KohaPay privacy policy

Version 2026-10-16 (draft). Draft: pending legal review before KohaPay launches.

Save as PDF

1. Who we are

KohaPay is run by Tallawah Tech Limited (NZBN 94-29054016958), in New Zealand ("we", "us"). We're responsible for the personal information KohaPay collects, and we follow the Privacy Act 2020.

Our privacy officer handles privacy questions and requests. To contact them, email support@tallawahtech.co.nz.

This policy applies to the KohaPay mobile app and website. It sits alongside our terms of use, which include a shorter privacy notice you agree to when you sign up.

2. What we collect

Account details: your name, email address, mobile number and password. We store your password only in scrambled (hashed) form, so we can't read it. We record when you verify your email and mobile number.

Bank details: when you connect a bank through Akahu, Akahu reads your accounts once, with your consent, and gives us each account's name, account number, account holder name (as your bank has it) and bank, plus a one-off reference to that connection, which we store encrypted. This is one-off access: Akahu and KohaPay can't read your accounts again later. We don't receive your bank login, and we don't read or store your balances or transactions.

Why we get bank details: so people paying you can see the account is really yours (your bank-verified name and account number go into each payment to you, as Akahu and the banks require), and so you can choose which of your accounts to pay from.

Payments through Akahu: when you approve a payment, we send Akahu the amount, the account it's from, the receiver's verified name and account number, and a reference. You approve it at your bank, and Akahu tells us whether it was approved, sent or declined. Akahu doesn't give us anything else from your bank.

Payments and requests: amounts, notes, dates, who each request or payment is between, its status, and any fees. Groups you create or join: the group name, members, shared expenses and settlements.

Business accounts: your business name, NZBN if you give one, your plan, and the fees charged to you.

Paying a business on the web without the app: the amount, any note, when you paid, and the payment's status from Akahu. If you give an email address for a receipt, we use it only to send that receipt and then delete it. You approve the payment at your own bank through Akahu; we don't receive your bank login or account details.

People you know: contacts you save in KohaPay, and any @username you choose and whether it's public. If you use "Find people from my phone's contacts", the phone numbers and email addresses in your phone's contacts are sent to us to check which belong to KohaPay users; we don't keep them.

Safety and security: scam reports you make or that are made about you, a log of important actions on your account (such as signing up, connecting a bank, approving or declining a payment), and your device's network (IP) address, which we use briefly to limit repeated login attempts and lookups.

Your device: if you allow notifications, a push notification token for your device. We don't collect your location, and we don't use advertising or analytics trackers.

Your name, email address and mobile number are required to use KohaPay. Everything else is collected only when you use the feature it's for.

3. Phone permissions

KohaPay only asks for a permission when you use the feature that needs it, and you can turn each one off in your phone's settings.

Camera: to scan a KohaPay QR code. Images stay on your phone and aren't sent to us.

Contacts: only if you choose to find people from your contacts (see section 2).

Bluetooth: to add a contact by holding two phones together. Your phone shares a short-lived code (it expires within a minute) that the other phone reads, and you're asked before anyone is saved as a contact. No money moves this way.

Notifications: to tell you about requests and payments.

Face ID, fingerprint or passcode: if you turn on app lock, your phone checks this itself. We never receive your biometric information.

4. How we use it

To run KohaPay: create your account, let people find and pay you, start the payments you approve, show your history, run groups, and send you receipts, reminders, verification codes and notifications.

To charge business fees and paid plans, as set out in our terms.

To keep KohaPay and its users safe: verify who you are, prevent and investigate fraud and scams, enforce payment limits, and secure your account.

To meet our legal obligations, and to answer your questions and requests.

We only use your information for these purposes, or for something directly related that you'd reasonably expect. We don't sell your information and don't use it for advertising.

5. Who sees it

Other KohaPay users: people can find you by your mobile number, email address, or @username (if you make it public, it also appears in username search). They see your display name. When someone is about to pay you, they also see your bank account holder name and bank, so they can check they're paying the right person. Members of a group see each other's names and the group's expenses.

Akahu and the banks: to connect your bank and make the payments you approve. Akahu is a New Zealand open banking provider with its own privacy policy (akahu.nz).

Service providers who run parts of KohaPay for us, and may only use your information for that: Fly.io (hosting our servers and database), Resend (sending email), Twilio (sending text messages, such as verification codes), Stripe (taking card and bank account payments for KohaPay plans and fees; Stripe keeps those card and bank details, not KohaPay) and Expo (delivering push notifications, through Apple and Google).

The police, regulators or other authorities, when the law requires it or when it's needed to prevent or investigate fraud or serious harm. [Confirm whether AML/CFT reporting obligations apply.]

If KohaPay's business is sold or moved to a company, your information would move with it, under this policy.

6. Information stored or processed outside New Zealand

Our servers and database are hosted by Fly.io in Sydney, Australia. Email (Resend), text messages (Twilio), card and bank account payments (Stripe) and push notifications (Expo) are handled by providers based in the United States.

These providers store or process your information on our behalf to provide their service to us, and we remain responsible for it. Australia's Privacy Act 1988 gives protections comparable to New Zealand's. [Confirm with legal review whether each provider is treated as our agent under section 11 of the Privacy Act 2020 or as an overseas disclosure under IPP 12, and what contractual safeguards to rely on.]

7. How we keep it safe

All connections to KohaPay are encrypted. Passwords are hashed, bank connection references are encrypted, and access to our systems is limited to the people who run KohaPay. Every payment still needs your approval at your bank.

If a privacy breach happens that has caused, or is likely to cause, serious harm, we'll tell the Office of the Privacy Commissioner and the people affected as soon as practicable, as the Privacy Act 2020 requires.

8. How long we keep it

We keep your account details while you have an account. Bank details from Akahu are kept only while that bank is connected: when you remove a connection in the app, or delete your account, we delete its account details and connection reference.

Short-lived data is deleted automatically: verification and password reset codes, contact sharing codes and unfinished bank connections within a day, and security counters once their time window ends.

When you delete your account, we remove your name, email, mobile number, username, password, bank connections, saved contacts and notification tokens. Records of payments, fees, scam reports and the account activity log are kept, no longer linked to your name, for as long as the law requires for financial records. [Set the retention period, often 5 to 7 years, after legal advice.]

Backup copies of our database are kept for a limited time, and the oldest are deleted as new ones are made. [Set a backup retention period.]

9. Your rights

You can ask to see the personal information we hold about you, and ask us to correct it. You can download most of it yourself any time (Profile, Download my data), and change your name in Profile.

You can delete your account any time in Profile. For anything else, email support@tallawahtech.co.nz. We'll respond within 20 working days, and there's no charge.

If you're not happy with how we handle your information or a request, please tell us first. You can also complain to the Office of the Privacy Commissioner (privacy.org.nz, 0800 803 909).

10. Children

KohaPay is for people who have their own New Zealand bank account. [Set a minimum age, e.g. 16 or 18, and confirm with legal review.] We don't knowingly collect information from children under that age.

11. Changes to this policy

We'll update this policy when KohaPay changes what it collects or who it shares with. The version date at the top shows when it last changed, and we'll tell you in the app about important changes.