The short version
- Korin reads your bank data through Akahu. It's read-only: Korin never sees your bank login and can't move money.
- We use your data to run Korin for you. We don't sell it to advertisers.
- To see whether our own ads work, we tell Meta and TikTok when someone signs up or connects a bank, with a scrambled copy of their email. They never get your financial data.
- Korin's own calculations produce the numbers. AI helps understand your questions, word the answers and sort transactions, and some of that happens outside New Zealand.
- Korin only sends your data to tools like Google Sheets or YNAB if you connect them, and you can stop it any time.
- You can disconnect a bank or delete everything at any time.
- Questions? Email hello@korin.nz.
This summary is for convenience. The full notice below is what applies.
1. Who we are
Korin is run by Kelson Labs Limited ("Korin", "we", "us"), a New Zealand company. This notice explains how we collect, use, store and protect your personal information, including the financial data we get through Akahu.
Privacy contact: hello@korin.nz
2. What we collect
From your bank, through Akahu, with your ongoing permission
- Account details: account name, type, number (as the bank formats it) and status.
- Account balances.
- Transactions: amounts, dates, descriptions, merchant details and categories.
- Pending transactions.
This is read-only. Korin never sees your internet-banking login, and it can't make payments, move or transfer money, or change anything at your bank.
About you
- Your email address, which you use to sign in (no password).
- Your display name, if you give one.
- Your phone number, if you link WhatsApp for notifications and service messages.
From using Korin
- Messages you send to Korin, and Korin's replies, on the web and WhatsApp.
- Your settings, goals and alert preferences.
- Technical and audit details, such as the type and time of an event, a request ID, and your IP address where we record it for security and audit events.
3. How we use it
- To run Korin for you: showing where your money goes, finding regular costs, working out what's safe to spend, and warning you before problems hit.
- To send the notifications you turn on, such as alerts and summaries.
- To keep the tools you connect, such as Google Sheets or YNAB, up to date (see section 7).
- To sign you in.
- To keep the service secure, including security and audit records.
- To measure whether Korin's own ads on Facebook and Instagram work (see section 11).
- To help you when you contact support.
- To meet our legal obligations.
We don't sell your personal or financial data to advertisers.
4. How your bank connects
Korin gets your financial data through Akahu, New Zealand's open-finance platform, under an ongoing consent you give. Akahu securely sends your account and transaction data to Korin.
This notice covers what Korin does with that data. Akahu's own Privacy Notice and End User Terms cover what Akahu does with it. Akahu is an independent company and doesn't endorse, guarantee or check Korin.
5. How Korin uses AI
- The numbers you see, such as balances, totals and what's safe to spend, are worked out by Korin's own fixed calculations and checked against your actual data. AI doesn't make them up; it helps understand your question and explain the result.
- Text that comes from your bank, such as transaction descriptions, is treated as untrusted and cleaned before it goes to an AI service.
- When you ask a question, Korin sends only what's relevant to it. That can include transaction details, account names, balances, dates, categories and your question.
- When Korin can't categorise a transaction any other way, it sends the merchant name and description to an AI service to suggest a category. Card numbers and long reference numbers are removed first, and your name, email and account details aren't sent with it.
- AI processing may happen outside New Zealand.
6. Who else handles your data
A small number of companies help us run Korin: the connection to your bank, AI, hosting, WhatsApp and email, card payments, Google sign-in and measuring our ads. They handle information on our behalf.
See the full list
| Provider | What for | Where (mainly) |
|---|---|---|
| Akahu | Connects Korin to your bank. | New Zealand |
| Anthropic, OpenAI | AI that helps answer your questions and sort transactions. | United States |
| Railway, Vercel | Hosting for Korin's app, website and database. | United States / global |
| Twilio, Meta, Resend | WhatsApp messages and email. | United States |
| Stripe | Subscription payments. Korin never stores your full card details. | United States |
| Sign-in, only if you choose Google sign-in. | United States | |
| Meta (Facebook, Instagram), TikTok | Measuring Korin's own ads: sign-up and bank-connected events with a coded (hashed) email. Never financial data. | United States, Singapore, Malaysia |
Some of them handle information outside New Zealand. When that happens, we take reasonable steps to make sure your information is protected in a way that's consistent with the Privacy Act 2020.
