Privacy Policy

1. Who we are

WizeSpend ("we", "us") operates the personal finance service at wizespend.co.za for users in South Africa. We are the responsible party for personal information processed through the service, as contemplated by the Protection of Personal Information Act, 2013 (POPIA).

Privacy queries: privacy@wizespend.co.za.

2. What we collect

Account information: your name, email address, and password (stored only as a salted hash).

Financial information you choose to upload: bank statements (PDF/CSV) and the transactions, balances and account numbers they contain, plus the budgets, goals, assets and categorizations you create.

Technical information: authentication tokens and basic request logs needed to run and secure the service.

We never ask for, receive, or store your online banking username or password. Statements are supplied by you.

3. Why we process it

To provide the service: importing and categorizing your transactions, computing budgets, goals, and insights, and sending service emails such as verification codes and the check-in digest you can disable in Settings.

We do not sell personal information. We do not share it with third parties for their marketing.

4. Where it is stored

Data is hosted with reputable cloud providers (application and database on Railway; email delivery via Resend). Traffic is encrypted in transit with TLS. Some infrastructure is located outside South Africa; by using the service you consent to that cross-border processing under section 72 of POPIA, applied with equivalent protection.

5. Your rights

Under POPIA you may request access to, correction of, or deletion of your personal information, and you may object to processing. Deleting your account removes your transactions, statements, budgets and goals from the live system.

To exercise any of these rights, email privacy@wizespend.co.za. You may also lodge a complaint with the Information Regulator (South Africa).

6. Retention & security

We keep your data only while your account exists or as required by law. Uploaded statement files are parsed and then removed from temporary storage; extracted transactions remain in your account until you delete them.

Access to production systems is restricted; passwords are hashed; email verification gates new accounts.

7. Changes

We will update this policy as the service evolves and note the effective date below. Material changes will be announced in-app or by email.