Effective: September 22, 2026 | Last updated: September 22, 2026

Privacy Policy

1. Overview

Oweize ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect, how we use and disclose it, your rights, and how to contact us.

Oweize is a personal finance application that helps users track shared expenses, split bills, and manage budgets. The app does not process payments, move money, or act as a financial institution. Users record payments that occur through external services (e.g., Venmo, Zelle, bank transfers, cash).

By using Oweize, you consent to the practices described in this policy. If you do not agree, do not use the app.

2. Information We Collect

2.1 Information You Provide Directly

Account information: Full name, email address, phone number (with country code), preferred currency -- used for account creation, authentication, notifications, and friend matching.
Profile information: Gender (optional), profile avatar (optional) -- used for avatar generation and user identification.
Authentication data: Google ID (if using Google Sign-In), Apple ID (if using Apple Sign-In) -- used for social login.
Financial information (user-entered): Expense descriptions, amounts, categories, income sources, settlement records, payment method handles (e.g., Venmo username, Zelle phone/email, CashApp handle, UPI ID, bank transfer details) -- used for expense splitting, budget tracking, and displaying payment information to friends.
User-generated content: Receipt images, bank/credit card statements (CSV or PDF), expense notes, group names -- used for receipt parsing, expense verification, and budget analysis.
Contacts (optional): Phone numbers and email addresses from your device contacts -- used for finding friends already on Oweize.
Communications: Support requests, feedback, survey responses -- used for customer support and product improvement.

2.2 Information Collected Automatically

Device and technical data: Device type, operating system version, device name, device push token (Expo), platform (iOS/Android/Web), IP address -- used for session management, push notifications, rate limiting, and security.
Usage and analytics data: Page views, browser information, interaction data, app usage patterns -- collected via Segment (web) and Mixpanel (mobile app and server) for analytics and product improvement. In the mobile app, analytics data includes events such as expense creation, group creation, subscription changes, and app usage patterns, along with your user ID and platform.
Financial data (via Plaid): Bank account names, types, balances, credit limits, transaction history (up to 730 days), merchant names, amounts, dates, and locations -- used for budget tracking dashboard and automated expense categorization.

2.3 Information from Third Parties

Google: Google user ID, email, name, profile picture URL -- received during Google Sign-In.
Apple: Apple user ID, email -- received during Apple Sign-In.
Plaid: Bank account and transaction data (see Section 2.2) -- received for the Budget feature.

3. How We Use Your Information

We use your personal information for the following purposes:

Provide and operate the service: Account creation, authentication, expense splitting, budget tracking, friend matching, notifications.
Communicate with you: Transactional emails (login OTP, welcome emails, account notifications), SMS OTP verification, support responses.
Improve the product: Analytics, usage analysis, feature development, bug fixes.
Security and fraud prevention: Rate limiting, session management, detecting unauthorized access.
Legal compliance: Responding to legal requests, complying with applicable laws and regulations.

We do not sell your personal information to third parties.

4. How We Disclose Your Information

4.1 Service Providers

We share personal information with the following third-party service providers to operate the app:

Plaid: Bank account connection and transaction retrieval. Data shared: internal user ID, country codes. Plaid receives bank credentials directly from you.
Twilio: SMS OTP verification. Data shared: phone number and OTP message content.
SendGrid: Transactional and marketing emails. Data shared: email address, name, OTP codes, promotional codes.
Expo: Push notifications. Data shared: device push token, notification content.
AWS S3: File storage for profile avatar images and receipt images.
AWS Bedrock (Claude AI): AI-powered data extraction from receipts and bank statements. Data shared: receipt images, bank/credit card statement content.
Google: Google Sign-In authentication.
Apple: Apple Sign-In authentication.
Segment: Web analytics. Data collected: IP address, browser info, page views, usage patterns.
Mixpanel: Mobile app and server-side analytics. Data collected: user ID, platform, app usage events (e.g., expense creation, group creation, subscription changes), subscription tier.
Vercel: Hosting, backend API, scheduled tasks.

4.2 Other Disclosures

We may also disclose your personal information:

With your consent: For example, when you choose to share payment method handles with friends.
To protect rights and safety: If we believe disclosure is necessary to prevent fraud, protect our rights, comply with law, or respond to legal process.
Business transfers: In connection with a merger, acquisition, or sale of assets, subject to appropriate privacy protections.

