Privacy Policy

1. Introduction

Reallo Ltd ("Reallo", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the Reallo website, application, and related services (the "Service").

This policy is written in compliance with the Privacy Act 2020 (NZ) and the Information Privacy Principles (IPPs) it establishes. We are committed to handling your data transparently, fairly, and in accordance with New Zealand law.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices, please do not use the Service.

2. Important Notice: Service Description

Reallo is a personal finance platform that provides spending analysis, waste calculation, and spending trend insights. Reallo does not provide financial advice or recommend specific investments, funds, or financial products.

The Service helps you understand your spending patterns and find money you're wasting. What you do with that money is your decision. If your financial situation is complex or you want personalised financial advice, a licensed financial adviser can help.

3. Information We Collect

We collect information in three categories:

Information you provide directly: When you sign up with an email address, we collect your email address and a password, which we only ever store as a one-way hash. If you sign up with Google or Apple instead, we store the account ID that provider gives us and the email address it shares, which for Apple can be a private relay address. Apple may also pass us your name the first time you sign in. For Apple accounts we keep an encrypted Apple token, used only to cancel Sign in with Apple when you close your account. Adding your name in the app is optional.

Two-factor authentication uses either an authenticator app on your device or a text code to your mobile. If you use an authenticator app, we store the secret that app is set up with, encrypted. If you use text codes, we collect the mobile number you give us, store it encrypted along with a keyed hash of it (so we can tell when a number is already in use and limit how many codes go to one number), and use it only to send you sign-in and security codes. We never use it for marketing. You can change the number at any time in Settings, and it's removed when you switch to an authenticator app or turn two-factor authentication off. Each text code we send is recorded with an encrypted copy of the number it went to, the IP address that asked for it where we have one, and a keyed hash of the code (never the code itself). Those records stay until you close your account.

When you set Reallo up, you also tell us about your goals (their names, target amounts and dates) and where you want money to go. For a cash destination that's one of your connected accounts, with its account number and name, and an optional reference. For investing it's your Sharesies customer reference, and for KiwiSaver your IRD number. We work out your income and expenses from your transactions, and you can enter your own figures instead. If we ask whether a payment is your pay, we keep your answer. When you contact support, we collect whatever you include in your message.

Information from your bank connection: When you connect your bank through Akahu, our bank connectivity provider, authorisation happens directly between you and your bank. Your bank login credentials are never shared with, transmitted to, or stored by Reallo at any point. For each account you link, we receive the account name (which can include your name), type, account number, bank and balances. For each transaction, we receive the date, the amount, the description (we remove any card number from it before we store it), the merchant name and logo where Akahu has one, Akahu's category, the transaction type, the running balance, and the other party's account number where your bank provides it. A description can include the names of people you paid or who paid you, and payment references. For pending card payments we also receive the card's last digits. We also receive the email address and ID of your Akahu account. This data access does not move money; payment initiation is a separate authorisation (see section 4b).

Information collected automatically: We keep security records that include the IP address a request came from, for example when you sign in, connect a bank or approve a payment. When you confirm a sign-in code we've emailed you, we remember that device so you aren't asked again, and store its browser's user-agent text and the IP address it signed in from. If notifications are allowed on your phone, we store its push token and whether it's an iPhone or Android. We use these to keep your account secure (for example, recognising trusted devices and investigating suspicious sign-ins) and to keep the Service running. We also note a few things you do in the app, like whether you've opened an insight or reviewed a subscription, so those features work. We do not run analytics on your use of the Reallo app, and the app uses no advertising trackers or third-party tracking pixels. The app does load its fonts from Google Fonts, so your device's IP address reaches Google when you use Reallo. Our public website at www.reallo.co.nz is different, as section 10 explains.

4. How We Use Your Information

We use your information for the following purposes:

To provide the Service: Analysing your transaction data to categorise spending, identifying discretionary expenditure, generating personalised budgets and spending insights, and calculating how much money you're wasting each month.

4a. Discretionary Spending Detection

Our rules engine analyses your transaction data to identify and categorise discretionary spending. This analysis is automated and based on transaction categories, merchant types, and spending patterns. The categorisations are suggestions only: you can override, adjust, or dismiss any categorisation at any time.

