Privacy Policy

Review status

This is a product and engineering draft prepared for Australian privacy and Consumer Data Right review. It accurately describes the replacement-app design, but it is not a substitute for approval by Moolah's legal adviser and CDR principal before a production real-data rollout.

Using Moolah does not create a blanket consent to every data use. Where consent is required—for example, Open Banking access, optional AI processing, notifications or marketing—we ask separately and you can change the relevant choice.

1. Who we are and what this policy covers

Moolah Personal Finance Pty Ltd provides personal and household money-management tools, including Cashflow, Forecast, Goals, Net Worth, Plan and Moolah AI.

This policy covers the Moolah mobile, web and beta services. Open Banking data is also governed by the consent you provide and Basiq's current Consumer Data Right policy.

• Company: Moolah Personal Finance Pty Ltd, 11 Conti Drive, Mount Duneed VIC 3217, Australia.
• Privacy contact: ryan@moolah.so.
• CDR: the Consumer Data Right framework that applies to consented Open Banking data.
• CDR data includes data collected through Open Banking and may include data derived from it where the CDR rules apply.

2. Information we collect

3. Why we use information

We use information only where it is reasonably necessary to:

• Create and secure your account and household.
• Provide Cashflow, Forecast, Goals, Net Worth, Plan and the features you request.
• Import and reconcile supported data from the existing Moolah service during an approved migration.
• Generate calculations, classifications and insights from the information available to the selected feature.
• Deliver service messages, requested invitations, alerts and support.
• Operate subscriptions, prevent abuse, diagnose faults, monitor security and improve reliability.
• Meet legal, accounting, privacy, CDR and regulatory obligations.

We do not sell personal information or CDR data. We do not use CDR data for direct marketing.

4. Open Banking and CDR data

Moolah's existing connected-finance service uses Basiq Pty Ltd, an Accredited Data Recipient, for consented read-only Open Banking access. Basiq's current published CDR policy identifies Moolah as a CDR representative.

The replacement Supabase-based app keeps new Open Banking connections disabled until the exact production application, representative arrangement, consent policy, callbacks, receipts, webhook and retention controls are confirmed. Existing Xano/Basiq connections remain under the existing live service while an approved migration is reconciled.

• You choose the institutions, accounts, data types, purpose and duration shown in the consent flow.
• Moolah uses connected data only for the purposes covered by that consent, such as tracking, forecasting, goals and net-worth views.
• Moolah does not receive or store your bank password. Authentication occurs through the bank/provider flow.
• Moolah cannot move money or change your bank account.
• Collection stops when consent is withdrawn or expires. Deletion or de-identification then follows your election, applicable law and the representative arrangement.

• Read Moolah's CDR handling summary
• Read Basiq's current CDR policy

5. Optional AI processing

Moolah AI is optional. Where a request needs personal or financial context, Moolah asks for a separate provider-processing choice and limits the data sent to the context needed to answer that request.

Moolah records privacy-minimised usage, safety and cost evidence. We do not use your personal financial information to build an unrelated advertising profile.

6. Service providers and processing locations

Providers used for relevant parts of the service may include:

• Xano for the existing live backend and controlled migration or rollback continuity.
• Supabase for replacement-app authentication, databases, functions and storage.
• Basiq for Open Banking access, consent and provider lifecycle handling.
• Twilio for authentication and invitation SMS delivery.
• Google Firebase for push delivery, crash reporting and app diagnostics.
• RevenueCat, Apple and Google for subscriptions, purchase status, app distribution and TestFlight or Play testing.
• OpenAI for an optional Moolah AI request when the required processing choice is active.
• Stripe for supported billing or partner-payment surfaces.
• Google Analytics and Meta tools on relevant web pages where configured and permitted.

Moolah's primary replacement database is configured in Australia. Some providers may process limited information in other countries where they or their subprocessors operate. We assess the information sent, purpose, access controls and contractual safeguards rather than claiming that every service datum always remains in Australia.

