Privacy for the way Nateleigh actually works.

1. Who is responsible and what this covers

Nateleigh is operated by Nateleigh Investments Limited, a New Zealand limited company (company number 8030162; NZBN 9429048334174). We are responsible for the personal information covered by this policy.

Our location is New Zealand. Our monitored privacy contact and electronic address is hello@usenateleigh.com. You can also reach us through usenateleigh.com.

This policy covers the public website, beta applications, invited beta accounts, support and research, statement uploads, transaction analysis, AI-assisted features, forecasts, and scenarios. The current beta is intended for adults in the United States and New Zealand.

2. United States privacy notice

The United States does not have one general consumer privacy law that replaces all state and sector-specific rules. We therefore use one baseline process for U.S. users and add state-specific treatment where required.

• We collect only the categories described below and use them for the stated service, security, support, improvement, communication, and legal purposes.
• We do not sell personal information, share it for cross-context behavioral advertising, or use financial data for targeted advertising.
• We do not profile a person to make a legally significant decision about credit, employment, housing, insurance, health care, education, benefits, or access to basic services.
• We provide access, correction, deletion, and portability routes to every user, even where a particular state law threshold does not apply to us.
• We assess U.S. financial privacy and security rules by the activity performed, not by what we call the product. U.S. real-statement access remains gated until the applicable controls and legal scope review pass.

Sections 13 and 14 provide the U.S. rights and California disclosures.

3. Information we collect

These categories can include identifiers, customer-record information, internet or electronic activity, commercial and financial records, inferences, and correspondence. Financial information can be sensitive. We do not ask for a bank password, PIN, one-time code, Social Security number, IRD number, full payment-card number, security code, or government identification through an upload or chat. Please do not provide them.

4. Where information comes from

Most information comes directly from you through a form, account, file, chat, support request, or research conversation. We collect limited website and security information automatically and create derived information from the data you submit.

A transaction file can contain information about a joint account holder, employer, payee, merchant, sensitive purchase, or another person. Upload only an account you own or are authorized to use, and make sure any joint account holder knows you are using Nateleigh.

Bank connections are not part of the upload-first beta. If introduced, information will also come from the financial institution and connection provider you authorize. Before connecting, we will explain the provider, data requested, purpose, duration, refresh behavior, and how to disconnect.

5. How we use information

First and foremost, we use your information to provide the service you request. That includes:

• reviewing beta applications, administering invitations, and maintaining our relationship with applicants and testers;
• creating and authenticating accounts and keeping household workspaces separate;
• parsing supported files, inferring structure, normalizing and categorizing transactions, identifying patterns, calculating balances, building forecasts, and modelling user-selected scenarios;
• answering product questions, presenting relevant evidence and uncertainty, and helping you correct information;
• sending application, account, security, support, and service-change communications;
• analyzing service use, feedback, errors, and support interactions to improve reliability, usability, and product performance;
• protecting the service, preventing abuse, debugging failures, and maintaining proportionate audit evidence;
• sending promotional updates only where you have chosen them or applicable law otherwise permits, with an unsubscribe route; and
• complying with law, valid legal process, and the establishment, exercise, or defence of legal claims.

We do not use financial data to decide whether another person qualifies for credit, employment, housing, insurance, health care, education, benefits, or another eligibility decision, and we do not furnish consumer reports or eligibility scores.

6. What is optional

Applying for the beta is voluntary. We need your name, email, and country to review and respond; we need your state if you are in the United States. The decision-area question is optional. You can begin with fictional sample data instead of your own information.

To analyze your own finances, Nateleigh needs a supported transaction file or, when available, a bank connection. Without that information, the related analysis cannot be produced. Operational messages are part of administering your application or account. Promotional communications remain a separate choice.

7. Who receives information

Depending on the feature you use, information may be processed by these categories of recipients:

• cloud infrastructure providers that host the website, application, authentication, databases, private storage, backups, and processing workers;
• communications and customer-management providers that receive beta applications and support email, maintain relationship records, and deliver service messages;
• AI service providers used for approved, limited categorization, interpretation, or explanation tasks;
• bank-connection providers if you later choose to connect an account;
• security, diagnostics, and support providers used to prevent abuse and resolve technical problems; and
• professional advisers, authorities, or transaction counterparties where reasonably necessary for legal compliance, claims, fraud or security response, or a genuine corporate transaction subject to appropriate safeguards.