4b. Payment Initiation

If you choose to set up automated payments, Reallo initiates payment instructions from your nominated bank account to a destination account you have selected. Important details:

• You must explicitly authorise each payment rule before it becomes active.
• Payments under an active rule are initiated automatically at 8pm NZ time every Wednesday, unless you skip, pause or stop them. On the day of a weekly move we aim to email a heads-up at midday, before the move runs at 8pm, with the option to skip it. The heads-up is a courtesy, sent only where your account is fully set up with two-factor authentication enabled and your bank connection is healthy, and it is not guaranteed. You can skip an upcoming move, or pause or cancel the rule, in the app at any time.
• Reallo never holds, receives, or has possession of your funds at any point. We only initiate the payment instruction through Akahu's payment APIs.
• You can pause or cancel any automated payment rule at any time through the app.
• We keep a record of every move (the amount, date, destination account and payee name) as your move history. It stays if you revoke bank access, and it's deleted when you close your account.

4c. Third-Party Destination Platforms

When you choose to direct funds to a third-party platform (such as an investment platform, KiwiSaver provider, or savings account), you are responsible for your relationship with that platform. Reallo has no affiliation with, control over, or responsibility for any third-party platform you choose. Once a payment instruction has been initiated from your bank account, Reallo's involvement ends. Any issues with the destination account or platform must be resolved directly with that provider.

4d. Other Uses

We also use your information to manage your account, send account-related communications, respond to support requests, enforce our Terms of Service, and comply with legal obligations.

To improve categorisation for everyone: where this is switched on, when at least three different people correct the same merchant to the same category, we may start using that correction for all users. The shared correction isn't linked to anyone, though we keep an internal record of the first three accounts whose corrections set it off.

To improve the Service, we use anonymised and aggregated data for identifying trends, fixing technical issues, and analysing usage patterns to guide product development.

We will never use your financial data for advertising purposes. We will never sell, rent, or trade your personal information to third parties for their marketing purposes.

4e. AI Processing

We use Anthropic, an AI company based in the United States, for a few jobs our own rules can't do alone. That means some of your data is processed overseas (see section 12). Here's exactly what we send:

• Sorting transactions into categories: the transaction description and an amount, for transactions our other rules couldn't place. Those rules run first: your own corrections, then transfer detection, Reallo's own merchant decisions, Akahu's category, a check for payments to people, and our keyword and merchant rules.
• Spotting subscriptions: the merchant name, up to three transaction descriptions, the average charge, and how many times you were charged recently (looking back up to 13 months).
• Recognising payments to people: the transaction description, so we can pull out the name of the person you paid or who paid you.
• Writing some of the short insights on your dashboard: the figures behind the insight, such as category, merchant and subscription names, amounts, percentage changes, visit counts and renewal dates.

Before a description or merchant name goes off for categories, subscriptions or payments to people, we remove bank account numbers, card numbers and other long strings of digits (the last four digits of a card can still appear). Insight requests carry figures and names, not bank descriptions. We don't add your name, email address, or any Reallo or Akahu account ID to a request. But a bank description can itself contain names, including yours and other people's, and payment references, and those go as they appear. Each request holds one person's data, so it isn't anonymous.

AI is part of how Reallo works, so there isn't a setting to switch it off. If you don't want your transactions processed this way, you can revoke bank access or close your account.

5. Legal Basis for Processing

Under the Privacy Act 2020 (NZ), we process your personal information on the following lawful bases:

Consent: You consent to data processing when you create an account and connect your bank. You can withdraw consent at any time by disconnecting your bank or deleting your account.

Contractual necessity: Processing your data is necessary to provide the Service you have signed up for.

Legitimate interest: We process limited data (server request and security logs) to keep the Service secure and running reliably, provided this does not override your privacy rights.

6. How We Share Your Information

We share your information only with the following categories of recipients, and only to the extent necessary to provide the Service:

Akahu Limited: To facilitate your bank connection. Akahu receives your authentication credentials directly from your bank (not through Reallo) and provides us with your transaction data. Akahu operates under New Zealand law. See akahu.nz/privacy for their privacy policy.

