Privacy Policy

Wrightly (“Wrightly”, “we”, “us”, “our”) is record-keeping and bookkeeping software for sole traders and small businesses. For how the service itself works, see our Terms of Service. Wrightly is operated by Wrightly Limited, a New Zealand limited company (NZBN 9429053844743). We hold ourselves to the New Zealand Privacy Act 2020 as our baseline standard for every customer; under that Act our Privacy Officer is Philip Roigard (contact details in section 09).

• Account information: the email you sign in with, and the organisations and members you set up. Sign-in is magic-link or one-time-code, so we do not store a password.
• Your business and financial data: receipts, invoices and quotes, expenses, mileage, clients, capital assets, bank line items and, where enabled, tax figures derived from them. This may include personal information about your own clients, which you are responsible for having the right to give us.
• Bank account information (New Zealand customers only, via Akahu): read-only account details and transactions for the accounts you choose to share. We never receive your internet banking login. See section 5.
• Uploaded files: receipt images and other documents you add.
• Usage and technical data: basic request logs, device and browser information, and errors, used to run and secure the service.
• Billing information: if you subscribe to Wrightly Plus, Stripe handles payment; we receive subscription status, not your card details.

We use it to provide, maintain and secure the service and your account; to store your records and produce your books, reports and, where enabled, tax figures; to run the AI features on Wrightly Plus; to take payment and send you service email; and to meet our legal obligations. We do not sell your personal information, advertise to you with your business data, or use your data to train AI models.

These providers act as our processors, using your information only to provide their service to us:

• Cloudflare: hosting, our application platform, and receipt/document storage (R2), email routing, and security-access monitoring.
• Supabase: our database and sign-in.
• Stripe: subscription billing and card payments on invoices you send.
• Resend: transactional and service email.
• Akahu (New Zealand customers only): the open finance platform that holds your bank connection, if you have one.
• Sentry: error monitoring on technical failures, not the contents of your documents. It processes data in the United States.
• Cloudflare Workers AI: on Wrightly Plus, processes documents and statements you submit to extract and categorise figures. Not retained after the request, and not used to train any model.

Your database and account records are hosted in Australia. Stripe, Resend and Sentry process data in the United States, and Cloudflare serves files from its global network. Where information is processed outside the country you are in, we rely on our providers’ contractual data-protection commitments to keep it protected to a standard comparable with the New Zealand Privacy Act 2020.

This section applies if you are a New Zealand customer; live bank feeds are not yet available elsewhere. Bank connections are part of Wrightly Plus, set up through Akahu: you sign in with your bank there and choose which accounts to share. We hold no payment permission of any kind, so Wrightly cannot move money or change anything at your bank. The access token is encrypted and used only by our server. Disconnect any time on the Connections page in Wrightly, or at my.akahu.nz; transactions already imported stay in your books afterward, because they are your accounting records. For the full picture, see our bank connections page.

Essential cookies keep you signed in; the service does not work without them. We also use Google Analytics to see how people use wrightly.app; it never receives your name, email or business records. Visitors outside New Zealand are asked before it runs at all; in New Zealand it runs by default. Either way, you can change your answer below.

We keep your information while your account is active. Your account is always yours to delete: you can do it yourself in the app at any time, and we do not hold it for a waiting period first. We do not keep your financial records for seven years on your behalf. That seven-year record-keeping duty under the Tax Administration Act 1994 is yours, not ours, so export your own copies first. We keep limited security and access logs for a bounded period, for fraud prevention and to meet our legal obligations, even after deletion.

You can ask for access to the personal information we hold about you, ask us to correct it, export your data, or delete your account and data, any time, from the app. Deletion is immediate and permanent: we remove your financial records and uploaded files, and remove or anonymise what our processors hold for you, other than the bounded logs described above. An organisation you share with other people is only deleted if you say so explicitly; otherwise your access to it is removed and its records stay with its owner. Email our Privacy Officer to make a request; we will respond within 20 working days, the Privacy Act’s standard, wherever you are.

We encrypt your data in transit and at rest, isolate each organisation’s data at the database level, and log access to production systems and stored files. If a breach occurs that is likely to cause serious harm, we will notify affected people and the Office of the Privacy Commissioner as required by the Privacy Act 2020. Wrightly is intended for people 18 and over; we do not knowingly collect information from children.

For any privacy question or request, or to reach our Privacy Officer, Philip Roigard, email privacy@wrightly.app. If you are not satisfied with our response, contact the Office of the Privacy Commissioner at privacy.org.nz, or your own data-protection authority if you have one.