Privacy Policy

1. Information We Collect

• Email address and name (for account creation)
• Bank statement data: transactions, amounts, merchants (encrypted at rest)
• Usage data: chat messages sent, features used
• Billing information: managed by Paystack — we do not store card details

2. Lawful Basis for Processing

We process your information on the following lawful grounds under POPIA:

• Contract: processing necessary to provide the budget analysis service
• Consent: for marketing communications (you may withdraw at any time)
• Legitimate interest: improving service quality and security

3. How We Use Your Information

• Providing AI-powered budget analysis and spending insights
• Storing your budget goals and preferences
• Processing subscription billing via Paystack
• Communicating important service updates

4. Data Security

• AES-256-GCM encryption for all financial data at rest
• TLS/HTTPS for all data in transit
• Secure cloud infrastructure (Supabase, hosted in EU)
• Access controls: only you can access your data

5. Your POPIA Rights

You have the right to:

• Access your personal information
• Correct inaccurate information
• Delete your account and all associated data (see Settings)
• Object to processing for direct marketing
• Lodge a complaint with the Information Regulator

To exercise any right, email: privacy@trackspend.co.za

6. International Data Transfers

Some service providers process data outside South Africa:

• OpenAI (USA) — AI analysis of your statement text
• Supabase (EU) — encrypted database storage

The United States (where OpenAI operates) does not have an adequacy finding under POPIA. We transfer data to OpenAI on the basis of your explicit consent, given when you create your account (POPIA Section 72(1)(a)). You may withdraw consent at any time by deleting your account in Settings, which permanently removes all your data. The European Union, where Supabase operates, is recognised as providing adequate protection equivalent to POPIA.

7. Data Retention

We retain your data only as long as you have an active account. When you delete your account, all personal data is permanently and immediately removed. See Settings to delete your account.

8. Security Breach Notification

In the event of a security compromise involving your personal information, we will notify you and the Information Regulator of South Africa as soon as reasonably possible after becoming aware of the breach, as required by section 22 of POPIA. Notification will include: a description of the compromise, the possible consequences, the measures we have taken or propose to take, and contact details for further information. You may contact us at privacy@trackspend.co.za if you have concerns about the security of your data.

9. Information Regulator

If you're not satisfied with how we handle your data, you may lodge a complaint with the Information Regulator of South Africa:

• Website: inforegulator.org.za
• Email: inforegulator@justice.gov.za

10. Contact

Our Information Officer is Kaylin Klein of Sikelela Tech (Pty) Ltd, registered with the Information Regulator of South Africa (Registration No. 2026-062072).

Information Officer: privacy@trackspend.co.za