Privacy Policy

1. Who we are

Sprout is a personal expense management application for New Zealanders. We help you track your spending by connecting to your bank accounts through Akahu, New Zealand's open finance platform.

This privacy policy explains what personal information we collect, how we use it, and your rights under the New Zealand Privacy Act 2020.

2. What information we collect

When you sign in and use Sprout, we collect:

• Google account information — your name, email address, and profile picture, provided by Google when you sign in.
• Financial account information — account names, types, and balances from the bank accounts you connect through Akahu.
• Transaction data — descriptions, amounts, dates, and merchant names for transactions in your connected accounts. We access up to 12 months of history on first connection, then fetch new transactions daily.
• Preferences — your theme choice, budget settings, and custom categories you create.

3. How we use your information

We use your information exclusively to provide the Sprout service:

• Display your spending breakdown by category
• Show your budget progress and safe-to-spend amount
• Provide insights and trends about your spending habits
• Detect recurring payments and subscriptions

We access your bank account data on a read-only basis. Sprout cannot move money, make payments, or modify your bank accounts in any way.

We do not sell, rent, or share your personal information with third parties.

4. Data storage and security

Your data is stored in Cloudflare D1, a serverless SQL database, and is encrypted in transit (HTTPS) and at rest. Your Akahu access tokens are stored securely and are never exposed to your browser or device.

We do not store your bank login credentials. Authentication with your bank is handled entirely by Akahu.

5. Data retention

We retain your data only for as long as you maintain a Sprout account. When you disconnect a bank account, we delete the associated transaction and account data. When you delete your Sprout account, all your personal data is permanently removed.

You may also log into my.akahu.nz at any time to revoke Sprout's access to your bank data. We will detect the revocation and remove your data accordingly.

6. Your rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Access the personal information we hold about you
• Request correction of your personal information
• Request deletion of your personal information
• Make a complaint to the Privacy Commissioner if you believe your privacy has been breached

7. Contact

If you have questions about this privacy policy or wish to exercise your rights, contact us at privacy@getsprout.nz.