Privacy Policy
This policy explains how SaveSavvy (Pty) Ltd ("SaveSavvy", "we") collects, uses, and protects your personal information, in line with the Protection of Personal Information Act, 2013 (POPIA).
1. Who we are
SaveSavvy (Pty) Ltd, registration no. 2026/392082/07, 17 Arthurs Road, Sea Point, Cape Town, Western Cape, 8005, is the responsible party. Information Officer: Adam Edelberg, privacy@savesavvy.co.za.
2. What we collect
- Account: your email address. You sign in with a magic link sent to that address, so we do not store a password for your account.
- Waitlist: if you join the waitlist on our website, the email address you give us.
- Financial documents: bank and investment statements you upload or forward by email, and the data extracted from them - transaction dates, descriptions, amounts, account names and types, and balances. Statements can include personal information about other people (such as payees or joint account holders); we process it only to show you your own transactions.
- App data you create: categories, budgets, and edits to transactions.
- Technical: IP address and request logs, kept for up to 30 days for security and debugging.
- Crash diagnostics: when the app crashes or errors, it sends Sentry the stack trace, your device model, OS and app version, and a short trail of screens visited and network requests made beforehand. We configure Sentry not to attach your IP address or account identifiers.
We do not use advertising or analytics SDKs, and we do not profile you or track you across other apps or websites. Sentry is the only third-party SDK in our app, used solely for crash reporting.
3. Why we process it, and on what basis
| Purpose | Lawful basis (POPIA) |
|---|---|
| Create and operate your account | Performance of our agreement with you |
| Parse statements and categorise transactions | Performance of our agreement; your consent when you submit a statement |
| Show spending, budgets, and insights | Performance of our agreement |
| Security, fraud prevention, debugging | Our legitimate interests |
| Tell you when SaveSavvy launches (waitlist) | Your consent - ask us to remove you at any time via privacy@savesavvy.co.za |
We do not sell your personal information.
4. Automated statement parsing (AI processors)
To read your statements we send the document text to a third-party AI service (Anthropic) which extracts the transactions. Anthropic processes the data only to return the result and, per its commercial terms, does not use it to train its models. If you are not comfortable with this, do not submit statements.
This parsing is automated. You can review and correct every extracted transaction in the app.
5. Who we share it with (operators)
We use these operators (processors) under contract:
| Operator | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, hosting | EU |
| Vultr | Application server hosting | EU |
| Mailgun | Inbound statement-import email | EU |
| Sentry | Crash and error reporting (mobile app) | EU |
| Anthropic | Statement parsing (AI) | USA |
6. Cross-border transfers
Your data is stored in the EU and, for statement parsing, processed by Anthropic in the USA. We transfer it under POPIA section 72 on the basis that the recipients are bound by contractual terms providing protection substantially similar to POPIA, and that the transfer is necessary to perform our agreement with you.
7. Security
Sensitive financial fields (such as transaction descriptions) are encrypted at rest. Access is restricted to your authenticated account; no endpoint serves another user's data. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information. If a data breach affects your personal information, we will notify you and the Information Regulator, as POPIA section 22 requires.
8. Retention
We keep your data while your account is active. When you delete your account we delete your personal data from our live systems promptly; residual copies in database backups are deleted automatically within 14 days, and sensitive financial fields remain encrypted inside those backups. Crash and error diagnostics held by Sentry are deleted automatically 90 days after we receive them. Waitlist email addresses are kept until launch, or until you ask us to remove you.
9. Your rights
Under POPIA you may: access your data; correct or delete it; object to processing; and complain to the Information Regulator. To exercise these, contact privacy@savesavvy.co.za.
Information Regulator (South Africa): inforeg@inforegulator.org.za, inforegulator.org.za
10. Deleting your account
You can delete your account and all associated financial data from within the app at any time. This is immediate and irreversible.
11. Children
SaveSavvy is not intended for anyone under 18. We do not knowingly collect data from children.
12. Changes
We may update this policy. Material changes will be notified in the app or by email. Continued use after the effective date means you accept the update.
13. Contact
SaveSavvy (Pty) Ltd, privacy@savesavvy.co.za.