Third-party destination accounts: If you choose to set up automated transfers to an investment platform, KiwiSaver provider, or savings account, we share the minimum information necessary to facilitate the transfer (transfer amount and frequency). We do not share your transaction data or spending analysis with these platforms.

Hosting and infrastructure providers: Our app runs on Fly.io and our database is hosted by Supabase, both in Sydney, Australia. Our website and the browser version of the app are served by Vercel. These providers process data on our behalf under data processing agreements.

Email delivery provider: To send you account emails (verification codes, security notices, and notices about your scheduled moves), we pass your email address and the content of those emails to our email delivery provider.

SMS delivery provider: If you choose text codes for two-factor authentication, we pass your mobile number and the security code to TNZ Group Limited (New Zealand), who deliver the text on our behalf. They receive nothing else about you, and they process it on our behalf, not for their own purposes.

AI provider: Anthropic (United States) receives the details set out in section 4e. It processes them on our behalf, not for its own purposes.

We do not share your personal information with any other third parties unless required to do so by law (for example, in response to a valid court order or statutory demand from a New Zealand government agency).

7. Data Storage and Security

Your data is stored in Sydney, Australia, with Fly.io and Supabase, so it's stored and processed outside New Zealand. Some providers also process it in other countries. Where that happens, we take the steps the Privacy Act 2020 requires for cross-border disclosure, so your information keeps comparable protection to what it would have here. The International Data Transfers section below has the detail.

We protect your data in transit with TLS 1.2 or higher on every connection, including between our application and our database. At rest, the most sensitive secrets we hold, namely your two-factor authentication secret, your mobile number if you use text codes, and the access tokens that let us read your bank data through Akahu, are individually encrypted with AES-256 before they are written to the database, so they are unreadable without a key held outside it. Passwords and backup codes are only ever stored as one-way hashes. The rest of your data, including your transaction history, is protected by the disk encryption our hosting providers apply to all stored data, together with role-based access controls restricting access to authorised personnel on a need-to-know basis, and secure development practices including code review and dependency scanning.

While we implement industry-standard security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents in accordance with the Privacy Act 2020 notification requirements.

8. Data Retention

We retain your personal information for the following periods:

Active accounts: We keep your data for as long as your account is open. If you stop using Reallo without closing your account, we keep your data until you close your account or ask us to delete it. The one exception is an account that signed up with an email address and never verified it, which we delete after 30 days. If we ever start deleting inactive accounts, we'll tell you at least 14 days beforehand.

Bank data obtained via Akahu: We hold the transaction data we receive through Akahu only for as long as we reasonably need it to run the Service.

When you disconnect your bank inside the Reallo app, we immediately stop fetching new data, cancel the payment approvals you gave us, revoke our access with Akahu, and delete the transaction data we hold for you (pending transactions included), your balance history, the spending insights and subscription reviews we built from your transactions, the Akahu access token and the sync records tied to that connection. The deletion on our side happens straight away, as a single all-or-nothing operation, so nothing is left half-removed. If you agreed to test Reallo, your tester snapshot (described below) is kept.

If instead you revoke our access only from your Akahu dashboard at my.akahu.nz, we find out when our regular syncs start being refused, and delete the same data once we have confirmed the revocation, within about a day. We wait for three refused syncs spread over at least 24 hours because deletion is permanent, and the pause protects you from losing your data over an accidental or temporary connection drop that was never a real disconnection. In the rare case of a wider connection outage we hold off on these deletions for longer, so we never remove your data by mistake.

Disconnecting does not delete your Reallo account. Your goals, budgets, destinations and move history stay in place so you can keep using Reallo and reconnect later. If you want everything removed, use Close account in Settings.

Support communications: Support emails stay in our mailbox, separate from your account. We keep them only as long as we need them to help you and to settle any dispute, and we'll delete them if you ask.

Deleting your account: When you close your account in Settings, or ask us to delete it by emailing developer@reallo.co.nz, we delete your account and your personal data from our live systems straight away, and disconnect your bank connections at the same time. You do not have to wait for any retention period to end.

