Last updated: 20 June 2026 Website: conciergebysugar.com

Privacy Policy

Sugar is operated by Sugar Limited, registered at Suite 14278, 17b Farnham Street, Parnell, Auckland, 1052, New Zealand. This Privacy Policy explains how we collect, use, store, disclose, and protect your personal information when you use conciergebysugar.com, the Sugar dashboard, and related Sugar services.

We handle your information in accordance with the New Zealand Privacy Act 2020. By using Sugar, you agree to the collection and use of your information as described in this policy.

1. Information We Collect

We collect information you provide directly, information generated when you use Sugar, and information from integrations you choose to connect.

Account and contact information, such as name, email address, phone number, authentication details, support messages, preferences, and contact channel choices.
Onboarding and financial profile information, such as income range, debt range, credit score range, financial goals, arrears or bill stress indicators, priority categories such as debt, bills, insurance, subscriptions, utilities, and other details you provide in the Sugar flow.
Membership and payment metadata, such as plan, cadence, checkout status, and subscription status. Card details are handled by our payment processor and are not stored by Sugar.
Email connection data, if you connect Gmail, Outlook, Hotmail, or another mailbox. This can include message metadata, senders, subjects, dates, attachments, and extracted fields from financial emails relating to bills, bank statements, loan statements, insurance renewals, utilities, subscriptions, receipts, and similar financial documents.
Bank account connection data, if you connect accounts through Akahu. This can include institution name, account name, account type, masked account identifiers, balances, currency, transaction history, dates, descriptions, amounts, merchant or category information where available, account status, refresh or sync timestamps, and Akahu identifiers needed to maintain the connection.
Documents or files you upload, including bank statements, bills, insurance documents, loan documents, and identity or financial documents used to provide the service.
Usage, device, log, cookie, and analytics data, such as pages visited, clicks, feature usage, browser, IP address, device data, diagnostics, and error logs.

We do not ask for or store your online banking password. We do not intentionally store full bank account numbers where a masked or derived value is enough to provide the service.

2. How We Use Your Information

To assess your eligibility for our financial wellness services.
To scan for bills, debt, insurance, subscriptions, utilities, and other expenses that may have savings opportunities.
To import and organise statements, transactions, balances, renewals, and documents you choose to connect or upload.
To provide personalised financial insights, recommendations, savings options, reports, and dashboard views.
To support work you ask us to do, such as comparing providers, preparing switching options, negotiating or consolidating where applicable, and presenting options for your approval.
To communicate with you, including welcome emails, findings reports, follow-ups, support, account manager contact, and scheduling.
To process membership, checkout, billing, and service administration.
To improve our platform by analysing how users interact with our services.
To authenticate users, keep accounts secure, prevent misuse, and debug reliability issues.
To comply with legal obligations under New Zealand law.

We do not sell, rent, or share your personal information with third-party financial service providers or other external parties for their own marketing purposes.

3. Email and Mailbox Connections

If you connect a mailbox, Sugar uses read-only access to find financial emails and documents. Sugar does not send, delete, archive, or modify emails in your mailbox.

We focus on messages and attachments related to utilities, insurance, bank statements, loan statements, loan agreements, bills, receipts, subscriptions, and renewals.
Where feasible, we store extracted fields such as provider, amount, due date, renewal date, category, and document type rather than storing full message bodies.
You can disconnect a mailbox from the Sugar dashboard or revoke access from the relevant provider account settings.
For Google accounts, we follow Google's Limited Use requirements and do not use Google user data for advertising or unrelated profiling.

4. Akahu and Bank Account Connections

Sugar supports bank account connection through Akahu. Akahu is New Zealand's open finance platform. When you choose to connect a bank account, Sugar sends you to Akahu's hosted authorisation flow, where you authenticate with Akahu and choose which financial accounts to share with Sugar.

Sugar's current bank connection feature is used for read-only account and transaction access, not for initiating payments.
We use Akahu to access account information, balances, transaction history, transaction descriptions, merchant or category enrichment where available, account status, and refresh metadata for the accounts you authorise.
Access may continue and refresh until you disconnect the account, revoke authorisation through Akahu or your bank, delete your Sugar account, or otherwise ask us to stop.
Akahu credentials, app secrets, user access tokens, and OAuth exchange details are handled by our backend systems and are not exposed in frontend code.
You can see linked bank accounts in the Sugar dashboard and disconnect accounts there. You may also revoke access through Akahu where available.
If you disconnect or revoke bank access, Sugar will stop syncing that connection and will delete or de-identify Akahu-derived data that is no longer reasonably required for the service, legal obligations, dispute resolution, security, or business records.

