Privacy Policy

1. Who This Policy Applies To

This Privacy Policy applies to:

• Tenant Administrators — individuals who register and operate an account on the MPLUS platform.
• Sub-Users — staff or users invited by a Tenant Administrator to access the platform under their account.
• Visitors — individuals who visit the MPLUS website without registering.

Group Members (individuals whose data is entered by a Tenant Admin) do not interact directly with MPLUS. The Tenant Administrator is responsible for their own privacy obligations to group members under applicable law.

2. Information We Collect

3. Tenant Admin & Group Member Data

All data entered by a Tenant Administrator (including group member names, contact numbers, addresses, and financial records) is stored securely on our servers and is accessible only to:

• The Tenant Administrator who entered the data
• Sub-users authorized by that Tenant Administrator
• MPLUS Super Administrators (for system maintenance only)

MPLUS does not sell, share, or otherwise distribute Tenant Data to any third party. MPLUS does not analyze group member data for any purpose other than providing the platform's core functionality.

4. How We Use Information

• To create and manage your account on the platform
• To provide, maintain, and improve the MPLUS software services
• To authenticate your identity and secure your session
• To process subscription management (Free vs. Pro plan)
• To send important notices about your account (e.g., approval status)
• To investigate and prevent abuse, fraud, or security incidents
• To comply with legal obligations

We do not use your data for advertising, behavioral profiling, or sale to third parties.

5. Data Storage & Security

We implement the following technical and organizational measures to protect your data:

• Password hashing using PHP's bcrypt algorithm — passwords are never stored in plain text
• CSRF token protection on all form submissions
• Session hardening — session IDs are regenerated on login to prevent fixation attacks
• HttpOnly & SameSite cookies to mitigate XSS and CSRF risks
• Multi-tenant data isolation — all database queries are scoped to the authenticated tenant
• Google JWT verification for Google Sign-In authentication

While we take security seriously, no system is 100% impenetrable. We cannot guarantee absolute security and disclaim liability for unauthorized access resulting from Tenant Admin negligence (e.g., shared passwords, unsecured devices).

6. Data Retention

• Account data is retained for as long as your account is active on the platform.
• Upon account termination, Tenant Data may be retained for up to 30 days before deletion to allow for data export, unless earlier deletion is requested.
• Technical logs (server access logs) are retained for up to 90 days for security purposes.
• You may request early deletion of your account data by contacting the Super Admin.

7. Sharing of Information

We do not sell or rent your personal information. We may share data only in the following limited circumstances:

• Legal Compliance: If required by law, court order, or government authority.
• Safety: To protect the rights, property, or safety of MPLUS, its users, or the public.
• Business Transfer: In connection with a merger, acquisition, or sale of assets, with prior notice to affected users.

We do not share Tenant Data with other Tenant Administrators. All data is strictly isolated per tenant account.

8. Your Rights

As a Tenant Administrator, you have the following rights with respect to your account and personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update incorrect or outdated personal information through your profile settings.
• Deletion: Request deletion of your account and associated data.
• Data Portability: Export your Tenant Data using the built-in data export tools (CSV/Excel/PDF).

If you are a group member whose data has been entered by a Tenant Admin, please direct all data privacy requests to that Tenant Administrator. MPLUS cannot process individual member requests as we have no direct relationship with group members.

9. Cookies & Session Data

MPLUS uses server-side PHP sessions to manage authenticated user state. Session data is stored on the server and identified by a cookie placed in your browser. We do not use third-party tracking cookies or analytics cookies.

• Session cookies expire when you close your browser or log out.
• Session cookies are marked HttpOnly and SameSite=Lax.
• No advertising or analytics cookies are used.

10. Children's Privacy

MPLUS is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has registered an account, please contact the Super Admin for immediate removal.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify active users by updating the "Last Updated" date at the top of this page. Significant changes will be communicated through the platform. Your continued use of MPLUS after any changes constitutes your acceptance of the revised policy.

12. Contact

For privacy-related inquiries, data access requests, or concerns about data handling, please contact the MPLUS Super Administrator through the platform or via the contact information provided during your account setup.