What remains after deletion: Apart from support emails (above), only the following is kept after your account is deleted.

• Security and audit log entries, with the link to your user record removed. These record events such as sign-ins, bank connections, payment approvals, payments and deletions. Entries made from a request you sent still hold its IP address, and an entry's details can include your email address, a masked bank account number (the last four digits), a masked phone number, merchant or subscription names, and Akahu's IDs for your accounts, payment approvals and payments. In rare error cases they can include a full bank account number. So these entries are not fully anonymised. We keep them for security investigations, and there is no set date when they are deleted yet.
• Tester snapshots, only if you agreed to test Reallo. A tester snapshot is a copy of your transactions that we keep for product testing. It stays after you disconnect your bank or delete your account, and we delete it when you ask us to.
• Requests to Akahu to revoke Reallo's access to your bank, until the revocation goes through. If Akahu cannot be reached when you delete your account, we keep the request queued and retry it, and follow it up ourselves if the retries fail.
• Bank notifications (webhooks) that Akahu sent us, for up to 90 days. The exception is a notification about a payment we have no record of, which we keep until we have resolved it.
• Backups of our database, for up to 7 days. We back up our database once a day and keep each backup for 7 days, so once your data is deleted from our live systems, it's fully gone from our backups within 7 days too. Backups are not used to run the Service.

Aggregated data: Anonymised, aggregated data that cannot be used to identify you may be retained indefinitely for statistical analysis and product improvement.

9. Your Rights

Under the Privacy Act 2020 (NZ), you have the following rights regarding your personal information:

Right to access: You may request a copy of the personal information we hold about you. We will respond within 20 working days as required by law.

Right to correction: You may request correction of any personal information that is inaccurate, incomplete, or misleading. You can update most information directly through your account settings.

Right to deletion: You may request deletion of your personal information by deleting your account through Settings > Danger Zone > Close account (type DELETE to confirm, then tap Delete account), or by contacting developer@reallo.co.nz. Section 8 lists exactly what remains after deletion and for how long.

Right to a copy of your data: Reallo does not yet have a self-serve export. To get a copy of your transaction history, spending analysis, and move history, email developer@reallo.co.nz and we will provide it in a portable format within 20 working days, the same timeframe as an access request.

Right to withdraw consent: You may withdraw consent for data processing at any time by disconnecting your bank or deleting your account. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Right to complain: If you believe your privacy rights have been violated, you may lodge a complaint with the Office of the Privacy Commissioner at privacy.org.nz.

To exercise any of these rights, contact us at developer@reallo.co.nz. We may ask you to verify your identity before processing your request.

10. Cookies and Tracking Technologies

We use cookies and similar technologies as described in our Cookie Policy. In summary, in the Reallo app we use only essential cookies required for the Service to function (authentication, session management, security), plus settings stored in your browser's local storage to remember your preferences on your device.

The app does not use analytics cookies, advertising cookies, social media tracking pixels, or cross-site tracking technologies. For full details, see our Cookie Policy.

Our public website at www.reallo.co.nz, which you can use without an account, is different. It uses PostHog for analytics, and Google Tag Manager, which loads Google Analytics and the Meta and TikTok pixels. The Meta and TikTok pixels measure how our ads perform, for example whether a visit from an ad led to someone joining the waitlist. We do not share your email address or name with Meta or TikTok, or with our analytics tools. You can opt out by blocking or deleting cookies for reallo.co.nz in your browser's cookie settings, as described in our Cookie Policy. None of this runs in the Reallo app.

10a. This website (reallo.co.nz)

Sections 1 to 10 describe the Reallo app, and section 10 summarises this website's analytics and advertising tools. This section covers our public website at reallo.co.nz in full. You can use it without an account, and it handles a small amount of additional information the app does not.

