Bank connections

Keeping books by hand means downloading statements, importing them, and sorting the rows. A bank connection removes that work. Connect your bank account, and we will automatically fetch your transactions: they land in Wrightly on their own, ready to be categorised, so your GST return and your income tax figures stay current all year instead of being rebuilt at deadline time.

Connecting is always your choice, and Wrightly works fine without it. If you would rather not connect an account, you can upload bank statements or enter transactions yourself and everything else works the same way.

Akahu is New Zealand’s open finance platform. We use Akahu to fetch transaction data from your connected bank account. Akahu is the secure bridge between your bank and Wrightly: you sign in with your bank through Akahu, not through us, and you pick which accounts to share.

Because Akahu holds the connection, you can review and manage every app you have connected, and withdraw your consent, from your own Akahu dashboard at my.akahu.nz.

The access is read-only and limited to the accounts you select when you connect. For those accounts we receive:

• Account details: the account name and type, the bank it is held at, the masked account number, and the balance.
• Transactions: the date, the amount, the description and reference, the merchant or payee where the bank supplies one, and the bank’s own identifier for the transaction.

We do not see or store your internet banking username, password or any other bank credential. Those are entered with your bank, through Akahu, and never reach Wrightly.

We ask for no payment permission of any kind. Wrightly cannot move money, make a payment, or change anything at your bank. The connection only ever reads.

The consent you give is enduring. That means it is ongoing rather than a single one-off fetch: once you connect an account, Wrightly keeps access to that account’s details and transactions so new transactions continue to arrive as they happen. It is what makes the feature useful, because books that update themselves only once are not much help.

There is no fixed end date. The access continues until you disconnect it, either in Wrightly or at my.akahu.nz, or until your bank or Akahu ends it. Section 08 covers how to stop it.

Imported transactions become the bank line items in your Wrightly books. From there they are used to:

• suggest a category and a GST treatment for each transaction, which you can accept or change;
• produce your GST returns, income tax figures, profit and loss, and expense claim reports;
• match receipts and invoices you have uploaded to the matching payment, so your claims have evidence behind them.

That is the whole use. We do not sell your information, we do not share it with marketers or data brokers, we do not use it to advertise to you, and we do not use it to train machine-learning models.

Alongside the account and transaction data itself, running the connection means we hold a small amount of information about the connection:

• The access token Akahu issues for your connection. It is encrypted before we store it, it is only ever used by our server, and it is never sent to your browser or phone.
• Connection records: which accounts you chose to share, when the connection was made, when it last synced, and whether it is healthy or needs reconnecting.
• An audit trail: who in your organisation connected, changed or disconnected an account, and when. Every change to your data is recorded this way, not just bank connections.

Our Privacy Policy covers everything else Wrightly collects, including the information you enter yourself.

Bank data is encrypted in transit and at rest. Your records live in our database in Australia, and files you upload are stored on Cloudflare. Access tokens for connected services are separately encrypted on top of that.

Each business’s data is isolated from every other business’s at the database level, and within your own business, access follows the role you gave each member: owners and admins can read and write, viewers can only read. Categorisation of transactions runs on Cloudflare Workers AI, whose terms mean the data is used only to return the result to us and is not used to train models. Our Security page sets out the detail.

If you choose to connect Wrightly to an outside assistant or tool through our connector, that tool can read the books it is given access to, including transactions that came from your bank feed. That only happens if you set it up, and you can revoke it at any time from your settings.

You are in control of the connection and can end it whenever you like. There are two ways:

• In Wrightly: open Connections and disconnect the account. We revoke the access at Akahu and delete the stored token straight away, so no further data comes in.
• At Akahu: sign in to my.akahu.nz and withdraw Wrightly’s access there. This works even if you never open Wrightly again.

Disconnecting is never gated behind a subscription. If your Wrightly Plus plan lapses, you can still disconnect a bank account.

Transactions that have already come in stay in your books after you disconnect. They are your accounting records, and you are required to keep your business records, generally for at least seven years under the Tax Administration Act 1994. Removing them the moment a feed is switched off would take your own records away from you.

You stay in charge of them: you can delete records yourself, or ask us to delete your data and account entirely, which removes them along with everything else. Export what you need to keep first. Section 8 and 9 of our Privacy Policy explain retention and deletion in full.

Bank connections are part of Wrightly Plus, our paid plan. See pricing for the current price and what else is included. Everything on this page applies only once you connect an account, and connecting is never automatic.

If you want to know anything more about how your bank data is handled, or you want us to delete something, email privacy@wrightly.app. We answer these ourselves. Our Privacy Officer is Philip Roigard, and if you are not happy with our response you can contact the Office of the Privacy Commissioner at privacy.org.nz.