1. Who we are
Billy Pay is operated by Billy Pay Limited, a New Zealand company. We are the agency responsible for the personal information described in this notice under the Privacy Act 2020.
Contact: privacy@billypay.co.nz. Postal address on request.
2. What we collect
3. Why we collect it
We collect personal information only for purposes connected to running Billy Pay:
- To create and secure your account, and verify it's you.
- To calculate who owes what within a group and show accurate balances.
- To initiate the payments you approve, and confirm they've cleared.
- To notify you about bills, requests and settlements.
- To detect fraud and misuse, and to meet legal and regulatory obligations.
- To fix problems and improve the app using aggregated, de-identified usage data.
We do not use your information for advertising, and we do not sell it to anyone.
4. Bank data and Akahu
Billy Pay accesses your bank data through Akahu, an accredited New Zealand open banking provider. When you connect a bank, you authorise the connection in a flow run by Akahu and your bank — your credentials are entered there, never in Billy Pay, and we never see or store them.
Akahu holds the access token on our behalf and passes us only the data covered by the permissions you granted. Akahu's own handling of your information is governed by its privacy policy at akahu.nz/privacy-policy.
You can see and revoke every connection you've granted from your Billy Pay account settings, or directly through Akahu's consent portal. Revoking stops any further access immediately.
5. Who we share information with
- Other people in your groups — your name, avatar initials, the bills you add and your balance within that group are visible to the other members. Your account numbers, transaction history and contact details are not.
- Akahu and your bank — to read the data you authorised and to initiate the payments you approve.
- Service providers — cloud hosting, error monitoring, SMS delivery and customer support tools, bound by confidentiality and permitted to use the data only to provide those services to us.
- Authorities — where we're required by law, or where it's necessary to investigate fraud or protect someone's safety.
Some providers store data outside New Zealand. Where they do, we require protections comparable to those under the Privacy Act 2020.
6. How long we keep it
We keep your information for as long as you have an account, and after closure only as long as we need it to resolve outstanding balances, meet financial record-keeping obligations, or defend a legal claim. Bank transaction data pulled for balance calculations is deleted when it is no longer needed for that purpose, and within 30 days of you disconnecting the account.
7. How we protect it
Data is encrypted in transit and at rest. Access is restricted to staff who need it to operate or support the service, and is logged. Your PIN is stored only as a salted hash. We test our systems regularly and have a process for assessing and notifying privacy breaches as required by the Privacy Act 2020.
8. Your rights
You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it if it's wrong. Email privacy@billypay.co.nz and we will respond within 20 working days. You can also delete your account from the app, which removes your profile and disconnects your banks.
9. Withdrawing consent
You can disconnect a bank account at any time from Account → Connected banks, or revoke access through Akahu. You can turn off notifications in your device settings. Withdrawing bank access means Billy Pay can no longer calculate balances automatically or settle payments for you, but your existing records stay visible until you delete your account.
10. Complaints
If you're unhappy with how we've handled your information, contact us first — use the contact form or email privacy@billypay.co.nz — we aim to acknowledge within 2 working days and resolve within 20. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
11. Changes to this notice
If we change this notice we'll update the date above, and where the change is material we'll tell you in the app or by email before it takes effect.