Skip to main content
OwdynOwdyn

Legal

Privacy Policy

What we collect, how we use it, and the choices you have.

Last updated: 28 June 2026

On this page

  1. 1. Information we collect
  2. 2. How we use your information
  3. 3. How AI features process your data
  4. 4. How we share your information
  5. 5. How we protect your data
  6. 6. If a security incident happens
  7. 7. Your rights and choices
  8. 8. Data retention
  9. 9. Cookies
  10. 10. Where your data is stored
  11. 11. Children's privacy
  12. 12. Changes to this policy
  13. 13. Questions

Information we collect

Account details, the financial data you add, feedback you send, and limited technical data for security.

Account information

Email (required for sign-in), name (optional), profile picture (optional, with Google sign-in), and your password.

Financial data

Added manually or, on Plus and Wise, via bank sync: accounts and balances, transactions (amount, date, description, category), budgets and categories, and goals. This is your data, used to provide the service.

Bank sync (Plus and Wise — coming soon)

When you connect a bank account, we collect, via Akahu: account names and full account numbers, current and available balances, and up to 90 days of transaction history on first connection, refreshed after that.

Akahu is an accredited requestor and open banking intermediary in New Zealand, acting as the secure connection between you and your bank. Owdyn collects this data from Akahu.

Owdyn never handles your banking credentials. Depending on your bank, you log in directly with your bank, or Akahu logs in on your behalf through its secure hosted flow. Either way, your credentials are never shared with Owdyn.

View Akahu's privacy policy at akahu.nz/privacy-notice.

Feedback data

When you submit in-app feedback, we collect the type (bug, feature request, or other), your message, the page you were on, your plan (to help us prioritise), and, for bug reports, your browser and device type. Feedback is stored in our database and forwarded to Canny.

Usage and security information

Device and browser type, IP address (for security, rate limiting, and abuse prevention), pages and features used, AI feature usage counts (to enforce Free limits), and security events (sign-in, sign-out, 2FA changes, plan changes), logged with a timestamp and IP address for fraud detection, account recovery, and investigation.

How we use your information

To run Owdyn, generate insights, improve the product, communicate with you, take payment, and keep things secure.

  • Provide Owdyn: show accounts, track budgets, display analytics.
  • Generate insights and suggestions, including optional AI features.
  • Improve Owdyn: understand feature usage and process your feedback.
  • Communicate with you: service messages, security alerts, and marketing only if you opt in.
  • Process payments through Stripe.
  • Maintain security and prevent abuse.

How AI features process your data

Owdyn uses Anthropic's Claude to suggest categories and insights. We sanitise data before it leaves Owdyn.

On import or bank sync, descriptions and amounts are sent to Anthropic for category suggestions. Spending insights and other optional features only run when you ask — if you never use them, nothing is sent. Suggestions are always shown for your review before being applied.

What we send

  • Transaction descriptions, sanitised first — emails, phone numbers, card numbers, account numbers, and IRD numbers stripped before sending
  • Amounts and income or expense type
  • Your category names as options
  • Aggregated spending summaries, only when you request an insight

What we never send

  • ✕Your email or password
  • ✕Payment information
  • ✕Identity documents

Under Anthropic's Data Processing Addendum, your data is used only to generate your responses, is not used to train AI models, and is not retained long-term. Current subprocessors: anthropic.com/subprocessors. Full technical detail is on our Security page.

AI outputs may be inaccurate or incomplete — always review them. No decision with a legal or significant effect is made solely by automated means. For personalised advice, consult a qualified adviser.

How we share your information

We do not sell your data. We share it only with the providers that help run Owdyn.

Anthropic (AI)

Sanitised transaction descriptions, amounts, and income or expense type, to generate suggestions and insights.

Stripe (payments)

Payment information (we never see your full card number), to process Plus and Wise subscriptions.

Neon & Vercel (infrastructure)

All application data — Neon stores it (PostgreSQL database), Vercel runs the service (hosting).

Upstash (rate limiting)

Anonymised identifiers from your IP and account ID, used only to enforce rate limits. No financial or personal data is sent. Upstash is US-based, and counters expire automatically.

Resend (email)

Your email and name, to send account and security messages.

Canny (feedback)

Your name, email, and the feedback you submit, to manage and prioritise feedback and power the public roadmap. We do not share your financial or transaction data with Canny. Canny is US-based.

We may also share data where required by law or valid legal process, or during a business transfer (we will tell you).

How we protect your data

Industry-standard encryption and safeguards, with the technical detail on our Security page.

  • Encryption in transit: HTTPS and TLS 1.2 or higher on all connections.
  • Encryption at rest: AES-256 disk-level encryption on our database (Neon).
  • Application-layer encryption: AES-256-GCM applied inside Owdyn for the most sensitive fields — specifically your 2FA secret and any bank OAuth tokens — before they are written to the database.
  • Password security: hashed with bcrypt (cost factor 12), never stored in plain text.
  • Rate limiting on authentication endpoints.
  • Audit logging of key security events.

