Privacy policy

Last updated: 24 July 2026

WhatIf (“we”, “us”) is a personal financial decision simulator operated in New Zealand. This policy explains what personal information we collect, how we use and protect it, and your rights under the Privacy Act 2020. WhatIf is an early product and we will keep this policy up to date as it grows.

What we collect

• Account information: your email address, to sign you in. If you sign in with Google, we receive your name, email, and a profile identifier from Google.
• Financial information you enter: the figures you provide to build your plan — age, income, spending, savings, KiwiSaver, investments, debts, home value, goals, and the WhatIf scenarios you create. You choose what to enter.
• Technical information: minimal, non-identifying operational data (such as error and performance logs) needed to run the service. We do not log your financial values, your email address, or the content of your entries.

What we do not do

• We do not sell your information.
• We do not use it for advertising or share it with advertisers.
• We do not provide personalised financial advice — WhatIf is an illustrative simulator.

How we use it

Only to provide the service: to save your plan and scenarios, calculate your illustrative projections, and let you sign in. Nothing else.

Where it is stored and who processes it

Your data is stored securely in Microsoft Azure (Australia/New Zealand region), with secrets held in a managed key vault and access restricted. We rely on a small number of processors purely to run the service:

• Microsoft Azure — hosting and database.
• Google— only if you choose “Continue with Google”.
• Resend — to send your sign-in emails.
• Azure OpenAI (when enabled) — to interpret plain-English scenario descriptions. It never performs your calculations and is not sent your identity.

Security

We use encryption in transit and at rest, managed identities and a key vault for secrets, server-side authorisation on every request, and rate limiting. No system is perfectly secure, but we take protecting your financial information seriously.

Your rights (Privacy Act 2020)

• Access and export all your data — a JSON download from your account page.
• Correct it any time by editing your baseline.
• Delete your account and all associated data from your account page.

Cookies

We use a single essential cookie to keep you signed in. We do not use advertising or third-party tracking cookies, and we do not run analytics that capture your financial values.

Children

WhatIf is intended for adults managing their own finances and is not directed at children.

Changes

We will update this policy as the product evolves and post the new date above.

Contact

Questions or requests: privacy@whatif.co.nz.