5. SMS Communications

Oweize sends SMS messages solely for phone number verification (one-time passcodes). By providing your phone number and requesting a verification code, you consent to receive these messages.

Message frequency: One SMS per verification attempt. Oweize does not send recurring, marketing, or promotional SMS messages.
Message and data rates: Standard message and data rates from your wireless carrier may apply.
Opt-out: You may opt out of SMS messages at any time by replying STOP to any message from Oweize. After opting out, you will no longer receive SMS verification codes. You may still use the Service in countries where SMS verification is not required.
Help: For SMS-related support, reply HELP to any message or contact us at support@oweize.com.
Carriers supported: SMS delivery is supported on major US and Canadian carriers and most international carriers. Carrier-specific terms and conditions may apply.
Data shared with Twilio: Your phone number and the verification message content are shared with Twilio, our SMS delivery provider. See Twilio's privacy policy for details on how they handle this data.

6. AI-Powered Processing of Financial Documents

Oweize uses AI (Claude Sonnet 4.5 via AWS Bedrock) to extract data from receipt images and bank/credit card statements (CSV or PDF), including merchant names, amounts, categories, dates, and line items.

Financial documents containing sensitive data are processed by AI within the configured AWS region.
AI extraction may be inaccurate. You should review and verify all extracted data.
You can use Oweize without uploading receipts or statements, but certain features may be limited.
You can delete uploaded documents and extracted results through the app or by contacting us.

7. Data Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law.

Active user account data: Retained while your account is active.
Deleted user audit record: Name, email, phone, signup method, currency, signup date, and deletion date retained for fraud prevention, legal compliance, and dispute resolution.
Plaid access tokens: Deleted when you disconnect your bank or delete your account; revoked on Plaid servers upon account deletion.
Split expenses (user-created): Soft-deleted on account deletion to preserve shared records for other participants.
Split expenses (as participant): Your user ID anonymized; expense retained for other participants.
Settlements: Anonymized for active groups; hard-deleted for deactivated groups.
OTP data: Auto-expires after 1 hour.
Imported bank statements: Stored until you request deletion.
Receipt images: Stored in AWS S3; deleted when associated expense is deleted, subject to backup retention.

When you delete your account, we delete or anonymize your personal information as described above. Some information may remain where necessary to preserve shared records for other users, prevent fraud or abuse, comply with legal obligations, resolve disputes, or maintain security and accounting records.

8. Your Rights

Depending on your location, you may have the following rights:

Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete information.
Deletion: Request deletion of your personal information, subject to legal and operational exceptions.
Portability: Request a copy of your data in a structured, commonly used format.
Restriction: Request that we limit how we use your personal information.
Objection: Object to certain processing activities.
Withdraw consent: Withdraw consent for optional processing (e.g., marketing emails).

To exercise your rights, contact us at support@oweize.com. We will respond within 30 days, or as required by applicable law. We may need to verify your identity before processing your request.

If you have a privacy complaint, you may contact us directly. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada, the UK Information Commissioner's Office (ICO), your national data protection authority in the EU, or your local privacy regulator.

9. Security

We implement reasonable technical and organizational measures to protect your personal information, including encryption of financial tokens at rest (AES-256-GCM), password and OTP hashing, JWT-based authentication, API rate limiting, CORS allowlisting, HTTPS everywhere, session management with remote revocation, and time-limited access to stored files.

No security measure is perfect. We cannot guarantee absolute security, and you use the service at your own risk.

10. Children's Privacy

Oweize is not intended for children under 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us, and we will take steps to delete it.

11. Cross-Border Data Transfers

Oweize is based in Canada. Your personal information may be transferred to and processed in countries other than your country of residence, including Canada and the United States. Our hosting infrastructure (Vercel), file storage (AWS S3), AI processing (AWS Bedrock), SMS delivery (Twilio), email delivery (SendGrid), push notifications (Expo), and analytics services (Mixpanel, Segment) are operated by companies based in the United States. Our database (MongoDB) is hosted on cloud infrastructure that may be located in the United States.

