Privacy Policy

1Who we are & scope

Shogun Ventures Limited (“Shogun Ventures”, “we”, “us”, “our”) is the entity responsible for personal information handled through the Katana mobile application and the website at trykatana.app (together, the “App”). For the purposes of applicable data protection law, we are the data controller.

• New Zealand Business Number (NZBN): 9429051904760
• Registered office: Suite 1243, Unit A, Level G, 26 Hobson Street, Auckland 1010, New Zealand
• Privacy contact: [email protected]

We handle personal information in accordance with the Privacy Act 2020 (New Zealand) and its Information Privacy Principles (“IPPs”), and, where they apply to you, other data protection laws (see section 17). This Policy applies to your use of the App and does not apply to any third-party product or service that has its own privacy policy.

This Policy is governed by the laws of New Zealand and forms part of, and is read together with, our Terms & Conditions — including the disclaimers and limitations of liability in them, which apply (to the extent permitted by law) to matters arising under this Policy.

2Information we collect

We collect the following categories of information. We aim to collect only what we reasonably need to provide and improve the App.

Information you provide

• Account & identity. Your email address; and, if you sign in with Google, the account identifier, email address and name that Google provides. Where you use more than one sign-in method with the same verified email, we associate them with one account.
• Profile & settings. Your name (if provided), display name, language/locale, time zone, notification preferences, and records of the versions of our Terms and this Policy you have accepted (with dates).
• Your budgeting content. The information you enter into the App — including income, fixed expenses, savings goals, expense entries (amounts, categories, notes and dates) and related figures (your “Content”). This is financial information you choose to record; we do not obtain it from your bank or any financial institution.
• Household information. If you create or join a shared household: household name, your role, and the membership and invitations you manage or accept.
• Communications. Messages you send us (for example, support requests) and your correspondence with us.

Information collected automatically

• Device & technical data. Device platform and a device identifier used to manage your sign-in sessions, app version, and general settings needed to run the App.
• Log & usage data. When the App communicates with our servers we receive standard technical information such as IP address, request times, and basic diagnostic information used for security, troubleshooting and reliability.

Information from third parties

• Sign-in providers. If you use Google sign-in, we receive limited profile information from Google as described above.
• App stores & subscriptions. When you buy a subscription or one-time purchase, the Apple App Store or Google Play processes the payment and, through our subscription provider (RevenueCat), we receive your entitlement and transaction status (for example, whether a subscription is active, the product, store and environment, and relevant identifiers). We do not receive or store your full payment card details.

We do not intentionally collect special or “sensitive” categories of information (such as health, ethnicity or biometric data). Please do not enter such information into free-text fields.

3How we collect it

We collect information directly from you (when you create an account, use the App, or contact us), automatically (through your use of the App and its communication with our servers), and from the limited third parties described above (sign-in and app-store/subscription providers). Where the law requires us to collect information directly from you, we do so.

4How we use information

We use personal information to:

• create and manage your account, authenticate you, and keep your data in sync across your devices;
• provide the App’s core features — recording entries, calculating budgets and savings, tracking goals, and enabling shared households;
• process and manage subscriptions and entitlements (via the app stores and our subscription provider);
• send you service communications, such as sign-in codes, security alerts, and notices about changes to the App, our Terms or this Policy;
• provide support and respond to your requests;
• maintain the security, integrity and reliability of the App, prevent and investigate fraud, abuse and breaches of our Terms, and enforce our rights;
• operate, analyse, maintain and improve the App and develop new features (using usage information and de-identified or aggregated data);
• comply with our legal obligations and respond to lawful requests;
• with your consent where required, send you optional communications you have opted into; and
• use information for any other purpose we disclose to you at the time of collection, or as otherwise permitted or required by law.

We may create aggregated or de-identified information that does not identify you and use it for any lawful purpose, including analytics and improving and promoting the App. We will not attempt to re-identify such information.

Device permissions

The App requests only the device permissions it needs to function (for example, permission to show notifications, if you enable them). It does not require access to your location, contacts, photos, microphone, camera or bank accounts. You can review and change app permissions at any time in your device settings.