We update this list before adding or changing a provider in a way that materially changes how your data is handled.
7. Tools you connect
On the Integrations page you can choose to connect tools you already use. Korin only sends data to a tool after you connect it there, sign in to that tool and approve access.
| Tool | What Korin sends |
|---|---|
| Google Sheets | Transactions, accounts, balances, regular payments, budgets and goals, to a spreadsheet in your Google Drive. |
| Notion | Transactions and accounts, to the Notion page you pick. |
| Airtable | Transactions and accounts, to the Airtable base you pick. |
| YNAB | Transactions, to your YNAB budget. |
- Transactions include the date, amount, description, merchant, category and account name. Accounts include the account name, type, bank and account number.
- Once data is in that tool, the tool's own privacy terms cover it. These companies are mainly based in the United States.
- The access you approve is stored encrypted (AES-256-GCM), and Korin only uses it to send your data there.
- You can disconnect a tool on the Integrations page at any time. Korin stops sending data, revokes its access where the tool allows it, and deletes the access it stored. Data already sent stays in the tool; you can delete it there.
8. How we protect it
- Data is encrypted in transit (HTTPS/TLS).
- Bank access tokens are encrypted when stored (AES-256-GCM).
- You must be signed in, and each person can only reach their own data.
- Sensitive details are removed from our system logs.
- Each bank-connection link works once and expires quickly.
- Messages from Akahu and Stripe are only accepted if they are signed correctly.
- Error messages don't reveal internal details.
No system is perfectly secure.
9. How long we keep it
| When | What happens to your data |
|---|---|
| Your account is active and connected | We keep account and transaction data while it's needed to run Korin. |
| You disconnect a bank, or revoke access through Akahu | Korin revokes or stops its Akahu access and stops fetching new data for that connection. Stored transactions are kept for up to 90 days in case you reconnect, then permanently deleted unless you reconnect first. |
| You remove a single account | That account is left out of Korin's insights. Its stored transactions are kept for up to 90 days, then permanently deleted unless you reconnect it first. |
| You delete your Korin account | Korin revokes all bank access and permanently deletes the personal data it holds: accounts, transactions, goals, settings, conversation history, memories, alerts, sessions, and in-product audit events linked to your account. |
What deleting your account doesn't remove
- Coded references to records held by our providers (one-way codes, not the real IDs), kept for a set period and then removed automatically.
- Support or complaint records, which may stay on file with access through the public support portal turned off.
- Billing-event and webhook processing records.
- Records Stripe holds as our payment processor. Your Stripe customer record is anonymised, not deleted.
- Infrastructure logs kept outside Korin's application database.
- Data already sent to tools you connected, such as Google Sheets. Korin disconnects them, but you delete that data in the tool itself.
- Ad-measurement events already sent to Meta or TikTok (see section 11). They keep them under their own policies.
- A minimal, de-identified record that a deletion happened.
10. Your choices and rights
Disconnect a bank
You can disconnect a bank in Korin. Korin revokes the Akahu access for it and stops reading that connection. One Akahu authorisation can cover several accounts; when it does, Korin disconnects them together, because a single account can't always be revoked on its own.
You can also revoke access directly through Akahu. Korin then stops accessing that connection. If a connection stops working, Korin may ask you to reconnect it.
Delete everything
You can permanently delete your account from the Privacy page in Korin ("Delete everything"). Your account is switched off straight away, and the data Korin holds is removed in the background. This can't be undone. Section 9 explains what is and isn't removed.
See or correct your information
Under the Privacy Act 2020, you can ask to see or correct the personal information Korin holds about you. Email hello@korin.nz.
Marketing
We only send marketing if you've opted in, and you can opt out at any time. Service and security messages aren't marketing; that includes login codes and the financial alerts you turn on.
Complaints
If you have a privacy concern, please contact us first at hello@korin.nz. If you're not happy with our response, you can complain to the Office of the Privacy Commissioner.
12. Children
Korin isn't meant for anyone under 18, and we don't knowingly collect personal information from children.
13. Changes to this notice
We may update this notice. We'll tell you about material changes and, where appropriate, may ask you to accept the updated notice.
14. Contact us
Kelson Labs Limited, New Zealand. For any privacy question, email hello@korin.nz.