Waitlist, newsletter and contact forms: When you join our waitlist, subscribe to updates, or contact us through the site, we collect your email address, the option you optionally select describing your situation, and anything you write in a message to us. We use your email address to send you updates about Reallo, including when it launches, and we use what you write to us to reply to your messages. We do not pass your email address or name to our analytics tools, or to Meta or TikTok. Form submissions are processed by Formspree (United States). We keep your waitlist email until you unsubscribe or ask us to delete it. You can unsubscribe at any time using the link in any email, and ask for deletion by emailing developer@reallo.co.nz.

Website analytics and advertising: Unlike the app, the website uses analytics so we can understand how people find and use it, and advertising pixels so we can measure how our ads perform. PostHog (hosted in the European Union) provides product analytics. Google Tag Manager loads Google Analytics and the Meta and TikTok pixels. The Meta and TikTok pixels measure how our ads perform, for example whether a visit from an ad led to someone joining the waitlist. These tools collect standard technical information your browser sends (device type, browser, pages visited) and how you arrived at the site, including referral and campaign information from links you click. When you join the waitlist they are told that a signup happened and where it came from, never your email address or name. The website is hosted by Vercel. Because these providers operate overseas, this information may be stored and processed outside New Zealand, including in the United States and the European Union, and may be subject to the laws of those countries. Analytics data is retained according to our providers' standard retention periods.

Opting out: You can opt out of the website's analytics and advertising cookies by blocking or deleting cookies for reallo.co.nz in your browser's cookie settings, or by blocking third-party cookies. Our Cookie Policy explains how. Blocking them does not stop you using the website.

The website does not collect financial information, bank details, or account data. Nothing you do on the website connects to your bank; that happens only in the app, under the sections above. Website analytics are never linked to your bank data.

11. Age Restriction

Reallo is designed for use by anyone aged 16 or over. We do not knowingly collect personal information from anyone under the age of 16. During account registration, you must confirm that you are at least 16 years old.

If we become aware that we have collected personal information from a person under 16, we will take steps to delete that information as soon as practicable. If you are a parent or guardian and believe your child under 16 has provided personal information to Reallo, please contact us at developer@reallo.co.nz.

12. International Data Transfers

Your data is stored in Australia: our app runs on Fly.io and our database is hosted by Supabase, both in Sydney. Some of our other service providers (such as our email delivery provider, Vercel, which serves our website and the browser version of the app, and Anthropic, the AI provider described in section 4e) may process data in other countries, including the United States. Where international transfers occur, we ensure that adequate data protection measures are in place through contractual data processing agreements that require the recipient to protect your data to a standard comparable to New Zealand law.

Your bank connection itself runs through Akahu's New Zealand infrastructure. Section 4e sets out exactly what we send to our AI provider.

13. Data Breach Notification

In the event of a privacy breach that we reasonably believe has caused, or is likely to cause, serious harm to any affected individual, we will:

• Notify the Office of the Privacy Commissioner as soon as practicable, and in any case within 72 hours of becoming aware of the breach.
• Notify affected individuals directly (by email, phone, or in-app notification) as soon as practicable, informing them of the nature of the breach, what information was affected, what steps we have taken, and what steps they should take to protect themselves.
• If direct notification is not possible, we will issue a public notice on our website and through our app.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or the Service itself. Material changes will be communicated to you via email or through a prominent notice within the Service at least 14 days before they take effect.

The "Last updated" date at the top of this policy reflects the most recent revision. We encourage you to review this policy periodically. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

15. Privacy Officer

In accordance with the Privacy Act 2020, Reallo has appointed a Privacy Officer who is responsible for ensuring our compliance with this policy and the Privacy Act. The Privacy Officer oversees all data access and correction requests, data breach assessment and notification, privacy impact assessments for new features, staff training on data handling obligations, and responding to enquiries from the Office of the Privacy Commissioner.

You may contact our Privacy Officer at:

Privacy Officer, Reallo Ltd
Email: developer@reallo.co.nz
Location: Auckland, New Zealand

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Reallo Ltd
Email: developer@reallo.co.nz
Location: Auckland, New Zealand

Privacy enquiries and formal requests under the Privacy Act 2020 reach our Privacy Officer at this address.

We aim to respond to all privacy-related enquiries within 5 working days. For formal privacy requests under the Privacy Act 2020, we will respond within 20 working days as required by law.