Consumer Data Right policy

About this policy

This policy covers banking data you share with PersonaFi under the Consumer Data Right. It's separate from our privacy policy, which covers everything else we hold about you.

PersonaFi is a personal finance app run by G.P Filopoulos & P Filopoulos, a family partnership trading as PersonaFi (ABN 15 592 438 277), based in Dandenong North, Victoria.

Bank connections are provided by Fiskil Pty Ltd, an accredited data recipient under the CDR. With your consent, Fiskil collects your data from your bank and passes it to PersonaFi, which receives it as Fiskil's CDR representative. Fiskil's CDR policy also applies to how your data is handled.

We only collect and use your CDR data with your consent, and only to provide the PersonaFi service you've asked for.

What we collect and why

With your consent, we use this data to:

• sort your transactions into spending categories;
• forecast your cash month by month from your real balances and the income, bills and spending that repeat;
• compare your spending, income and savings with similar Australian households, using public figures from the Australian Bureau of Statistics;
• let you test "what if" changes against your own forecast;
• track changes you commit to against your usual spending;
• have your coach explain your numbers and answer your questions;
• send you low-cash alerts, if you turn them on.

We also create data from your CDR data, such as category totals, forecasts and comparisons. We handle this derived data the same way as the data it came from.

We don't use your CDR data for marketing, sell it, or use it to recommend financial products. PersonaFi provides modelling and general information, not financial advice.

Your consent

You choose which accounts to share and for how long, through Fiskil's consent screens, then confirm with your bank. Your consent lasts for the period you choose, up to 12 months. You can withdraw it at any time:

• by disconnecting the account in PersonaFi;
• through Fiskil's consumer dashboard; or
• through your bank's data-sharing dashboard.

If you withdraw consent, we stop receiving new data from that account and delete the CDR data we hold from it, as described in Deleting it. You can keep using PersonaFi with your other accounts or by uploading CSV files. There are no fees or penalties for withdrawing.

We or Fiskil will let you know when your consent is given, changed, about to expire, or withdrawn.

How we hold and protect it

• Where: your CDR data is stored only in Australia, on Google Cloud in Sydney (region australia-southeast1).
• Storage: held in Google BigQuery, which encrypts the data it stores.
• On the move: sent between Fiskil, PersonaFi and your browser over encrypted connections.
• Caching: some results are kept briefly in the app's memory so pages load faster. They're never written to disk and are cleared when the app restarts.
• Logs: our app logs are kept in Sydney and don't contain your transactions.
• Who can see it: only you, and PersonaFi's founder for support and maintenance, signing in with multi-factor authentication. Access is logged.

Who we share it with

We don't sell your CDR data or share it with advertisers, brokers, lenders or anyone else for their own use. These service providers handle it only to run their part of PersonaFi. None of them is accredited under the CDR, and each must delete the data as this policy requires.

Outside Australia. Your CDR data is stored only in Australia. The information described above for OpenAI and Resend is handled in the United States so they can provide their services. OpenAI doesn't use it to train its models and keeps it for up to 30 days to monitor for abuse.

We don't disclose CDR data to anyone else, in Australia or overseas, unless the law requires it.

Deleting it

We delete your CDR data when we no longer need it. We don't de-identify CDR data, and we don't use it for research.

Your CDR data is deleted when:

• you withdraw consent for an account;
• your consent expires and you don't renew it; or
• you delete your PersonaFi account.

How: we delete the CDR data, and the data we created from it, from our database. Deletion starts straight away and a daily check confirms it's done. Copies kept in the app's memory are cleared when it restarts, and Google's automatic recovery copies expire within 14 days. We keep only a record that the deletion happened (an ID and when).

Your right to ask for deletion: deletion is our default, so you don't need to ask. If you'd like confirmation, email privacy@personafi.com.au and we'll confirm in writing once it's done.

Accessing and correcting it

You can see your transactions, categories and forecasts in the app at any time, and download your data from Settings, then Download my data. You can also email privacy@personafi.com.au for a copy.

You can recategorise transactions and change how any forecast line works yourself. If the bank data itself is wrong, such as a transaction amount, contact your bank, since it comes from them. If you ask us to correct your CDR data, we'll reply within 10 business days, either correcting it or explaining why we can't.

Complaints

You can complain about how we handle your CDR data at any time, for free.

1. Tell us: email privacy@personafi.com.au with your name, the email address on your PersonaFi account, what happened, and what you'd like us to do.
2. We'll acknowledge it within 2 business days.
3. We'll investigate and reply in writing within 30 days. If we need longer, we'll tell you why and when to expect an answer.
4. Putting it right: depending on what we find, we may correct or delete data, change how we handle it, apologise, or explain why no change is needed.

If you're not satisfied, you can take your complaint to:

• the Australian Financial Complaints Authority (AFCA), a free, independent dispute resolution scheme: afca.org.au, 1800 931 678; or
• the Office of the Australian Information Commissioner (OAIC): oaic.gov.au, 1300 363 992.

You can also complain to Fiskil, as the accredited data recipient, using the details in Fiskil's CDR policy.

Contact us

Email privacy@personafi.com.au about anything on this page, or support@personafi.com.au for help with your account.

This policy is free. If you'd like a copy by email or in print, ask us and we'll send it the way you prefer.

If we change how we handle CDR data, for example by using a new service provider, we'll update this page and the date at the top.