Consumer Data Right Policy

What this policy covers

This Consumer Data Right ("CDR") Policy explains how Cleer Money handles the banking data you share with us under Australia's CDR (open banking) framework: what we collect, why, how long we keep it, and how you stay in control.

It supplements our Privacy Policy, which covers all other personal information. Where this policy and the Privacy Policy overlap in relation to CDR data, this policy applies.

Cleer Money is operated by Cleer Co Pty Ltd (ACN 699 655 948), a company registered in Australia, with its registered office in Maroochydore, Queensland, Australia.

Our arrangement with Fiskil

Cleer Money is not itself an accredited data recipient. We access CDR data as a representative / sponsored party under the CDR accreditation of Fiskil Pty Ltd, an accredited data recipient under the Competition and Consumer Act 2010 (Cth) and the Consumer Data Right rules administered by the ACCC and OAIC.

In practice this means:

• When you connect a bank, you give consent through Fiskil's CDR consent flow, and your bank authenticates you directly, so we never see your banking credentials.
• Fiskil retrieves your data from your bank under the CDR rules and passes it to Cleer Money strictly in accordance with the consent you gave.
• Both Fiskil and Cleer Money are bound by the CDR privacy safeguards in how that data is handled.

Fiskil's own CDR policy is available at fiskil.com.

What CDR data we collect, and why

With your consent, we collect the following CDR data:

CDR data is collected for the purpose of categorisation and insights only. We do not collect CDR data we don't need, and we do not ask for broader consents than the App requires.

Data minimisation & purpose limitation

• No marketing. CDR data is never used to market products or services to you.
• No profiling. CDR data is not used to build advertising or credit profiles about you.
• No sale. CDR data is never sold or disclosed to third parties for their own purposes.
• Minimum necessary. We request only the data clusters needed to operate the App, for the shortest period that delivers the service you asked for.

CDR data is stored securely on our cloud infrastructure (Supabase) with encryption in transit, row-level security, and access limited to authorised systems. See the Privacy Policy for our full security measures.

Withdrawing consent & deletion

You are always in control of your CDR data sharing. You can withdraw consent at any time, free of charge:

• In the App: Profile → your connected bank → Remove bank
• Via Fiskil's consent dashboard, where you can view and manage the data-sharing consents you have given
• Via your bank's data-sharing dashboard in its internet banking or app

Withdrawing CDR consent does not delete your Cleer Money account. You can keep using the App with CSV import, or reconnect a bank later.

Your rights over CDR data

• Access: ask us what CDR data we hold about you
• Correction: ask us to correct CDR data that is inaccurate, out of date or incomplete
• Deletion: withdraw consent and have your CDR data deleted within 7 days, as described above
• Visibility: review your active consents at any time in the App, Fiskil's consent dashboard, or your bank's dashboard

To exercise any of these rights, contact support@cleermoney.com.au. We respond within 30 days.

Complaints & escalation

Step 1: talk to us first. Email support@cleermoney.com.au with the subject "CDR complaint". We will acknowledge your complaint promptly and aim to resolve it within 30 days.

Step 2: escalate if unresolved. If you are not satisfied with our response, you can escalate at no cost:

You may also raise concerns about the CDR regime generally with the ACCC at cdr.gov.au.