Skip to content
Sign inGet started

Privacy policy

Last updated 7 August 2026

This policy explains what personal information MM collects, why, who it is shared with, and how you can access or correct it. MM is operated by Pacific Fund Pty Ltd (ABN 75 143 185 406), and in this policy “we” and “us” mean that company.

What we collect

Your account. Your first and last name, your email address, and a password. We never store the password itself — only a one-way cryptographic hash of it, which cannot be turned back into the password you chose. A phone number is optional and we do not ask for one.

Business information you enter. The details of the businesses you manage in MM: names, ABN, descriptions, addresses and coordinates, contact details, and how each business should appear on the destination websites we publish to. This is business information rather than personal information, but a sole trader's business details can be both, so we treat it with the same care.

Technical records. Your IP address when you sign in, register or ask to reset a password, which we use to limit repeated attempts and protect accounts from being guessed at. Records of your active sessions. Timestamps and a request identifier for each request, which lets us trace a problem through our logs.

A record of changes. When someone in your organisation changes a business, location, listing or membership, we record who made the change, what was changed, and when. This is what lets an organisation answer “who changed this, and when?” about its own data.

What we do with it

  • To give you an account and let you sign in to it.
  • To confirm your email address, let you recover a forgotten password, and let an organisation invite you to join it.
  • To publish the business information you provide to the destination websites you have agreed to appear on.
  • To protect accounts — rate limiting sign-in and password-reset attempts so that an account cannot be guessed at.
  • To keep an accurate record of changes made to an organisation's data.

We do not use your information to advertise to you, we do not sell it, and we do not share it with anyone for their own marketing.

What is published

MM exists to publish business information to independent destination websites. The business details you enter and approve — names, descriptions, addresses, opening hours, contact details you provide for the business — are published on those public websites and can be seen by anyone.

Your own name and email address as an MM user are not published. They are visible to other members of the organisations you belong to, and to our staff.

Email we send you

We send three kinds of message, all of them prompted by something you or an administrator of your organisation did: confirming your email address, resetting your password, and inviting you to an organisation. We do not send marketing email, newsletters or bulk email of any kind.

Who else handles it

  • Amazon Web Services hosts MM and stores its data, in AWS's Sydney region.
  • Amazon Simple Email Service delivers the messages described above.
  • The destination websites receive the business information approved for publication, as described above.

MM's data is stored in Australia. We do not otherwise disclose personal information overseas.

Cookies

MM sets one cookie, and only after you sign in: it identifies your session so you do not have to sign in on every page. It is not readable by other websites, it carries no personal information itself, and it is removed when you sign out.

We use no analytics, no advertising cookies and no third-party trackers, on this website or in the application.

How it is protected

Passwords are hashed with Argon2id. Session tokens and the links we email you are stored only as one-way hashes, so a copy of our database does not contain anything that could be used to sign in as you. Traffic is encrypted in transit. Access to an organisation's data is checked on every request against your membership of that organisation.

How long we keep it

We keep your account and the business information in it for as long as your account is open. If you ask us to close your account we will delete or de-identify your personal information, except where we are required to keep it or where it forms part of the record of changes described above — in which case the change remains recorded but is no longer linked to you by name.

Getting access, or correcting something

You can see and correct most of your information by signing in. For anything else — including a copy of what we hold about you, or a request to delete it — contact us and we will respond within a reasonable period.

Complaints

If you think we have mishandled your personal information, contact us and we will look into it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

If we change this policy we will update the date at the top of this page. If a change materially affects how we handle information we already hold, we will tell affected account holders directly.