Infinite Minds Limited ("Infinite Minds Limited", "we", "us", or "our") operates the BudgetBuddy mobile application (the "App", or the "Service"). This Privacy Policy explains what personal information we collect, how we use and protect it, who we share it with, and the choices and rights you have. By creating an account or otherwise using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, you must not use the Service.
This Policy is written to comply with the New Zealand Privacy Act 2020, including the Information Privacy Principles ("IPPs") it sets out. If you access the Service from outside New Zealand, you consent to your information being collected, stored, and processed in New Zealand and in the other countries described in Section 8 (International Data Transfers).
We collect the following categories of information:
(a) Account information — the email address and password (stored by our authentication provider in hashed form, never in plain text) you use to register, and any display name you provide.
(b) Financial data you connect or enter — if you choose to link a bank account through Akahu Limited ("Akahu"), we receive transaction, account balance, and account-holder information from Akahu for the sole purpose of populating and categorising your budget. If you add transactions manually, upload a receipt photo for automatic categorisation, or set budgets and savings goals, we store that data against your account. Receipt photos are processed to extract data and are not permanently stored after processing.
(c) Profile and preference data — the country and currency you select, notification preferences, appearance settings, and any custom categories or categorisation rules you create.
(d) AI assistant ("Buddy") interactions — if you are eligible for and enable the Buddy chat feature, the questions you ask and a privacy-minimised summary of your financial data (never your raw, itemised transaction list) are sent to our AI provider, Anthropic, to generate a response. Your chat history with Buddy is stored against your account until you clear it or delete your account. You may disable this feature at any time in Settings.
(e) Device and diagnostic information — each time you sign in, we record your device's operating system name and version, device model, the app version you are running, and (from your profile) your selected country. This is collected solely for the purposes described in Section 4(e) below (security, fraud/abuse prevention, and diagnosing bugs) and is never used to serve you advertising or to build a marketing profile.
(f) Support communications — if you contact us via the in-app Feedback form or by email, we collect the content of your message and your account email so we can respond.
(g) Usage data collected automatically — technical logs (such as error logs and API request metadata) generated by our backend infrastructure in the ordinary course of operating the Service.
We do not knowingly collect any special category of information (such as health, religious, or biometric data) beyond the optional Face ID/biometric app-lock toggle, which authenticates locally on your device and is never transmitted to us.
We collect information (i) directly from you, when you register, enter data, or contact us; (ii) automatically, through your use of the App and our backend systems; and (iii) from third parties you authorise us to receive data from, principally Akahu when you connect a bank account.
We use the information described above only for the following purposes:
(a) To provide, operate, and maintain the Service, including calculating budgets, categorising transactions, generating your financial health score, and syncing data across your sessions.
(b) To operate paid subscription tiers, enforce the feature and usage limits associated with your tier, and process any future in-app purchases.
(c) To operate the optional Buddy AI assistant, as described in Section 2(d).
(d) To communicate with you about your account, respond to support requests, and — where you have opted in — send budget threshold, large-transaction, low-balance, or weekly-digest notifications.
(e) To protect the security and integrity of the Service, investigate suspected fraud, abuse, unauthorised access, or violations of our Terms and Conditions, and to diagnose and fix technical issues, using the device/diagnostic information described in Section 2(e).
(f) To comply with our legal obligations, resolve disputes, and enforce our agreements.
We do not sell your personal information. We do not use your financial data to serve you third-party advertising.
Where required, we rely on your consent (given when you register, connect a bank account, or enable a feature such as Buddy), the necessity of processing to perform our contract with you (these Terms), and our legitimate interests in operating, securing, and improving the Service, balanced against your privacy rights. You may withdraw consent for optional features (such as Buddy or bank connection) at any time; doing so will disable the relevant feature but will not affect the lawfulness of processing carried out before withdrawal.
We share the minimum information necessary with the following categories of service providers, each of which processes your information under its own privacy policy and terms, which we encourage you to review:
(a) Akahu Limited — provides bank-account connection and transaction-syncing infrastructure (available for New Zealand-based accounts only). Akahu operates under its own consent framework; you separately authorise Akahu (and, through it, your bank) to share your account data with us.
