← Back to Home

Privacy Policy

Last Updated: September 10, 2026

1. Information We Collect

To provide our expense tracking service, we collect the following information:

  • Account information: Email address, display name, and an encrypted password (or Google identity when you sign in with Google). An account is required to use Numza.
  • Financial data: Expense amounts, merchant names, categories, transaction dates, notes, budgets, and recurring expense configurations that you enter or that are extracted from your receipts and voice entries.
  • Receipts and attachments: Photos of receipts you scan, PDF documents you upload, and any OCR text extracted from them.
  • Voice audio recordings and transcripts: When you use voice input, the recording of your spoken expense description is sent to our servers. The audio is then transmitted to a third-party transcription provider that converts it into text, and the resulting transcript is processed to turn what you said into structured expense details.
  • Device metadata: Your device's currency preference and timezone to display amounts and dates correctly.

2. How We Use Your Data

Your data is used exclusively to provide the Numza service:

  • Storing and displaying your expense history, budgets, and analytics.
  • Processing receipts and bank notification text through AI to extract merchant names, amounts, and categories.
  • Generating spending insights and budget progress summaries.
  • Synchronizing your data across your own devices when you sign in.

We do not sell, rent, or share your personal data with third parties for their own marketing or advertising purposes. We do not track your location, device advertising IDs, or browsing history.

3. AI Processing & Third-Party Services

To provide Numza's smart features, we partner with reliable third-party service providers. Your data is shared with these providers solely to execute specific application services, and they are required to maintain strict standards of data protection and privacy compliance:

  • Voice audio transcription (OpenAI): When you use voice expense entry with AI features enabled, the voice audio recording captured by the app is transmitted through the Numza API to OpenAI, a third-party artificial intelligence service provider, which converts your speech into text. OpenAI receives the audio recording and returns a transcript. That transcript is then processed by one of the AI providers named in the app's consent dialog, DeepSeek AI or OpenAI, to turn your words into structured expense details. OpenAI does not receive the expense records created from the transcript.

    Receipt, PDF and transaction processing: To provide receipt scanning and automatic categorization, we use third-party artificial intelligence service providers. When you have enabled AI features and granted consent, the following data may be transmitted through the Numza API to one of the providers named in the app's consent dialog, DeepSeek AI or OpenAI, for these features. Which of the two serves a given request depends on our configuration and on availability, as described in the provider routing note below:

    • OCR text extracted from receipt images and PDF invoices, solely for extracting expense details (merchant, amount, date, items).
    • Transaction details — merchant names, amounts, categories, and dates — for automatic categorization.
    • Voice entry transcripts, for converting speech into structured expense records.

    Provider routing, changes and fallback. Which of these AI providers handles the processing described above depends on our server configuration and on availability. We configure one of them as the primary provider and the other as its failover, and a request that the primary provider cannot serve may be retried with the other. Either DeepSeek AI or OpenAI may therefore process any of the data categories listed above, including receipt text, transaction details, and voice entry transcripts. The voice audio recording itself is the one exception: it is sent to OpenAI for transcription, as described above. Both providers are named in the app's consent dialog, and we do not send your data to any AI provider that the consent dialog does not name.

    Data Sanitization & Redaction. Prior to transmitting receipt text, invoice documents, or voice transcripts to third-party AI processing services or storing them on our servers, Numza employs automated algorithms designed to detect and redact sensitive personal identifying information (PII) and full payment card credentials. While these automated sanitization tools aim to minimize sensitive data exposure, automated optical character recognition (OCR) and text processing cannot guarantee 100% redaction in every edge case (e.g., due to document image quality, unusual receipt layouts, or handwriting). Redaction cannot be applied to a voice recording itself: audio is transmitted as captured and is therefore only sent when you use voice expense entry after granting AI consent. We process only the minimum data necessary to provide expense extraction and categorization.

    Your consent. Numza will not send any of the above to a third-party AI service without your explicit, opt-in consent. On first use — and whenever this disclosure changes — the app asks for your permission and names the providers involved, OpenAI and DeepSeek AI, and explains exactly what data is shared. You can review or revoke your choice at any time in the app's Settings under “AI Data Privacy & Data Sharing”. Revoking consent stops all third-party AI data transmission immediately; all other features continue to work normally.

