Connecting your bank

Not us. The connection runs through Akahu, New Zealand's open banking provider. They are the ones your bank has a relationship with, and they are the ones who hold the consent.

You never type your bank login into KeaBudget. You sign in at your bank, or at Akahu, on their pages. Your username, password and one-time codes never pass through us, and we could not see them if we wanted to.

• Your account names, types and balances
• Your transactions: date, amount, description, merchant, and the category Akahu assigns

That is the whole list. Specifically, we do not receive:

• Your bank login, or any way to obtain it
• Your card numbers
• Anyone else's accounts, unless you connect them yourself

Read. That is all. It cannot move money, make a payment, set up a direct debit, or change anything at your bank. That is not a promise about how we behave, it is what the connection is technically limited to.

One thing: filling in your transactions so you do not have to type them, and keeping your balances current. That is the feature you are paying for.

We do not, and will not:

• Sell, lease or share your data with anyone
• Use it for advertising, or build a profile of you
• Use it for credit scoring or lending decisions, or pass it to anyone who does
• Read it ourselves, except where you ask us for support and we need to

• Akahu gives us an access token that stays valid until it is revoked, so we encrypt it (AES-256-GCM) before it ever reaches the database. A stolen copy of that database is not access to your bank
• Your data is encrypted in transit and at rest, in a database hosted in Australasia (currently Sydney)
• Two-step verification is required on every account, so a password leaked in someone else's breach is not enough to sign in as you

More detail on the full stack is on our security page.

There are three ways, and all of them work:

• In the app. Bank connections, then Disconnect. This revokes the token at Akahu first, so the sharing stops at source rather than just being hidden from you
• At Akahu. Withdraw consent directly with them
• At your bank. Most NZ banks list connected apps in their internet banking. Revoking there stops it too, and Akahu tells us, so we stop syncing

Disconnecting keeps the transactions already imported, so switching banks does not wipe a year of work. If you want those gone as well, "Delete imported data" is a separate button, and it does exactly that.

Your transactions stay while your account exists, because that history is the point of the app.

When you delete your account, we revoke your bank connection at Akahu first, then delete your transactions, accounts, categories, budgets, goals and your user record. Backups roll over within 30 days. You can delete your account yourself, from Account in the app, without emailing anyone.

Email hello@keabudget.co.nz. A real person reads it, and we aim to respond within 7 working days.

If your complaint is about the bank connection itself, Akahu has their own process and their own privacy notice. If you are not satisfied with how either of us handled your information, you can complain to the Office of the Privacy Commissioner, which is free and independent.