
- From the EU/UK: transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum / IDTA where applicable), incorporated into our providers' data processing terms.
- From New Zealand: in accordance with IPP 12 of the Privacy Act 2020, we only send personal information overseas to providers subject to comparable safeguards.
- From Australia: in accordance with APP 8, we take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles.
New Zealand holds a European Commission adequacy decision, so transfers from the EU to us do not require additional safeguards.
8. How long we keep it
| Data | Retention |
|---|---|
| Licence record (name, surname, email, company) | Kept for as long as the licence exists. PMAXIS licences are perpetual — they do not expire — so these records are retained indefinitely unless you ask us to delete them. |
| Device entries (identifier, label, timestamps) | Automatically removed after 90 days without use |
| Order records (Shopify) | As required by tax and business record-keeping law |
| Data stored on your own device | Until you clear your browser storage — entirely under your control |
We want to be straightforward about the first row. Because licences never expire, we keep the licence record indefinitely so the key remains valid and supportable. If you would rather we did not, you can ask us to delete it at any time — see §9. Deleting the record deactivates the licence.
9. Your rights
Wherever you live, you can ask us to:
- Access the personal information we hold about you
- Correct anything inaccurate or out of date (including your locked name and email — see §5)
- Delete your information
- Export your information in a portable format
- Restrict or object to how we use it
- Withdraw consent, where we rely on consent
To exercise any of these, contact us at https://pmaxis.co/pages/contact. We respond within 30 days. We do not charge a fee, and we will not treat you differently for asking.
Region-specific rights
European Economic Area / United Kingdom (GDPR, UK GDPR). You have the rights above under Articles 15–22, including the right not to be subject to solely automated decisions with legal effect — we make no such decisions. You may complain to your national supervisory authority, or to the UK Information Commissioner's Office (ico.org.uk).
New Zealand (Privacy Act 2020). You have the right to access and correct your information under IPP 6 and IPP 7. You may complain to the Office of the Privacy Commissioner (privacy.org.nz).
Australia (Privacy Act 1988). You have rights of access and correction under APP 12 and APP 13. You may complain to the Office of the Australian Information Commissioner (oaic.gov.au).
California (CCPA/CPRA). You have the right to know, delete, and correct your personal information, and to opt out of its sale or sharing. We do not sell or share personal information, and we have not done so in the preceding 12 months. We do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights.
Other US states (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana). You have comparable rights of access, correction, deletion, and portability, and the right to appeal a refused request. Contact us using the link above.
Canada (PIPEDA). You may access and correct your information and complain to the Office of the Privacy Commissioner of Canada.
10. Security
- All communication with our storefront and application uses HTTPS/TLS.
- Licence tokens are cryptographically signed and expire after 30 days, revalidating automatically.
- Licence records sit in Cloudflare Workers KV, reachable only through our licensing service.
- Access to the underlying systems is limited to the operator of PMAXIS.
No system is perfectly secure. If a breach occurs that is likely to cause you serious harm, we will notify you and the relevant regulator as required — in New Zealand, the Privacy Commissioner; in the EU/UK, the supervisory authority within 72 hours.
11. Cookies and local storage
The application does not use cookies. It uses your browser's local storage to hold your licence key, your entitlement record, your device identifier, your display preferences, and your project data. This never leaves your device and is not transmitted to us.
Clearing your browser storage will sign the device out and delete any project data you have not exported. Export your work first.
The pmaxis.co storefront is operated by Shopify, which uses cookies necessary for shopping-cart and checkout functionality. See Shopify's own privacy policy for detail.
12. Children
PMAXIS is professional software and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with information, contact us and we will delete it.
13. Self-hosted and offline copies
If you run PMAXIS from your own file system or your own server, the licensing gate is inactive and no information is transmitted to us at all. Everything stays on your machine. This policy then applies only to any purchase you made through our storefront.
14. Changes to this policy
We will post any changes on this page and update the "Last updated" date. If a change materially affects how we handle your information, we will take reasonable steps to tell you directly.
15. Complaints
If you are unhappy with how we have handled your information, please contact us first — most issues are resolved quickly. You may also complain to your local regulator:
| Region | Regulator |
|---|---|
| New Zealand | Office of the Privacy Commissioner — privacy.org.nz |
| Australia | Office of the Australian Information Commissioner — oaic.gov.au |
| United Kingdom | Information Commissioner's Office — ico.org.uk |
| European Economic Area | Your national data protection authority |
| Canada | Office of the Privacy Commissioner of Canada — priv.gc.ca |