For more information about Akahu, see akahu.nz/consumer.

5. Data Usage Details

This section reflects the data usage disclosures shown in Sugar's onboarding policy drawer and expands them for the current bank connection feature.

Contact details such as name, email, phone number, and contact preferences are used to communicate with you and deliver your results.
Financial profile details such as income range, credit score range, bill status, and problem areas are used to assess eligibility and tailor Sugar.
Transaction data such as amounts, dates, and descriptions extracted from statements or Akahu is used to analyse spending patterns and generate insights.
Usage data such as pages visited, features used, and interactions is used to improve the platform and user experience.

We do not request or store bank login credentials, credit card numbers, IRD numbers, tax file numbers, or passwords to external services. We discard raw bank statements and source financial documents after extraction where feasible.

6. Google User Data

If you connect a Google account, we may use Gmail APIs to identify and fetch bills, statements, insurance, loan, utility, subscription, receipt, or renewal documents in your mailbox to power Sugar features. We follow Google's Limited Use requirements.

We request only scopes needed to read relevant financial messages and do not send, delete, archive, or modify your email.
We do not use Google user data for advertising or unrelated profiling.
We do not allow human access to Gmail content unless you explicitly consent, it is necessary for security or legal compliance, or it is strictly required to diagnose an issue you report.
Where feasible, we extract key fields and discard full message bodies and attachments.
You can unlink Google in Sugar and revoke access from your Google Account settings.

7. Automated Processing and AI

We use automated processing and AI-assisted tools to analyse financial data, classify documents, detect savings opportunities, generate summaries, and support Sugar's recommendations. Data is sent only for the purpose of providing, securing, or improving Sugar. We avoid sending sensitive identifiers where they are not needed.

Where we use third-party AI API services, those providers operate under data processing terms and do not use your data to train their public models when accessed through business API services.

We share personal information only where needed to provide Sugar, operate our business, comply with law, or with your consent. Service providers may include hosting, database, authentication, analytics, email, payment, AI processing, customer support, security, and Akahu bank connectivity providers.

These providers are required to protect your information and use it only for the services they provide to us. We may also disclose information where required by law, to protect rights or safety, or in connection with a business transfer.

9. Data Storage and Security

Your data is stored with encryption at rest and in transit.
Aggregated or operational data may occasionally be recorded in internal systems for business operations.
We implement reasonable technical and organisational safeguards to protect your personal information.
No method of electronic storage is 100% secure, and we cannot guarantee absolute security.

10. Cookies and Analytics

We use cookies and similar tracking technologies to understand how our services are used and to improve your experience. Tools may include PostHog, Firebase Analytics, Google Analytics (GA4), and Meta Pixel.

11. Data Retention

We retain personal information only for as long as reasonably required to provide Sugar, maintain your account, support your membership, comply with legal obligations, resolve disputes, enforce agreements, prevent misuse, and keep business records.

Raw uploaded documents and source financial documents are discarded after extraction where feasible. Derived data, reports, insights, transaction records, and account records may be retained while they are needed to provide Sugar or maintain your history. Backup copies and logs may persist for a limited period before deletion.

You can request deletion of your personal information at any time. If you disconnect email or bank access, we stop new syncing from that source and delete or de-identify connected-source data that is no longer reasonably required.

12. Your Rights and Controls

Under the New Zealand Privacy Act 2020, you have the right to access the personal information we hold about you, request correction of inaccurate or incomplete information, and request deletion of your personal information.

You can disconnect linked email accounts and bank accounts from Sugar where the dashboard provides those controls.
You can revoke Google access from Google Account permissions and revoke Akahu access through Akahu where available.
You can ask us to delete your Sugar account and personal information, subject to legal and operational retention requirements.
You can contact us to understand or challenge automated processing that materially affects you.

We will respond to your request within a reasonable timeframe and no later than 20 working days, as required by law.

13. International Transfers

Some service providers may process or store information outside New Zealand. Where this occurs, we take reasonable steps to ensure your information is protected by comparable safeguards, including contractual commitments where appropriate.

14. Age Restriction

Sugar is intended for users aged 18 years and over. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected information from a person under 18, we will take steps to delete it promptly.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of our services after changes are posted constitutes acceptance of the updated policy.

16. Contact Us

Email: concierge@sugarwallet.com

Address: Suite 14278, 17b Farnham Street, Parnell, Auckland, 1052, New Zealand

This policy is governed by the laws of New Zealand.