KohaPay terms of use and privacy notice

Version 2026-10-16

Save as PDF

1. What KohaPay is

KohaPay is run by Tallawah Tech Limited ("we"). It lets you request money from people and pay them, straight from one New Zealand bank account to another.

KohaPay is not a bank and never holds your money. Money moves directly between bank accounts, using your bank's own payment systems.

2. Connecting your bank

To use KohaPay you connect a bank account through Akahu, a New Zealand open banking provider. You log in to your own bank on Akahu's or your bank's screens. KohaPay never sees or stores your bank username or password.

By connecting, you authorise Akahu to share with KohaPay the accounts you choose, and to let KohaPay start payments from them that you approve. Your bank's approval screen may say this includes seeing balances and transactions: KohaPay only uses each account's name, account number, account holder name and bank, and doesn't read or store your balance or transactions.

You can disconnect an account any time in the app (Bank connection), and you can also withdraw access through Akahu or your bank.

3. Making payments

Every payment needs your approval: when you pay a request or send money, KohaPay sends you to your bank (through Akahu) to approve that one payment. Nothing is paid until you do.

Before approving, check the account holder name KohaPay shows you is the person you mean to pay. Scammers often use a name that's close to, but not the same as, the real one.

Once your bank has made a payment it usually can't be cancelled or reversed, by us or by you. If you pay the wrong person, contact your bank straight away and tell us too.

To limit harm from mistakes and fraud, payments are capped (currently $1,000 a day and $5,000 per request), and unpaid requests expire after 30 days. We may change these limits.

Requests you receive are from other people, not from KohaPay. Only pay requests you recognise. Use "Report suspected scam" if something looks wrong.

4. Fees

Paying people with KohaPay is free.

Personal accounts: receiving payments is free too. Without KohaPay Plus, a personal account can receive up to 20 payments each calendar month. Every payment asked for counts, including payment links, unless it's declined, cancelled, fails or expires. Once you reach the limit you can't request money, and people can't send you money through KohaPay, until the next month, unless you get Plus or add a business profile.

Business accounts: KohaPay charges 0.95% of every payment you receive, at least $0.25 and up to $3 per payment (never more than the payment itself). You choose to switch to a business account in the app (Profile, Fees and business account), and can switch back at any time; fees on payments already received are still owed.

Business Pro: instead of the per-payment fee, a business account can choose Pro, which costs $24 for each calendar month the account is on Pro. That includes 100 payments received each month with no per-payment fee; each payment after that costs $0.25. Your first month on Pro is free. Pro is one 12-month plan, paid either $24 a month or $275 upfront for the year (billed with your first monthly bill of that year, with no free first month). It runs for 12 calendar months from the month you choose it, and renews for another 12 months unless you switch to pay as you go in the last month of the term. You can leave Pro earlier, but on monthly payments the monthly price is still charged for each remaining month of the term; a year paid upfront isn't refunded. You can switch from pay as you go to Pro at any time, as long as you have a card or bank account saved to pay for it, and you need to keep one saved while you're on Pro.

Personal accounts are for personal use. If you take payments for a business, you need a business account. If an account is plainly being used for a business, we may ask you to switch, or switch it for you after telling you.

The fee on each payment is worked out when the payment is requested, and only charged if it's paid. You can see your fees in the app.

Payments go straight from your customer's bank to yours, and KohaPay never holds them, so fees aren't taken out of payments. Instead, a business account needs a card or bank account saved in Plan and billing before it can take payments, and at the start of each month we automatically charge the previous month's fees (and any Business Pro charge) to it. We don't send bills for fees. If the charge fails on your main and backup methods, we tell you and keep trying. If it's still unpaid 7 days after the first try, your business account can't take payments through KohaPay (QR codes, Bluetooth, payment links, invoices, collections and requests) until it's paid; you can pay it from Home once your card or bank account is sorted. You need to keep a card or bank account saved while you have a business account. If fees stay unpaid we may close your account.

KohaPay Plus costs $2.99 a month, or $29 a year paid upfront, after any free month. It's charged to your saved card or bank account at the start of each month or year until you stop it. You can stop it at any time in Plan and billing; it keeps working until the end of the month or year you've paid for, and the unused part isn't refunded. If a payment fails on both your main and backup methods, we try again each day for 7 days, and Plus ends if it still hasn't been paid.

Cards and bank accounts: payments by card or NZ bank account (direct debit) are processed by Stripe. You can save a main method and a backup. We try your main one first and, if it fails, your backup straight away. By saving a method you authorise KohaPay to charge it for your plans and fees as these terms describe. KohaPay never sees or stores your full card or bank account number.

If we change the fees, we'll update these terms and ask you to agree again before the new fees apply.

5. What information we collect

When you sign up: your name, email address, mobile number and password (stored only in scrambled, hashed form).

When you connect a bank: the account details listed in section 2, and a one-off connection reference from Akahu, which we store encrypted.

When you use KohaPay: the requests and payments you make or receive (amounts, notes, dates, who they're between and their status), the contacts you save, any @username you choose, scam reports you make, and a log of important actions on your account (for example connecting a bank, approving or declining a payment).

If you choose "Find people from my phone's contacts": the phone numbers and email addresses in your contacts are sent to KohaPay to check which belong to KohaPay users. We don't keep them.

For security: your device's network address, to limit repeated login attempts and lookups.

Giving us your name, email and mobile number is required to use KohaPay. Everything else is only collected when you use the feature it's for.

6. Why we collect it, and who sees it

We use your information to run KohaPay: to let people find and pay you, show you your history, prevent fraud and scams, keep your account secure, and meet our legal obligations.

Other KohaPay users can find you by your mobile number or email address, and by your @username if you set one (if you make your username public, it also appears in username search). When someone looks you up or you request money from them, they see your display name. When someone is about to pay you, they also see your bank account holder name and bank, so they can check they're paying the right person.

We share information with Akahu and the banks involved to make payments, and with service providers who help us run KohaPay (such as hosting), who may only use it for that. We may share it with the police or regulators when the law requires it, or to investigate fraud.

We don't sell your information, and we don't use it for advertising.

7. How long we keep it

We keep your account details while you have an account. If you delete your account, we remove your name, email, mobile number, username, password and bank connections.

Records of payments, scam reports and the account activity log are kept after deletion for as long as the law requires for financial records (often several years), no longer linked to your name.

8. Your rights

You can see the information we hold about you (Profile, Download my data), correct your name in Profile, and ask us to correct anything else.

To ask a question or make a privacy request, email support@tallawahtech.co.nz. If you're not happy with how we handle it, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

9. Your responsibilities

Keep your phone, KohaPay password and bank login secure, and don't let anyone else use your account. Tell us if you think someone has.

Only use KohaPay for lawful payments. Don't use it to scam, harass or deceive anyone. We may suspend accounts that do, and report them to the authorities.

The information you give us, and the account you connect, must be your own.

10. KohaPay is being tested

KohaPay is in testing and parts of it may change or not work as expected. These terms are a draft and will be reviewed before KohaPay launches publicly.

To the extent the law allows, we're not responsible for losses caused by payments you approve, by your bank or Akahu, or by the app being unavailable. Nothing in these terms limits rights you have under the Consumer Guarantees Act or Fair Trading Act.

11. Changes to these terms

If we change these terms, the app will show you the new version and ask you to agree before you keep using KohaPay. If you don't agree, you can delete your account.