Privacy Notice

Korin is operated by Kelson Labs Limited ("Korin", "we", "us"), a New Zealand company.

This notice explains how Korin collects, uses, stores, and protects personal information, including financial data accessed through Akahu.

Korin accesses this data read-only. Korin does not access your internet-banking login credentials and cannot initiate payments, move money, transfer funds, or change anything at your bank.

• To provide cashflow clarity, recurring-cost detection, safe-to-spend context, and proactive alerts.
• To send notifications you enable, including alerts and summaries.
• To authenticate you.
• To protect the service and maintain security and audit records.
• To provide customer support.
• To meet legal obligations.

Korin does not sell your personal or financial data to advertisers.

Korin accesses your financial data through Akahu, New Zealand's open finance platform, under an enduring consent you grant. Akahu securely transmits your bank account and transaction data to Korin.

Korin's use of the data is governed by this Privacy Notice. Akahu's handling of the data is governed by Akahu's Privacy Notice and End User Terms. Akahu is an independent third party and does not endorse, guarantee, or verify Korin.

• Financial calculations are produced by Korin's deterministic financial logic. AI helps interpret your questions and present results.
• Key financial amounts are calculated by Korin's financial engine and validated against structured evidence.
• Bank-sourced text, including transaction descriptions, is treated as untrusted data and sanitised before being sent to an AI service.
• Korin sends only financial context relevant to the question. Relevant context can include transaction details, account names, balances, dates, categories, and your question.
• AI processing may occur outside New Zealand.

Korin uses the following providers to operate the service. They process information on Korin's behalf or provide a necessary connection layer.

Korin updates this list before adding or changing a sub-processor in a way that materially affects how consumer data is handled.

Some service providers process information outside New Zealand. Where this occurs, Korin takes reasonable steps to ensure personal information is protected in a manner consistent with the Privacy Act 2020.

• HTTPS/TLS encryption in transit.
• AES-256-GCM encryption of bank access tokens at rest.
• Authentication and user-scoped access controls.
• Redaction of sensitive fields in structured logs.
• Single-use, time-limited OAuth state for bank connections.
• Signature verification for Akahu and Stripe webhooks.
• Production error handling designed to avoid exposing internal exception details to consumers.

No system is perfectly secure.

While your account is active and connected, Korin retains account and transaction data while needed to operate the service.

You can disconnect a bank connection from Korin. Korin revokes the associated Akahu access and stops reading the affected connection.

Some Akahu authorisations can cover multiple accounts. Where that is the case, Korin disconnects at the authorisation boundary rather than implying that a single bank account can always be independently revoked.

You may also revoke access directly through Akahu. Korin handles external revocation and stops accessing the affected connection. If a connection becomes inactive, Korin can prompt you to reconnect.

You can request permanent account deletion from the Settings or Permissions area in Korin. Deletion is irreversible.

Under the Privacy Act 2020, you may request access to or correction of personal information Korin holds about you. Contact hello@korin.nz.

If you have a privacy concern, contact us first at hello@korin.nz. If you are not satisfied, you may complain to the Office of the Privacy Commissioner.

Korin uses a first-party session cookie to keep you signed in. Korin stores the light/dark theme preference in browser local storage. Korin does not use advertising or third-party tracking cookies.

Marketing communications are sent only where you have opted in. You can opt out. Service and security messages are not marketing. Login codes and consumer-enabled financial alerts are service messages.

Korin is not intended for people under 18 and Korin does not knowingly collect personal information from children.

Korin may update this Privacy Notice. Material changes will be communicated to consumers and, where appropriate, Korin may ask consumers to re-accept the updated notice.

For privacy questions, contact hello@korin.nz.