This Privacy Policy explains how Spendle ("we", "us", "our") handles your personal information. We are committed to protecting your privacy and handling your information in line with the New Zealand Privacy Act 2020 and the Information Privacy Principles.
Who we are
Spendle is a personal finance app made in New Zealand, operated by Automate AI Limited, a New Zealand company. In this policy, "we", "us" and "our" mean Automate AI Limited trading as Spendle. You can contact us about privacy at privacy@spendle.co.nz.
Information we collect
We collect the following kinds of information.
Information you give us, which may include:
- Your name, email address and other contact details.
- Any messages you send us, such as questions or instructions.
Information from the bank and other accounts you connect, retrieved read-only through our open-banking provider Akahu, which may include:
- Account details, such as the provider, the account name and type, and account numbers.
- Financial information, such as balances, transactions and history, payment due dates, credit limits and product details.
- Identifiers held on the account, such as the account holder’s name.
We never see or store your internet banking login details. Where your bank offers an official open-banking service, the connection uses secure tokens, and Akahu handles any credentials directly rather than sharing them with us.
Usage information, such as how you interact with the app, to help us keep it working well and improve it. On this marketing website, analytics are only collected once you actively consent.
Giving us this information is your choice, but some features will not work without it. For example, your safe-to-spend number needs a connected bank account. Spendle is intended for people aged 18 and over, and we do not knowingly collect information from anyone under 18.
How the bank connection works (open banking via Akahu)
Spendle connects to your accounts through Akahu (Akahu Technologies Limited), a New Zealand open-banking provider. When you connect an account, you grant consent through Akahu, and Akahu retrieves the data you have agreed to share so that Spendle can do the maths for you. The connection is read-only: Spendle can see your transaction and balance information, but cannot move money.
Akahu applies the principle of least privilege, meaning it only retrieves the data that is reasonably necessary for the features you use. Akahu operates the connection under its own Privacy Notice and End User Terms, and stores that connection data securely. Akahu does not sell or rent your data.
You stay in control. You can view, manage and revoke your connections at any time, both inside Spendle and through Akahu at my.akahu.nz. When you revoke a connection, Akahu deletes the connection data it holds within 24 hours of that revocation or expiry.
How we use your information
- To calculate your safe-to-spend number, categorise spending and power the features you use.
- To provide the AI coach. Your question is processed to generate a response and is not used to train AI models. AI processing and email are handled within Australia and New Zealand.
- To communicate with you about your account and, if you opt in, product updates. You can unsubscribe from product updates at any time.
- To keep Spendle secure and to meet our legal obligations.
Who we share information with
We share your information only with the providers who help us run Spendle, and only as needed:
- Akahu (Akahu Technologies Limited), our open-banking provider, to establish and maintain your bank connection.
- Amazon Web Services, our cloud hosting provider, which also provides the AI processing (Amazon Bedrock) and transactional email (Amazon SES) we use, within New Zealand and Australia.
- Stripe and RevenueCat, our payment and subscription providers, to take payment and manage your subscription if you choose a paid plan.
- Apple or Google, if you choose to sign in using them. They confirm your identity to us; we receive only the details needed to create and secure your account.
- Analytics and error-monitoring providers that help us keep the app reliable, only where enabled and, for website analytics, only with your consent. These are configured to keep data within Australia, New Zealand or the European Union.
- Authorities or others, where we are required to by law, or where it is needed to protect people from fraud or harm.
- In connection with a future change in ownership of our business, in which case this policy continues to apply.
We put agreements in place that require these providers to protect your information and to use it only to provide their service to us. We do not sell or rent your personal information to third parties, and we never show ads.
Where your data is stored
Your information is stored securely on Amazon Web Services, a trusted cloud platform, with data centres in New Zealand and Australia. It is encrypted in transit and at rest, and protected by strict access controls. The bank-feed connection is handled separately by Akahu under its own Privacy Notice.
Some of our providers, including Akahu, our cloud hosting and our AI processing, are based in or operate from Australia. When we disclose information to a provider overseas, we do so in line with Information Privacy Principle 12 of the Privacy Act 2020: we rely on the provider being subject to privacy protections comparable to New Zealand’s, on contractual safeguards that require them to protect your information, or on your authorisation. Australia has privacy laws comparable to New Zealand’s.
How long we keep your information
We keep your personal information only for as long as we need it to provide Spendle to you and to meet our legal obligations. When you delete your account, we delete or anonymise your personal information, except where we are required to keep some of it by law, such as limited billing records. When you revoke a bank connection, Akahu deletes the connection data it holds within 24 hours.
Keeping your information safe
- Two-factor authentication, using an authenticator app, is available on every account, and we encourage you to turn it on.
- Your information is encrypted in transit and at rest.
- We limit access to personal information to those who need it to do their job.
No system is perfectly secure. If a privacy breach happens that is likely to cause serious harm, we will notify the people affected and the Office of the Privacy Commissioner, as required by the Privacy Act 2020.
Your rights
Under the Privacy Act 2020 you have the right to:
- Access the personal information we hold about you.
- Ask us to correct information that is wrong.
- Export your data, and delete your account and data, at any time.
- Revoke your bank connection at any time.
To exercise any of these, contact privacy@spendle.co.nz.
Cookies and analytics
On this website, non-essential analytics are declined by default. Analytics tools only load after you actively accept. Some essential page assets, such as fonts, may still load so the website works properly. You can change your mind at any time by clearing your choice in your browser.
Complaints
If you are not happy with how we have handled your information, please tell us first so we can put it right. You can also contact the Office of the Privacy Commissioner at privacy.org.nz.
Changes to this policy
We will update this policy as Spendle grows, and we will let you know about any significant changes.
Spendle is not a registered bank, lender or licensed financial adviser. Information in the app is general in nature and is not personalised financial advice.