Service providers may process information only to perform their contracted role or another use permitted by law and contract. We assess relevant privacy, security, retention, subprocessor, and overseas-processing terms before enabling a provider for personal financial data. We keep an internal register of current providers. Contact us if you need information about the provider used for a particular feature.

We do not sell personal information. We have not sold personal information or shared it for cross-context behavioral advertising in the preceding 12 months. We do not disclose financial information or chats for targeted advertising.

8. AI-assisted features

Some features use automated or AI-assisted processing. Depending on the task, this may include the question you type together with selected, minimized financial context relevant to the answer. For categorization, it may include a redacted transaction description or counterparty, amount, direction, and candidate categories.

We do not send original statement files, bank login credentials, direct account credentials, or an unrestricted account history to an AI provider. We use technical controls to remove common direct identifiers before approved transaction text crosses that boundary, but automated redaction cannot guarantee that every identifying detail will be detected.

We configure business or API services so Nateleigh inputs are not used to train shared models where that control is available. We do not use identifiable financial information to train or fine-tune a Nateleigh model without a separate, explicit opt-in. Provider request and response bodies are not placed in ordinary Nateleigh application logs; a provider may retain limited information under its business terms for safety, abuse prevention, or legal compliance.

Nateleigh does not use AI or automated processing to make a legal or similarly significant eligibility decision. The active provider or model can change. We will provide additional notice before a change materially expands the data, purpose, retention, or recipient.

9. Sensitive information in transaction data

Uploaded financial data may contain merchant names or descriptions that reveal sensitive information, including information about health or other private circumstances. We process that information only to provide the categorization, analysis, forecasting, and decision-support features you request.

We do not intentionally infer medical diagnoses, prescriptions, reproductive status, or other sensitive traits from transaction data. We do not use it to determine eligibility, target advertising, or sell personal information. If a future feature would intentionally create sensitive inferences or materially change these practices, we will update this policy and obtain any consent required before enabling it.

10. Cookies, advertising, and tracking

The service may use strictly necessary cookies or similar local storage for authentication, security, and user preferences. At the effective date, the public beta site does not use third-party advertising pixels or session replay, and third parties are not permitted to collect your activity through Nateleigh over time and across unrelated websites for advertising.

Because we do not currently sell or share personal information or conduct cross-site behavioral advertising through the service, browser Do Not Track and Global Privacy Control signals do not change the present behavior. If those practices change, we will update this notice and implement legally required consent or opt-out controls before enabling them.

11. How long we keep information

We retain information while it serves the purpose described below, then delete or de-identify it unless a longer period is reasonably required for security, a dispute, legal compliance, or a documented legal hold.

• Beta applications and relationship records: while recruiting or operating the beta and for up to 24 months after your last meaningful interaction. If you become a user, core relationship records may remain while the account or customer relationship is active.
• Promotional contact: until you unsubscribe or 24 months pass without meaningful engagement, whichever happens first. We may retain a minimal suppression record so we continue to honor an opt-out.
• Account, authentication, and membership information: while the account is active and through the period needed to complete closure, security checks, and backup expiry.
• Successful original statement file: scheduled for deletion 14 days after successful import. A failed or abandoned original file is scheduled for deletion after 7 days.
• Parsed transactions, categories, balances, chats, forecasts, and scenarios: while your household account is active, unless you delete an item where that feature is available or request household deletion.
• Support and research records: while needed to resolve the matter and generally no more than 24 months after the last interaction, unless de-identified or separately authorized.
• Ordinary production logs: ordinarily no more than 30 days. Security and staff-access records may be kept for up to 90 days or longer for a documented incident or legal need.
• Legal acceptance and transaction records: for the life of the relationship and the period reasonably needed to establish the terms, comply with law, or resolve a claim.

Deleting an original file does not delete the parsed transactions needed to provide your account. After deletion from active systems, residual backup copies are isolated and expire through the normal backup cycle; they are not used for ordinary product purposes.

