Privacy Policy

Spendula is a personal-finance application that helps people import, organise and analyse their financial transactions. It lets you upload transaction files, categorise spending, set budgets, track reimbursements and mark transactions for later tax review.

This policy explains what information Spendula collects, how it is used and the choices you have. Spendula is operated by Spendula (Replace with Spendula Pty Ltd once registered) in Australia.

Depending on how you use Spendula, we may collect:

• Your name and email address
• Authentication information used to sign you in and keep you signed in
• Google account profile information (such as name, email and profile image) when you use Google sign-in
• Account names and account settings you create in the app
• Currency preferences
• Transaction information from CSV files you upload
• Transaction dates, descriptions, merchants, categories and amounts
• Budgets you create
• Reimbursement records and their linked transactions
• Tax Ready records and related notes
• Merchant rules you define
• Recurring-bill information detected or confirmed in the app
• Notes you enter against transactions
• Receipts or attachments, if and when that feature is available to you
• Technical information such as browser type, device information, IP address, server logs and error data
• Usage and analytics information, only if analytics is enabled for the service

Spendula does not connect directly to your bank. Transaction data reaches Spendula only through files you upload or entries you create, unless a bank-connection feature is introduced in the future and you choose to use it.

• Directly from you, when you create an account or enter information
• From CSV files you upload
• From your actions in the application, such as editing categories or creating budgets
• Through Google authentication, if you sign in with Google
• Automatically, through security logs, error reporting and (where enabled) analytics tools
• Through AI categorisation and transaction-processing features that operate on the transactions you import

• Create and manage your account
• Import and display your transactions
• Categorise transactions
• Detect potential duplicate transactions
• Calculate budgets and spending insights
• Track reimbursements
• Organise Tax Ready transactions
• Detect recurring bills
• Improve and maintain the application
• Provide customer support
• Maintain security and prevent misuse
• Comply with legal obligations

• Transaction descriptions and the limited context needed for categorisation may be sent to a third-party artificial intelligence service.
• Only the information required for the categorisation task is sent.
• AI output may be inaccurate or incomplete.
• You can review and correct any categorisation at any time.
• Merchant rules you create take priority over AI categorisation.
• Spendula does not treat AI output as financial, legal or tax advice.

Spendula may use third-party artificial intelligence service providers to categorise transactions and generate financial insights. The AI provider currently configured is OpenAI.

Spendula relies on third-party providers for functions such as hosting, database storage, authentication, AI categorisation, analytics, error monitoring and email delivery. Providers used may include:

• Vercel — application hosting
• Lovable Cloud / Supabase infrastructure — database, authentication and storage
• Google OAuth — optional Google sign-in
• An AI service provider for transaction categorisation — OpenAI

Providers are used only for the purposes described in this policy.

• To service providers that help operate Spendula, limited to what they need
• Where required or authorised by law
• Where reasonably necessary to protect you, Spendula or others
• In connection with a business transfer, such as a merger or acquisition
• With your consent

Spendula does not sell your personal information.

Some service providers may process or store information outside Australia. Based on the providers listed above, this may include Your information may be processed in countries where our trusted service providers operate, including the United States and other jurisdictions supporting our hosting, authentication and AI infrastructure. . We take reasonable steps to use providers that apply appropriate protections to personal information.

We retain your information while your account remains active and for a reasonable period afterwards where required for legal, operational, backup and security purposes. Users may request deletion of their account and personal data.

You can delete individual transactions, import batches and account data from within the app. When an account is deleted, associated records are removed from the live application. Encrypted backups may continue to hold copies for a limited period before being overwritten in the ordinary backup cycle.

We take reasonable steps to protect your information, including:

• Encrypted HTTPS connections
• Authentication controls for account access
• Database access controls, including row-level security so users can only read their own records
• Restricted access to server-side secrets and API keys
• Monitoring, error reporting and backups

No online service can be completely secure, and we cannot guarantee absolute security of information transmitted to or stored in Spendula.

• Access the information held in your account by signing in and viewing your transactions, budgets and settings
• Correct information by editing transactions, categories, merchant rules, budgets and account settings
• Delete individual transactions, selected transactions in bulk, import batches or all transactions for an account
• Export information from the app where an export option is available
• Withdraw optional consent, such as by discontinuing use of optional features
• Request deletion of your account and remaining personal information by contacting us at privacy@spendula.com

Spendula uses essential browser storage only. Your sign-in session is stored in your browser's local storage so you stay signed in, and session storage is used to remember small interface preferences such as dashboard view settings.

Spendula does not currently use advertising cookies. Analytics is described in this policy only so that it is covered if it is enabled in future; if it is enabled, this policy will be updated.

Spendula is intended for users aged 16 years and over. We do not knowingly collect personal information from anyone below that age. If you believe a child has provided information to us, please contact us so we can remove it.

• Spendula is an organisational and informational tool.
• Spendula does not provide financial, legal, accounting or tax advice.
• Spendula does not determine whether an expense is legally tax deductible.
• Marking a transaction as Tax Ready simply flags it for your own later review.
• You should seek advice from a qualified professional before making financial or tax decisions.

If we suspect a data breach, we will investigate promptly, take steps to contain and remediate it, and notify affected users and relevant regulators where required by applicable law, including the Australian Notifiable Data Breaches scheme.

We may update this Privacy Policy from time to time. The revised policy takes effect when published on this page, and the "Last updated" date above will change to reflect it.

Spendula uses artificial intelligence to generate features that assist you, including:

• AI generated transaction categorisations
• AI generated recurring bill detection
• AI generated financial insights
• AI generated recommendations

These outputs are provided to assist you only. They are not guaranteed to be accurate, complete or up to date. You should always review important financial information before relying on it.

AI generated information does not constitute financial advice, accounting advice, tax advice, investment advice or legal advice. Spendula provides assistance only and does not advise you on any financial, legal, tax or investment matter.

Privacy contact: privacy@spendula.com

Operator: Spendula (Replace with Spendula Pty Ltd once registered)

Country: Australia

To make a privacy complaint, email the privacy contact above with details of your concern. We will acknowledge your complaint and aim to respond within a reasonable period. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.