5Our lawful bases

Under the Privacy Act 2020 we collect and handle personal information for the purposes above, which are connected with providing the App. Where the EU or UK General Data Protection Regulation (“GDPR”) applies to you, we rely on the following legal bases:

• Performance of a contract — to provide the App and features you request under our Terms;
• Legitimate interests — to secure, maintain, analyse and improve the App, prevent misuse, and run our business, provided these interests are not overridden by your rights;
• Consent — where we ask for it (for example, certain optional communications), which you may withdraw at any time; and
• Legal obligation — where we must process information to comply with the law.

6When we share information

We do not sell your personal information, and we do not share it for third-party advertising or cross-app tracking. We share personal information only as follows:

• Service providers. With the providers who host and operate the App on our behalf, under contracts requiring them to protect your information and use it only for our purposes (see section 7).
• App stores & subscription provider. With Apple, Google and RevenueCat to process purchases and manage entitlements.
• Other household members. If you use a shared household, your Content in that household is visible to its members (see section 8).
• Legal & safety. Where we reasonably believe disclosure is required or permitted by law, or is necessary to comply with a legal process, enforce our Terms, protect the rights, property or safety of Shogun Ventures, our users or others, or prevent fraud or harm.
• Business transfers. In connection with, or during negotiations for, any merger, sale of company assets, financing, acquisition or reorganisation of all or part of our business, in which case information may be transferred as a business asset (subject to this Policy).
• With your direction. Where you ask us to, or otherwise consent.

7Our service providers

We use a small number of reputable providers to run the App. They act as our processors and are only permitted to use personal information to provide their services to us. They currently include:

• Amazon Web Services (AWS) — cloud hosting, data storage (including export files), email delivery of sign-in codes and service messages, and related infrastructure;
• MongoDB (Atlas) — the database in which your account and Content are stored;
• RevenueCat — subscription and entitlement management;
• Apple and Google — app distribution, in-app purchases and (for Google) sign-in.

We may change providers or add new ones from time to time; we will keep this Policy up to date and continue to require appropriate protections.

8Shared households

The App lets you share a budget book with others in a “household”. If you use this feature, information you add to a household — including entries, goals and figures — will be visible to, and may be edited or deleted by, other members of that household, and the household owner manages membership and settings. You are responsible for who you invite and for what you choose to share. We are not responsible for how other household members use information shared within a household. Only share information, and invite people, you are comfortable with.

9International storage & transfers

We are based in New Zealand, but our providers operate globally. Your personal information may be stored and processed on servers located outside New Zealand — including in Australia, the United States and other locations where our providers operate.

Where we disclose personal information overseas, we take reasonable steps, as required by IPP 12 of the Privacy Act 2020, to ensure it is protected by comparable safeguards — for example through our contracts with providers. Where the GDPR applies, transfers outside the EEA or UK are made using an appropriate transfer mechanism (such as adequacy decisions or Standard Contractual Clauses). By using the App, you acknowledge that your information may be transferred to, and processed in, countries other than your own, which may have different data protection laws.

10How we protect information

We take reasonable technical and organisational measures designed to protect personal information against loss and unauthorised access, use, modification or disclosure. These include encryption of traffic in transit, storing sign-in credentials on your device in the platform’s secure storage (Keychain / Keystore), access controls, and use of reputable infrastructure providers.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. To the maximum extent permitted by law, we are not liable for any unauthorised access to, or loss, corruption or interception of, information that occurs despite our reasonable measures. You are responsible for keeping your device, email inbox and sign-in credentials secure, and for the security consequences of sharing within a household. This section is subject to, and does not limit, your non-excludable rights (see section 17) and is read together with the limitations in our Terms & Conditions.

11How long we keep it

We keep personal information for as long as we need it for the purposes described in this Policy — generally, for as long as you have an account with us.

• Account deletion. You can delete your account in the App. When you do, we will delete or de-identify your personal information from our active systems within 30 days, except as set out below.
• Backups & residual copies. Residual copies may persist in secure backups for a limited period before being overwritten in the ordinary course.
• Legal & legitimate retention. We may retain certain information for longer where we are required to by law, or where reasonably necessary to resolve disputes, prevent fraud and abuse, enforce our Terms, or keep records of consents and transactions.
• De-identified data. We may retain and use aggregated or de-identified information indefinitely.