7. Retention and deletion

Moolah's current engineering retention model is:

• Account and product data: retained while your account is active. A confirmed whole-account deletion has a 30-day recovery period, then deletes the supported product-data graph and Auth identity once provider, shared-household, storage and legal-retention checks pass.
• CDR data: retained only while needed for the consented purpose and any period required by the CDR rules or representative arrangement. Collection stops on withdrawal or expiry; eligible data is then deleted or de-identified according to the recorded election.
• Security and signed-webhook evidence: privacy-minimised metadata, without raw financial payloads, retained for 400 days.
• SMS delivery evidence: provider status only, without message content or the destination phone number, retained for at least 30 days.
• Migration evidence: hashed identifiers, counts and reconciliation totals only, retained for a bounded rollback and assurance period. Raw migration packages are kept out of customer-facing storage and destroyed when no longer required.
• Billing, sales and narrowly required deletion or compliance evidence: retained for up to six years where required for accounting, legal, dispute or regulatory purposes. Product content is not retained wholesale merely because this evidence is required.
• Backups: removed through the provider's bounded backup lifecycle. Restored systems remain isolated until withdrawals and deletions since the restore point are reconciled.

Deletion can be delayed where another active household member's data would be affected, a provider withdrawal is incomplete, a legal hold applies or a narrow statutory record must be retained. Moolah records the reason and deletes the remaining eligible data as soon as the blocker is resolved.

8. When information is disclosed

We disclose information only:

• To a provider that needs it to deliver a feature you use.
• With your direction or consent.
• To an authorised member of your household for information covered by their role.
• Where required or authorised by law, a court, regulator or CDR obligation.
• To investigate fraud, security incidents or a serious threat where permitted by law.

A household invitation does not itself disclose financial data. Access begins only after the invited person verifies their identity and the household role is accepted.

9. Your choices and rights

Subject to applicable law, you can:

• Access the personal information we hold about you.
• Ask us to correct information that is inaccurate, incomplete or out of date.
• Change notification, marketing and optional AI-processing choices.
• Manage or withdraw Open Banking consent.
• Request deletion or de-identification where available.
• Close your account or make a privacy or CDR complaint.

We aim to acknowledge and handle privacy requests within 30 days. Identity verification or a fresh sign-in may be required before a sensitive request is completed.

10. Security

Controls used for the replacement service include:

• Encryption in transit and managed encryption at rest.
• Verified phone sign-in, session controls and step-up checks for sensitive actions.
• Row-level access controls, least-privilege service boundaries and privacy-minimised logs.
• Signed provider webhooks, replay protection, bounded retries and fail-closed feature gates.
• Monitoring, incident response and deletion controls.

No online service can guarantee absolute security. If you believe your account or information is at risk, contact ryan@moolah.so promptly and do not email passwords, bank credentials or unnecessary account details.

11. Children

Moolah is not intended for people under 18. We do not knowingly create a financial-data account for a child. Contact us if you believe a child's information has been provided so we can investigate and remove it where required.

12. Complaints

Send a privacy or CDR complaint to ryan@moolah.so with enough information for us to identify the issue. Do not include passwords, banking credentials or unnecessary financial details.

If the complaint concerns Open Banking, you can also use the complaint channels in Basiq's current CDR policy. If you are not satisfied with the response, you may contact the Office of the Australian Information Commissioner.

• Office of the Australian Information Commissioner
• Basiq CDR policy and complaint information

13. Changes to this policy

When this policy changes, we will:

• Update the date and retain a version reference.
• Provide an in-app or direct notice where a change is material.
• Ask again where a new use requires a fresh consent rather than relying on continued use.

14. Contact us

Moolah Personal Finance Pty Ltd, 11 Conti Drive, Mount Duneed VIC 3217, Australia.

Privacy and CDR contact: ryan@moolah.so.