These countries may have data protection laws that differ from those of your country of residence. We implement appropriate safeguards to ensure your personal data remains protected in accordance with this Privacy Policy and applicable law:

Canada: The European Commission has recognized Canada as providing an adequate level of data protection for organizations subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). The United Kingdom has similarly recognized Canada as adequate.
United States: For transfers to US-based service providers, we rely on the EU-U.S. Data Privacy Framework (where the provider is DPF-certified), Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Agreement or UK Addendum to the EU SCCs (for UK data transfers), and contractual data processing agreements requiring equivalent protections.
Technical safeguards: All data transfers occur over encrypted connections (TLS/HTTPS). Financial tokens are encrypted at rest (AES-256-GCM). Access to personal data is restricted to authorized personnel and systems on a need-to-know basis.

For users in the EEA and UK, additional detail on transfer mechanisms and your rights regarding international transfers is provided in the "European Economic Area and United Kingdom" section under "Additional Disclosures." You may request a copy of the safeguards we use for international transfers by contacting us at support@oweize.com.

12. Cookies and Analytics

Our website and web application use analytics services (Google Analytics and Segment). These services collect page views, browser information, IP addresses, and usage patterns. We request your consent before loading analytics cookies. You can manage your preference through the cookie consent banner or your browser settings. Disabling cookies may limit certain features. Our mobile app uses Mixpanel for product analytics. Mobile analytics is activated after you accept our Terms of Service and Privacy Policy. Mixpanel collects usage events (such as expense creation and subscription changes), your user ID, and platform. We do not share personally identifiable information with Mixpanel beyond what is necessary for analytics. You may request deletion of your analytics data by contacting us.

13. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by updating the date at the top of this page, posting an in-app notice or banner, or sending an email notification. Your continued use of Oweize after changes constitutes acceptance of the updated policy.

14. Additional Disclosures

California (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information is collected, used, shared, or sold; to delete personal information (subject to exceptions); to opt-out of the sale or sharing of personal information (we do not sell or share personal information as defined by CCPA); and to non-discrimination for exercising privacy rights. Contact us at support@oweize.com.

European Economic Area and United Kingdom

This section applies to you if you are located in the European Economic Area ("EEA"), the United Kingdom ("UK"), or Switzerland. In this section, references to "GDPR" mean the General Data Protection Regulation (EU) 2016/679 and, where applicable, the UK General Data Protection Regulation as retained under the UK Data Protection Act 2018, and the Swiss Federal Act on Data Protection. Where this section conflicts with other parts of this Privacy Policy, this section prevails for EEA, UK, and Swiss users.

Data Controller

The data controller responsible for your personal data is Oweize, operated by Parth Patel, with a principal place of business at Kitchener, Ontario, Canada. You can contact the data controller at support@oweize.com.

Legal Bases for Processing

We process your personal data only where we have a valid legal basis under Article 6 of the GDPR. The legal bases we rely on depend on the specific processing activity:

Performance of a contract (Article 6(1)(b)): We process your account information (name, email, phone number, currency preference), authentication data, user-entered financial information (expenses, settlements, income sources, payment method handles), group membership data, and friend connections as necessary to perform our contract with you and provide the Oweize service. This includes account creation, expense splitting, balance calculations, settlement recording, budget tracking, push notifications related to your account activity, and customer support.
Consent (Article 6(1)(a)): We rely on your explicit consent for the following processing activities: connecting your bank account via Plaid and retrieving financial data (account balances, transaction history); processing receipt images and bank statements using AI (AWS Bedrock / Claude); importing your device contacts for friend matching; sending marketing or promotional emails; and loading analytics cookies on our website. You may withdraw your consent at any time (see "Withdrawing Consent" below), without affecting the lawfulness of processing based on consent before its withdrawal.
Legitimate interests (Article 6(1)(f)): We process certain data where necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Our legitimate interests include: operating and improving the service (usage analytics via Mixpanel on the mobile app and server, aggregated usage patterns); maintaining the security and integrity of the service (rate limiting, session management, fraud detection, IP address logging); and enforcing our Terms of Service. Where we rely on legitimate interests, you have the right to object (see "Right to Object" below).
Legal obligation (Article 6(1)(c)): We process personal data where necessary to comply with applicable legal obligations, including responding to lawful requests from public authorities, maintaining records required by tax or financial regulations, and fulfilling our obligations under data protection law.