12Your rights & choices

Subject to applicable law, you have the following rights:

• Access & correction. Under IPP 6 and IPP 7 of the Privacy Act 2020, you may ask for access to, and correction of, personal information we hold about you. You can view and edit much of your information directly in the App.
• Export. You can export your data from within the App at any time.
• Deletion. You can delete your account and data as described in section 11.
• Communication choices. You can manage notification preferences in the App. Any optional or promotional messages will include a way to opt out (such as an unsubscribe link), and we comply with applicable anti-spam laws, including the Unsolicited Electronic Messages Act 2007 (New Zealand). Note that we may still send you essential service messages (such as sign-in codes and important legal or security notices) that are necessary to provide the App, and that you cannot opt out of.

Where the GDPR or other laws apply to you, you may also have rights to restrict or object to certain processing, to data portability, to withdraw consent, and to lodge a complaint with a supervisory authority (see section 17).

To exercise any right, contact us at [email protected]. We may need to verify your identity before acting, and we will respond within the time required by applicable law (for access requests under the Privacy Act 2020, within 20 working days of your request). There is generally no charge, although we may charge a reasonable fee, or decline a request, where the law permits (for example, if a request is manifestly unfounded or excessive).

13Children

The App is not intended for, or directed at, children under 16 years of age, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will take reasonable steps to delete it.

14Cookies, analytics & tracking

The Katana app does not use third-party advertising networks, and does not track you across other apps or websites for advertising. We do not sell or share your information with data brokers.

Our website (trykatana.app) is a simple informational site. It loads web fonts from Google’s font service to display correctly, which may involve your browser contacting that service; we do not use it to set advertising cookies. Any analytics we may use on the website is limited and privacy-respecting, and we will update this Policy if that changes.

15Automated processing

The App performs automated calculations on the figures you enter (for example, working out a budget, “safe to spend” amount, projected savings or goal progress). These are arithmetic presentations of your own inputs, not decisions that produce legal or similarly significant effects on you, and they do not constitute advice (see our Terms & Conditions). We do not engage in automated decision-making of the kind restricted by Article 22 of the GDPR.

16Data breaches

If a privacy breach occurs that it is reasonable to believe has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020, and will comply with any equivalent notification obligations under other applicable laws.

17Region-specific rights

New Zealand

This Policy is designed to comply with the Privacy Act 2020. You may complain to us first at [email protected], and if you are not satisfied, to the Office of the Privacy Commissioner (privacy.org.nz).

European Economic Area & United Kingdom

If you are in the EEA or UK, the GDPR gives you rights of access, rectification, erasure, restriction, objection and data portability, and the right to withdraw consent and to complain to your local data protection authority. Our legal bases are set out in section 5. We are established in New Zealand, which the European Commission has recognised as providing an adequate level of data protection.

California & other US states

We do not “sell” or “share” personal information as those terms are defined under the California Consumer Privacy Act (as amended) or comparable US state laws, and we do not use personal information for cross-context behavioural advertising. Where such laws apply, you may have rights to know, access, correct and delete personal information, which you can exercise as described in section 12, and you will not be discriminated against for exercising them.

18Changes to this Policy

This Policy is versioned. We may update it from time to time — for example, to reflect new features, providers, or changes in law. When we make a material change, we will publish the updated Policy here with a new version number and, where appropriate, notify you or ask you to accept the updated Policy in the App. The current version and effective date appear at the top of this page. Your continued use of the App after an updated Policy takes effect constitutes your acceptance of it, to the extent permitted by law.

19How to contact us & complaints

If you have any questions, requests or complaints about privacy, please contact our privacy contact:

Shogun Ventures Limited
Registered office: Suite 1243, Unit A, Level G, 26 Hobson Street, Auckland 1010, New Zealand
NZBN: 9429051904760
Email: [email protected]

We take privacy concerns seriously and will work with you in good faith to resolve them. If we cannot, you may contact the relevant authority for your region (see section 17).

By using Katana you acknowledge that you have read and understood this Privacy Policy.