    Purpose and protections. The data is used solely for the features described above. It is not used to train AI models and is never sold. OpenAI and DeepSeek AI are each required, by contract, to provide privacy and security protections at least equal to those described in this policy, to use the data only to provide the processing services to Numza, and to retain it only as long as necessary for that purpose.

    Changes. If we add a new AI provider or materially change how your data is processed by third-party AI, we will update this policy and ask for your consent again before any new processing begins. This is the process that applies to the addition of OpenAI for voice audio transcription: the updated disclosure is shown in the app and you are asked to agree to it again. If you do not agree, no voice audio is transmitted for transcription and the AI features stop until you grant consent.

  • Transactional Emails: We use a transactional email delivery provider to send messages, such as verification codes during registration and password reset links. Your email address is shared solely to facilitate these deliveries.
  • Subscription Management: We use a subscription management service to verify in-app purchases and manage Premium (PRO) subscription entitlements. Entitlement verification tokens are processed to enable premium features. No payment card information (such as credit card numbers or CVVs) is collected, stored, or processed by Numza; all payments are processed directly by Apple App Store or Google Play Store.
  • Cloud File Storage: Scanned receipts, images, and uploaded PDF files are stored securely using cloud object storage infrastructure.
  • Performance Diagnostics: We use an application diagnostics tool to monitor crashes and improve performance. This telemetry is anonymized and does not include personal financial data.

4. Data Storage & Security

Your account data, expenses, budgets, and receipt metadata are stored on our servers in a secure database. Receipt images, PDF files, and the voice recordings you submit for expense entry are stored in cloud object storage. All communication between the Numza app and our servers is encrypted in transit using TLS (HTTPS).

A local copy of your expense data is cached on your device in encrypted local storage so recent transactions render immediately. This local cache is a read-only copy for display, not an offline store: Numza requires a working connection, and opening or changing data still goes to our servers.

5. Google Sign-In

You may optionally sign in using your Google account. When you use Google Sign-In, we receive your Google email address and display name. We do not access your Google Drive, contacts, or any other Google service data. You can unlink your Google account at any time from the app settings (provided you have a password set to prevent account lockout).

6. Data Retention & Deletion

We retain your data for as long as your account remains active. You can permanently delete your account and all associated data at any time from the app settings. Account deletion is irreversible and cascades to all your expenses, receipts, budgets, and recurring expense configurations, both on our servers and in cloud storage.

Voice recordings submitted for expense entry are retained only to produce the transcript for that entry. Deleting your account removes the entry, its transcript, and the recording files themselves from our servers and from cloud storage. There is no separate step to request their removal.

You can also export your expense data to a clean CSV spreadsheet format at any time before deleting your account.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Correct any inaccurate or incomplete data.
  • Erasure: Request deletion of your data (also available directly in the app).
  • Portability: Receive your data in a structured format (CSV/spreadsheet export is available in the app).
  • Restriction: Request that we limit how we process your data.
  • Objection: Object to processing based on legitimate interests.
  • Withdraw consent: Where processing is based on consent, you may withdraw it at any time.
  • Complaint: Lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at the email address listed in the Contact section below.

8. Legal Basis for Processing

We process your personal data on the following legal grounds:

  • Contractual necessity: Processing required to provide the Numza service you have requested (e.g., storing your expenses, syncing across devices).
  • Consent: Where you have given clear consent (e.g., using Google Sign-In, enabling AI-powered extraction).
  • Legitimate interests: For purposes such as improving our service, preventing fraud, and ensuring security, where these interests are not overridden by your rights.

9. Children's Privacy

Numza is not directed to children under the age of 13 (or the relevant age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately so we can remove it.

10. International Data Transfers

Your data is stored on servers and cloud infrastructure that may be located outside your country of residence. We take appropriate safeguards to ensure your data remains protected in accordance with this Privacy Policy, including using service providers that adhere to recognized data protection frameworks where applicable.

11. Contact Us

Numza is operated by Webbers Network Plt (Malaysia). If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

12. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal and regulatory reasons. We will notify you of material changes through the app or via email.