(b) Anthropic, PBC — provides the large-language-model infrastructure behind the optional Buddy assistant. Only users on our Elite subscription tier who have Buddy enabled have any data sent to Anthropic, and only a privacy-minimised summary is sent, never your raw transaction list.
(c) Supabase, Inc. — provides our database, authentication, and file-storage infrastructure. All data described in Section 2 is stored on Supabase's infrastructure.
(d) Email delivery providers — used solely to send transactional emails (e.g. password resets, feedback acknowledgements).
We do not permit any third-party service provider to use your information for their own independent marketing purposes. Each provider is contractually or contextually restricted to processing your information solely to provide services to us.
We may also disclose information where required by law, in response to a valid legal process (such as a court order or search warrant), or where necessary to protect the rights, property, or safety of Infinite Minds Limited, our users, or the public, including to investigate suspected fraud or misuse of the Service.
We implement industry-standard technical and organisational measures to protect your information, including encryption of data in transit (TLS) and at rest, row-level database access controls scoped to your individual account, hashed password storage, and rate-limiting on sensitive endpoints. No method of electronic transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for using a strong, unique password.
If we become aware of a data breach that poses a real risk of serious harm, we will notify affected users and the New Zealand Office of the Privacy Commissioner in accordance with the Privacy Act 2020's mandatory breach-reporting obligations.
Our service providers (including Supabase and Anthropic) may store or process data on servers located outside New Zealand, including in the United States and other jurisdictions. Where we transfer personal information overseas, we take reasonable steps to ensure the overseas recipient is subject to privacy protections comparable to those in the Privacy Act 2020, including by relying on providers that maintain internationally recognised security and privacy certifications and contractual safeguards.
We retain your personal information for as long as your account remains active, and for a reasonable period afterwards to comply with legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements. When you delete your account (available at any time in Settings), we permanently delete your profile, transactions, budgets, savings goals, categorisation rules, Buddy chat history, and connected-account data from our production systems, other than information we are legally required to retain (such as records needed to demonstrate compliance with applicable law) and residual copies in encrypted backups, which are purged on a rolling schedule.
Under the Privacy Act 2020, you have the right to:
(a) Access the personal information we hold about you (available at any time via the "Export transactions" feature in Settings, or by contacting us for a full account export);
(b) Request correction of information you believe is inaccurate, incomplete, or out of date (most fields are directly editable in the App);
(c) Request deletion of your account and associated personal information, as described in Section 9;
(d) Withdraw consent to optional processing (such as bank connection or Buddy) at any time; and
(e) Make a complaint about how we have handled your personal information.
To exercise any of these rights, contact us at info@infiniteminds.app. We will respond within the timeframes required by the Privacy Act 2020. If you are not satisfied with our response, you have the right to make a complaint to the Office of the Privacy Commissioner at privacy.org.nz.
The Service uses automated logic to categorise transactions, calculate your financial health score, generate budgeting tips, and — where enabled — power the Buddy chat assistant. These features are provided for general informational and organisational purposes only. They do not constitute, and must not be relied upon as, financial, investment, tax, legal, or professional advice. AI-generated responses may be incomplete, outdated, or incorrect. You should independently verify any information before acting on it and consult a qualified professional for advice specific to your circumstances.
The Service is not directed at, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have inadvertently collected personal information from a person under 18, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at info@infiniteminds.app.
The App does not use browser cookies. We do not currently use third-party advertising or analytics SDKs that track you across other apps or websites. If this changes, we will update this Policy and, where required by law, seek your consent before enabling such tracking.
We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or legal requirements. We will post the updated Policy in the App with a revised "Last updated" date, and where a change is material, we will provide additional notice (such as an in-app notification) before it takes effect. Your continued use of the Service after a change takes effect constitutes acceptance of the revised Policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us at:
Infinite Minds Limited
Email: info@infiniteminds.app