12. How we protect information

We use safeguards appropriate to a financial-data beta, including encrypted connections, private storage, household-level authorization controls, restricted staff access, least-privilege services, secret management, rate limits, audit records, monitored failures, provider review, and a written incident process. We test relevant deletion and access controls before enabling real-data features.

No online service can promise zero risk. We do not claim that Nateleigh is “completely secure,” “bank-grade,” or independently certified unless that statement becomes current and documented.

13. U.S. privacy rights and choices

We provide the following practical baseline to every user. Where an applicable U.S. state law grants a right, we will honor it subject to the law's verification and exceptions. You can ask us to:

• confirm whether we process personal information about you and provide access to it;
• correct inaccurate personal information;
• delete information provided by or obtained about you;
• provide a portable copy of information you provided;
• opt out of sale, targeted advertising, or qualifying significant-decision profiling—none of which we currently conduct;
• withdraw from optional research or promotional communications; or
• appeal a refusal to act on a privacy request.

Send a request to hello@usenateleigh.com with “Privacy request” in the subject. For an appeal, use “Privacy appeal.” We will verify identity proportionately, respond within the legally required period, and generally target 45 days. An authorized agent may submit a request where state law permits; we may require proof of authority and direct verification with you.

We will not discriminate or retaliate against you for exercising a privacy right. If we deny an appeal, we will explain the decision and, where required, provide the relevant state regulator's complaint route.

14. California and other state disclosures

California. For the preceding 12 months, the personal-information categories we collected are identifiers; customer-record information; internet or electronic activity; commercial and financial records; inferences; and correspondence. Sections 3 through 8 describe examples, sources, purposes, retention, and recipient categories. We have not sold personal information, shared it for cross-context behavioral advertising, or offered a financial incentive for personal information. The beta is for adults and we do not knowingly sell or share information of people under 16.

The California Online Privacy Protection Act applies to online operators beyond the threshold-based California Consumer Privacy Act. Section 10 explains our Do Not Track and cross-site tracking practices. If Nateleigh becomes subject to additional California Consumer Privacy Act requirements, we will implement the applicable notice, request, opt-out, sensitive-information, risk-assessment, cybersecurity-audit, and automated-decision controls before the relevant processing.

Nevada. Nevada residents may request review or correction of covered information and may opt out of a covered sale under Nevada's online privacy law. We do not conduct a covered sale.

Other state comprehensive privacy laws use different thresholds and exemptions. We review applicability as our users, revenue, features, and advertising practices change; the baseline rights in section 13 remain available regardless.

15. Privacy and security incidents

We maintain a process to contain, investigate, document, and remediate suspected privacy or security events. All U.S. states have breach-notification laws, with different definitions, deadlines, and regulator-notice rules. When a breach is legally notifiable, we will notify affected people, regulators, consumer reporting agencies, or others within the period required for the affected residents and data.

We also assess any federal notification rule that applies to the activity and data, including the FTC Safeguards Rule or Health Breach Notification Rule where legally applicable.

16. International processing and New Zealand addendum

Nateleigh is based in New Zealand and serves invited users in the United States and New Zealand. Our providers may process or store information in the United States, New Zealand, and other locations disclosed by those providers. Privacy protections and government-access rules can differ by location.

For New Zealand users, Nateleigh Investments Limited is the collecting agency under the Privacy Act 2020. We use information for the purposes in section 5, apply the access and correction rights in Information Privacy Principles 6 and 7, do not retain information longer than required for a lawful purpose under Principle 9, and assess overseas disclosures under Principle 12. Where a provider acts only as our agent, we remain responsible for the information. Serious-harm breaches are notified to the New Zealand Privacy Commissioner and affected people as soon as practicable.

17. Adults only and policy changes

The beta is for people aged 18 or older. It is not directed to children, and we do not knowingly collect beta account or financial data from anyone under 18. If you believe a minor has provided information, contact us so we can investigate and delete it where appropriate.

We will update the version and effective date when this policy changes. We will post the updated policy here and provide additional notice where required. If a change materially expands how existing financial information is used—for example, a new purpose, model-training use, behavioral-advertising use, or materially different recipient—we will provide clear notice and obtain fresh agreement or consent where required before the change applies.