For more, see our Security page.

No system is completely secure, so please use a strong, unique password, enable two-factor authentication, and keep your email account secure.

If a security incident happens

We will notify you promptly and report to the Privacy Commissioner where required.

If a breach affects your information, we will notify you as soon as reasonably practicable (as required by the NZ Privacy Act 2020, targeting within 72 hours where possible), explain what was affected and how, describe what we are doing, and give you guidance.

Where a breach is likely to cause serious harm, we report it to the NZ Privacy Commissioner, as required by Part 6 of the Privacy Act 2020.

If Anthropic notifies us of a breach affecting your transaction data, we will tell you as soon as we can.

To report a concern, email support@owdyn.nz. We aim to respond within 24 hours.

Your rights and choices

Under the NZ Privacy Act you can access, correct, export, and delete your data, and complain if needed.

Under the NZ Privacy Act 2020 (Information Privacy Principles 6 and 7), you can:

Access and correction requests are responded to within 20 working days, free of charge, as required by s44 of the Privacy Act 2020.

Access your information

Most is available in-app. For anything else, email support@owdyn.nz.

Correct your information

Update most data in-app, or email us. If we decline a correction, you can ask for a statement of disagreement to be attached.

Export your data

CSV export anytime in Settings → Export Data.

Delete your account

In Settings. Deletion is immediate and permanent — see Data retention below for the full timeline.

Object or complain

Contact us first at support@owdyn.nz. If you are not satisfied, contact the NZ Privacy Commissioner at privacy.org.nz, 0800 803 909, or enquiries@privacy.org.nz.

Data retention

We keep your data while your account is active. When you delete it, financial data is erased immediately.

When you delete your account, the following happens immediately and permanently:

Permanently deleted

All personal financial data, including your profile, accounts, transactions, budgets, goals, bills, BNPL plans, categories, rules, bank connections, import history, forecasting scenarios, payoff simulations, snapshots, AI insights, notifications, and feedback. This cannot be undone, so export first.

De-identified, not deleted

Action audit logs (such as "account created") are anonymised. Your name and account link are removed, and the de-identified record is kept for fraud detection and legal defence. It contains nothing that can identify you.

Day 90

Backups are purged.

Bank connection revocation

When you disconnect a bank account, your Akahu access token is revoked immediately and the connection record is deleted. Transactions already synced stay in your account as part of your history, auto-sync stops, and you can delete individual transactions anytime or delete your account to erase everything. If your plan no longer includes automatic sync, syncing pauses; if it stays paused for 30 days, we disconnect the bank connection and revoke the token automatically, with notice beforehand. This is consistent with the NZ Privacy Act 2020 (IPP 9).

After account deletion, Anthropic deletes your transaction data under its Data Processing Addendum.

Stripe retains billing records under its own policy and tax law.

Feedback submitted to Canny is retained under Canny's policy; to request deletion from Canny, email support@owdyn.nz and we will submit a request on your behalf.

Cookies

We use essential cookies for sign-in and security, and no advertising cookies.

Owdyn uses essential cookies for authentication and session management. See our Cookie Policy for detail. We do not use third-party advertising cookies or sell data to advertisers.

Where your data is stored

Owdyn is built for New Zealand. Your data is stored in Australia, with AI processing and hosting in the US.

Owdyn is based in Auckland and designed for New Zealand residents. Its features, pricing, bank integrations, and formats are built for the NZ market.

Your data is stored in the AWS Sydney region (Australia). By using Owdyn you acknowledge that your data may be stored and processed in Australia and the United States (AI processing via Anthropic, and hosting via Vercel). These policies and any dispute about your data are governed by New Zealand law, including the Privacy Act 2020.

If you use Owdyn from outside New Zealand:

  • Your data is processed under NZ law and stored in Australia and the US
  • You may have additional local rights (such as GDPR in Europe), which you can exercise by emailing support@owdyn.nz
  • Bank integrations support NZ banks only
  • We cannot guarantee the service meets the requirements of other jurisdictions

Children's privacy

Owdyn is intended for users aged 18 and over.

By creating an account, users confirm they are 18 or over. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with personal information, email support@owdyn.nz and we will delete it.

Changes to this policy

We will give you 30 days' notice of material changes.

We may update this policy. Changes take effect 30 days after we notify you, except changes required by law (immediate) or changes that benefit you (which may take effect sooner). For significant changes we notify you by email, in-app, or by updating the date at the top.

Questions

Questions about privacy or your data? Get in touch.

Email: support@owdyn.nz

Legal entity: OWDYN LIMITED (trading as Owdyn)

NZBN: 9429053482907

Address: Auckland, New Zealand

Privacy and security inquiries receive priority response within 24 to 48 hours.