Plaid and Bank Data: Controller Relationship

When you connect a bank account through Plaid, Plaid acts as an independent data controller for the bank connection, authentication, and initial data retrieval process. In the United Kingdom, Plaid Financial Ltd (FCA authorization #804718) operates as an authorized Account Information Service Provider under the Payment Services Regulations 2017. In the EEA, Plaid B.V. (DNB authorization #R179714) operates as an authorized Account Information Service Provider under the Payment Services Directive 2 (PSD2). Plaid processes your bank credentials and financial data under its own privacy policy and legal bases. Oweize does not receive or store your bank login credentials.

Once Plaid retrieves your financial data with your consent, Plaid shares that data with Oweize. Oweize then acts as an independent data controller for all subsequent processing of that financial data (categorization, budget tracking, display, storage, and AI-assisted analysis). You should review Plaid's End User Privacy Policy at plaid.com/legal for information on how Plaid processes your data.

Consent Renewal for Bank Connections (PSD2/Open Banking)

Under PSD2 and UK Open Banking regulations, your consent to access bank account information must be renewed periodically. Your bank connection consent expires after a maximum of 180 days (or such shorter period as required by your financial institution or applicable regulation). Before your consent expires, we will notify you via the app or email and request that you re-authenticate your bank connection through Plaid. If you do not renew your consent, we will no longer be able to retrieve new transaction data from your bank, though previously retrieved data will remain in your account unless you request its deletion. You may disconnect your bank account at any time through the app settings.

International Data Transfers

Oweize is established in Canada and uses service providers located in the United States and other countries outside the EEA and UK. When your personal data is transferred outside the EEA or UK, we ensure that appropriate safeguards are in place as required by Chapter V of the GDPR (Articles 44 to 49):

Transfers to Canada (Oweize): The European Commission has recognized Canada as providing an adequate level of data protection for transfers to organizations subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) (Commission Decision 2002/2/EC). As a Canadian commercial entity subject to PIPEDA, transfers of your personal data to Oweize in Canada are covered by this adequacy decision. For UK transfers, the UK has similarly recognized Canada as an adequate jurisdiction.
Transfers to the United States (sub-processors): Several of our service providers are based in the United States, including Vercel (hosting), AWS (file storage, AI processing), Twilio (SMS), SendGrid (email), Mixpanel (analytics), and Segment (web analytics). For these transfers, we rely on one or more of the following mechanisms: (a) the EU-U.S. Data Privacy Framework ("DPF"), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, where the recipient is certified under the applicable framework; (b) Standard Contractual Clauses ("SCCs") adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), supplemented by additional technical and organizational measures where necessary based on a transfer impact assessment; and (c) for UK transfers, the International Data Transfer Agreement ("IDTA") or the UK Addendum to the EU SCCs, as issued by the UK Information Commissioner's Office.
Supplementary measures: In addition to the legal transfer mechanisms above, we implement technical safeguards including encryption of financial tokens at rest (AES-256-GCM), encryption in transit (TLS/HTTPS), access controls, and contractual obligations on sub-processors to maintain equivalent data protection standards.

You may request a copy of the relevant transfer mechanism (including SCCs) by contacting us at support@oweize.com.

Your Rights Under the GDPR

As a data subject in the EEA or UK, you have the following rights under the GDPR. These rights are not absolute and may be subject to limitations and conditions set out in the GDPR.

