Privacy Policy

1. Information We Collect

• Email address and name (for account creation)
• Bank statement data: for each transaction we store the merchant name and amount encrypted (AES-256-GCM), alongside the raw statement line it came from, its date, and its category
• AI chat history, and any memory notes the assistant saves about you to personalise future answers (memory notes are stored encrypted)
• Usage data: chat messages sent, features used
• Billing information: managed by Paystack — we do not store card details

2. Lawful Basis for Processing

We process your information on the following lawful grounds under POPIA:

• Contract: processing necessary to provide the budget analysis service
• Consent: for marketing communications (you may withdraw at any time)
• Legitimate interest: improving service quality and security

3. How We Use Your Information

• Providing AI-powered budget analysis and spending insights
• Storing your budget goals and preferences
• Processing subscription billing via Paystack
• Communicating important service updates

4. Data Security

• AES-256-GCM encryption at rest for stored merchant names, amounts, and saved chat-memory notes
• TLS/HTTPS for all data in transit
• Secure cloud infrastructure (Supabase, hosted in EU)
• Uploaded statement files are sent directly to Google's Vertex AI for vision-based transaction extraction — no separate storage bucket is used, and the file is not retained by Track Spend once your transactions have been extracted. Our Vertex AI configuration is set so that Google does not use this data to train its models and does not retain it after your request has been processed (Zero Data Retention)
• Access controls: only you can access your data

5. Your POPIA Rights

You have the right to:

• Access your personal information
• Correct inaccurate information
• Delete your account and all associated data (see Settings)
• Object to processing for direct marketing
• Lodge a complaint with the Information Regulator

To exercise any right, email: privacy@track-spend.com

6. International Data Transfers

Some service providers process data outside South Africa:

• OpenAI (USA) — powers the AI chat assistant. To answer your questions it receives your itemised transaction data, spending summaries, and any memory notes the assistant has saved about you
• RunPod (USA) — hosts a self-hosted, fine-tuned personal-finance model that Track Spend uses to write the final reply on some general-advice chat questions for Pro subscribers. It receives the same chat context OpenAI does for those replies — your itemised transaction data, spending summaries, and saved memory notes. Questions that change your budgets, savings goals, tracked debts or memory, and all chat for trial accounts, are answered by OpenAI, not this model.
• Supabase (EU) — encrypted database storage
• Google — Vertex AI — (1) vision-based extraction of transaction data directly from uploaded PDF statements, (2) categorization of transactions our own rule-based system can't confidently classify, and (3) generation of your AI spending insights (debit order, subscription, and anomaly analysis). These three run on Google's Gemini model via Vertex AI, not on OpenAI.

The United States (where OpenAI and RunPod operate) does not have an adequacy finding under POPIA. We transfer data to OpenAI and RunPod on the basis of your explicit consent, given when you create your account (POPIA Section 72(1)(a)). You may withdraw consent at any time by deleting your account in Settings, which permanently removes all your data. The European Union, where Supabase operates, is recognised as providing adequate protection equivalent to POPIA.

The finance model on RunPod runs on infrastructure Track Spend controls. Your chat context is sent to it only to generate the answer to that message and is not stored afterwards or used to train any model. Unlike our Vertex AI configuration, this is a matter of how the service is operated rather than a contractual Zero Data Retention guarantee from RunPod as an infrastructure provider, and the request may be processed in whichever region the model's compute is running.

When you upload a PDF statement, the entire file — including the account-holder details printed in the statement header, such as your name, ID number, account number, and address — is sent to Google through Vertex AI as part of the extraction request. It is not staged in any separate storage bucket, and it is not retained by Track Spend afterwards. Google also receives raw transaction descriptions (for the transactions our rule-based categorization can't confidently classify) and a summary of your debit orders, subscriptions, and spending anomalies (to generate your AI insights). None of this data is redacted before it is sent, so it may contain identifying details printed on your statement.

Track Spend uses Vertex AI configured for no model training and Zero Data Retention — project-level data caching is disabled and abuse-monitoring logging is opted out — so Google does not keep this data after your request is answered, or use it to improve its models. Google may process these requests in any region worldwide; no adequacy finding under POPIA is asserted for that processing. As with OpenAI, the transfer relies on your explicit consent given at account creation (POPIA Section 72(1)(a)), withdrawable at any time by deleting your account in Settings.

7. Data Retention

We retain your data only as long as you have an active account. When you delete your account, all personal data is permanently and immediately removed. See Settings to delete your account.

8. Security Breach Notification

In the event of a security compromise involving your personal information, we will notify you and the Information Regulator of South Africa as soon as reasonably possible after becoming aware of the breach, as required by section 22 of POPIA. Notification will include: a description of the compromise, the possible consequences, the measures we have taken or propose to take, and contact details for further information. You may contact us at privacy@track-spend.com if you have concerns about the security of your data.

9. Information Regulator

If you're not satisfied with how we handle your data, you may lodge a complaint with the Information Regulator of South Africa:

• Website: inforegulator.org.za
• Email: inforegulator@justice.gov.za

10. Contact

Track Spend is operated by Sikelela Tech (Pty) Ltd (company registration 2026/522938/07). Our Information Officer is Kaylin Klein, registered with the Information Regulator of South Africa (Registration No. 2026-062072).

Information Officer: privacy@track-spend.com