Privacy Policy

Last updated: 2026-10-12

This Privacy Policy describes how Spenza ("Spenza", "we", "us", or "our") collects, uses, stores, and protects information when you use the Spenza mobile application and related services.

Contact

For privacy questions, support, or data requests, contact:

• Support: z1esco@s-penza.app
• Security: z1esco@s-penza.app

What Spenza Does

Spenza helps users track spending, manage budgets, scan receipts, receive notifications, export reports, and view spending insights. Spenza is not a bank, payment institution, investment adviser, tax adviser, or credit provider.

Information We Collect

Account Information

We collect information needed to create and operate your account, including:

• Email address
• Display name
• Avatar or profile photo, if provided
• Authentication identifiers from Supabase Auth or Google OAuth
• Workspace and membership identifiers

Financial and App Content

We collect the financial information you add to Spenza, including:

• Expenses
• Merchants
• Categories
• Budgets
• Notes
• Dates
• Payment method labels
• Exported report metadata
• CSV import data, if you use CSV import

Spenza does not ask for bank login credentials and does not store full payment card numbers.

Receipt OCR Information

If you use receipt scanning, Spenza may process receipt images and recognized text to extract merchant, amount, date, time, currency, and category suggestions.

Receipt images, PDFs and supplied text are sent through authenticated Supabase Edge Functions to OpenAI GPT for cloud OCR and extraction. Bank statements use the same cloud extraction path. AI Insights send spending summaries, category and merchant totals, and budget information through Supabase to Google Gemini. Financial Coach sends your question, conversation history and supplied financial context, which can include recent expenses and budgets, through Supabase to Google Gemini. Provider API keys remain on the backend and are never included in the app. Extracted receipt data is shown to you for review before an expense is created. Spenza does not auto-save OCR results without your confirmation. Spenza has implemented server-side Claude (Anthropic) support in its Financial Coach for conversational spending analysis, budgeting guidance, transaction understanding and Malaysian financial-data reasoning, including MYR transactions and mixed Malay-English questions. Claude support is implemented server-side but is not yet active in production.

Google OAuth Information

If you choose Google sign-in, we may receive information allowed by your Google account permission screen, such as your email address, name, profile image, and Google account identifier. We use this only for account login, account management, and security.

Notifications and FCM

If you enable notifications, Spenza may collect and store:

• Firebase Cloud Messaging device token
• Device platform and app version
• Notification permission status
• Notification preferences
• Token sync timestamps

This data is used to send budget alerts, reminders, monthly summaries, and other app notifications that you allow.

Subscription and Billing Information

Spenza Premium is Coming Soon. Paid subscriptions, Google Play Billing, purchase restoration, renewals and cancellations are not currently available. Personal recurring-expense tracking remains available and does not purchase or cancel subscriptions with third-party services. If paid subscriptions become available, Spenza may store the following information for purchase verification and access management:

• Subscription plan and status
• Product identifier
• Purchase token or receipt verification data
• Order identifier
• Renewal or period end metadata

If Google Play Billing is offered in a future release, Google Play would process payment details. Spenza does not store full card numbers.

Analytics and Diagnostics

Spenza and its hosting providers process technical information needed to operate and secure the service, such as request and error information.

The current mobile app does not send product analytics events to an external analytics provider. Technical service logs may be processed to operate the service, diagnose errors and protect accounts. Receipt and bank-statement contents are processed for the capture and AI features described above.

How We Use Information

We use information to:

• Provide account login and session management
• Store and show your expenses, categories, budgets, and analytics
• Generate dashboards, reports, and spending insights
• Process receipt OCR and CSV imports when requested
• Sync notification preferences and device tokens
• Enforce current feature access; verify paid subscriptions only if billing becomes available
• Provide support and respond to requests
• Detect abuse, protect accounts, and maintain service integrity
• Improve app reliability, performance, and product quality
• Comply with legal obligations

How We Share Information

We do not sell personal financial data.

We may share information with service providers that help operate Spenza, including:

• Supabase for authentication, database, storage, and Edge Functions
• OpenAI (GPT) for receipt and bank-statement extraction
• Google services for OAuth, Firebase Cloud Messaging and Gemini
• Billing providers for subscription processing only if paid billing becomes available
• Support or security tools used to respond to user requests

We may also disclose information if required by law, to protect Spenza or users, or in connection with a merger, acquisition, financing, or sale of assets.

Data Storage and Security

Spenza uses Supabase for authentication, database storage, file storage and server-side functions. Authentication, encrypted connections and workspace-scoped access controls help protect this information.

No method of transmission or storage is perfectly secure. Users should keep their account credentials safe and contact us immediately if they suspect unauthorized access.

Your Choices

You can:

• Update account profile information in the app where available
• Edit or delete expenses, categories, and budgets
• Disable notification permissions at the device level
• Change notification preferences in Spenza where available
• Export financial data using Spenza export features
• Request account or data deletion by contacting z1esco@s-penza.app
• Request access to or correction of your personal information by contacting z1esco@s-penza.app

Data Deletion Requests

To request deletion, email z1esco@s-penza.app with the subject:

Data Deletion Request - Spenza

We may ask you to verify account ownership before processing the request. Deletion may not remove records that we must retain for legal, billing, security, dispute, or compliance reasons.

Children

Spenza is not intended for children. Users should only use Spenza if they are legally able to create an account and manage their own financial information, or if they have appropriate parent or guardian consent where required by law.

International Processing

Spenza is based in Malaysia. Supabase, OpenAI and Google may process information outside Malaysia as part of providing their services. The information shared depends on the feature you choose to use, as described in this policy.

Data Retention

We keep account and financial information for as long as needed to provide the service and meet applicable legal, billing, security and dispute-handling obligations. You can delete records in the app or request account and data deletion. Any information retained after a deletion request is limited to those purposes.

Changes to This Policy

We may update this Privacy Policy as Spenza changes. We will communicate material changes through the app, website, store listing, or email where appropriate.