Right of access (Article 15): You have the right to obtain confirmation as to whether we process your personal data, and if so, to request a copy of that data along with information about the purposes of processing, the categories of data, the recipients, the retention period, your rights, the source of data not collected from you, and the existence of automated decision-making. We will provide the first copy free of charge; additional copies may be subject to a reasonable administrative fee.
Right to rectification (Article 16): You have the right to request correction of inaccurate personal data and completion of incomplete personal data. You can correct most account information directly through the app (name, phone number, currency, payment methods). For data you cannot correct directly, contact us.
Right to erasure (Article 17): You have the right to request deletion of your personal data where: it is no longer necessary for the purpose it was collected; you withdraw consent and there is no other legal basis; you object to processing and there are no overriding legitimate grounds; the data has been unlawfully processed; or erasure is required by law. This right does not apply where processing is necessary for compliance with a legal obligation, establishment or defense of legal claims, or other exceptions in Article 17(3). Where your data is shared with others (such as shared expenses in groups), we will anonymize your participation rather than delete the shared records, as described in Section 7 of this Privacy Policy.
Right to restriction of processing (Article 18): You have the right to request that we restrict the processing of your personal data where: you contest the accuracy of the data (for a period enabling verification); the processing is unlawful and you prefer restriction over erasure; we no longer need the data but you require it for legal claims; or you have objected to processing pending verification of legitimate grounds.
Right to data portability (Article 20): You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format (JSON), and to transmit that data to another controller without hindrance. This right applies where the processing is based on consent or contract performance and is carried out by automated means.
Right to object (Article 21): You have the right to object at any time to the processing of your personal data based on our legitimate interests (Article 6(1)(f)). Upon receiving your objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for legal claims. You have an absolute right to object to processing of your personal data for direct marketing purposes.
Right to withdraw consent (Article 7(3)): Where we rely on your consent as the legal basis for processing, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. You can withdraw consent by: disconnecting your bank account in the app settings (for Plaid data access); deleting uploaded documents (for AI-processed receipts and statements); adjusting your marketing preferences in the app or clicking the unsubscribe link in any marketing email; or contacting us at support@oweize.com.
Right not to be subject to automated decision-making (Article 22): See "Automated Decision-Making and Profiling" below.

How to Exercise Your Rights

To exercise any of the rights described above, contact us at support@oweize.com. Please include sufficient information to verify your identity (the email address associated with your Oweize account and, if necessary, additional verification). We will respond to your request within one month of receipt. If your request is complex or we receive a large number of requests, we may extend this period by up to two additional months, in which case we will notify you of the extension and the reasons for it within the initial one-month period. If we decline to act on your request, we will inform you of the reasons and your right to lodge a complaint with a supervisory authority.

Automated Decision-Making and Profiling

Oweize uses AI (Claude Sonnet 4.5 via AWS Bedrock) to automatically categorize bank transactions and extract data from receipts and bank statements. This processing is automated but does not produce legal effects or similarly significant effects on you. Transaction categorization is used solely to organize your budget view and spending insights. You can review, edit, or override any AI-generated categorization at any time within the app. AI-extracted data from receipts and statements is presented for your review and is not acted upon without your confirmation. Oweize does not make automated decisions about your creditworthiness, financial standing, or eligibility for services. If you have concerns about automated processing, contact us.

Data Retention for EEA and UK Users

In addition to the retention periods described in Section 7 of this Privacy Policy, the following specific timeframes apply:

Active account data: Retained for the duration of your account and the provision of services.
Bank transaction data (Plaid): Retained while your bank account is connected and for 12 months after disconnection, to allow you to review historical budget data. Deleted upon account deletion or upon your request.
Plaid access tokens: Deleted immediately when you disconnect your bank or delete your account. Revoked on Plaid's servers upon account deletion.
Deleted account audit record: Name, email, phone, signup method, currency, signup date, and deletion date retained for up to 3 years after account deletion for the purposes of fraud prevention, legal compliance, and dispute resolution.
Shared expense records: Where you created or participated in shared expenses, your personal data in those records is anonymized upon account deletion. The anonymized records are retained for other participants.
Receipt images and uploaded statements: Deleted upon account deletion or upon your request. Backup copies may be retained for up to 30 days after deletion.
Analytics data: Mixpanel and Segment data is retained for up to 24 months, after which it is deleted or anonymized.
OTP verification data: Automatically deleted 1 hour after creation.
Support correspondence: Retained for up to 3 years after resolution for quality assurance and legal claim purposes.

Right to Lodge a Complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. You may lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, your place of work, or the place of the alleged infringement.

United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom. Website: ico.org.uk. Telephone: +44 (0)303 123 1113.
Ireland: Data Protection Commission (DPC), 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. Website: dataprotection.ie.
Other EU Member States: A full list of national data protection authorities is available on the European Data Protection Board website at edpb.europa.eu.

We encourage you to contact us first so that we can try to resolve your concern directly.

Canada (PIPEDA)

If you are in Canada, you have the right to access your personal information, challenge its accuracy, and request correction or deletion (subject to legal and operational exceptions). You may file a complaint with the Office of the Privacy Commissioner of Canada.

15. Contact

If you have questions or concerns about this privacy policy or your personal information, please contact our Privacy Officer:

Privacy Officer: Parth Patel, Founder
Email: support@oweize.com
Address: Kitchener, Ontario, Canada