Privacy notice

Spendful is the responsible party for personal information processed through Spendful. Our address is South African physical address to be published before launch. The Information Officer can be contacted at privacy@spendful.com.

The legal entity name and South African physical address must be completed from the operator's company records before this service is offered to the public. This notice does not replace that required disclosure.

Spendful processes the profile details, preferences and financial records you choose to add to the service. Financial records can include accounts, transactions, categories, budgets, goals, debts, recurring items, tags and uploaded receipt information.

• Authentication and profile details connected to your account.
• Financial records entered manually or created from an imported statement.
• Preferences such as base currency, timezone, payday and notification settings.
• Support messages and technical details you provide when asking for help.

When you import a PDF, CSV or TXT bank statement, Spendful processes the file to identify accounts and transactions. The import flow is designed to create structured financial records from the statement; it does not require your online-banking username, password or one-time PIN.

Only upload files you are authorised to use. Review imported records before relying on them because statement formats and descriptions can vary by bank.

We process information only for specified, explicit and lawful purposes connected with the service, and we minimise collection to what those purposes require. Where consent is the appropriate basis, you may withdraw it without affecting processing already completed lawfully.

• Provide dashboards, budgets, analytics, forecasts and other requested features.
• Maintain account security, troubleshoot failures and prevent misuse.
• Process subscriptions and show billing status through the payment provider.
• Improve reliability and understand aggregate product usage without selling personal financial records.

Spendful relies on specialised providers for essential infrastructure. These providers process only the information required for their role and operate under their own terms and privacy commitments.

Some providers may process information outside South Africa. We use contractual, security and transfer safeguards appropriate to the information and applicable POPIA requirements, and we remain responsible for the processing we authorise.

• Clerk provides authentication and session management.
• Payfast processes subscription checkout, payment methods and billing records.
• Database and hosting providers store and serve application data.

Spendful uses essential browser storage for authentication, security, theme preferences, reporting-period choices and installable-app behaviour. Disabling essential storage may prevent sign-in or other core features from working.

Financial records are retained while your account remains active or for as long as needed to provide the service and meet applicable obligations. If the account has no dashboard activity for 30 days, Spendful sends a warning email and schedules deletion 30 days later. Signing in and opening the dashboard during that notice period automatically cancels the scheduled deletion.

Account deletion controls are also available in Settings. When deletion proceeds, the authentication identity and associated Spendful records are permanently removed. Some billing or security records may need to be retained for a limited period where the law requires it.

You can correct many records directly, export account data and request account deletion. Under POPIA, you may request access to, correction or deletion of personal information, object to processing in appropriate circumstances, and ask whether your information is being processed. Send requests to privacy@spendful.com; we may need to verify your identity and will respond within the period required by law.

You may complain to the Information Regulator of South Africa if you believe your personal information has been handled unlawfully: complaints@inforegulator.org.za or https://inforegulator.org.za.

We will not send electronic direct marketing where POPIA or the Electronic Communications and Transactions Act requires consent, and every permitted marketing message will identify the sender and provide an opt-out method. Spendful is not intended for children who cannot lawfully consent to processing; do not create an account on their behalf without lawful authority.

If a security compromise creates a risk to personal information, we will notify affected data subjects and the Information Regulator as required by POPIA.

Questions or privacy requests can be sent to privacy@spendful.com. This notice may change as the service evolves. Material changes will be reflected by the updated date and communicated in the product when appropriate.