Privacy Policy

Last Updated: 21 June 2026

Wealthra Pty Ltd (ACN 693 425 393) (“we”, “us”, or “our”) operates a website and personal financial management application (“the Service”) that helps you manage your finances, including AI-powered tools that answer questions and provide coaching on your finances. We are committed to protecting your privacy and handling your personal information in accordance with Australian law, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and the Consumer Data Right (CDR) framework where applicable. We are a CDR Representative operating under the accreditation of our principal Accredited Data Recipient (ADR), Basiq Pty Ltd.

This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information, including CDR data (such as banking information) obtained under Australia's open banking regime. By using the Service, you agree to the practices described in this Policy. It should be read together with our Terms of Service and our CDR Consent Policy.

1. What personal information we collect

We collect personal information that is reasonably necessary for our functions and activities. The kinds of information we may collect include:

• Identification & contact: Name, date of birth, residential address, email, phone number.
• Financial & banking: Account details, balances, transaction history, payment details, income, expenses, and credit information. This may include CDR data such as product, account and transaction data.
• Device & usage: IP address, browser type, device identifiers, location data (if enabled), and interaction/analytics data.
• AI interactions: Questions you ask our AI tools and the coaching context you provide (de-identified before processing — see Section 4).
• Other: Preferences, feedback, or information you provide voluntarily.

We do not collect sensitive information (for example, health data or racial origin) unless it is reasonably necessary and you consent, or as otherwise permitted by law.

2. How we collect your personal information

• Directly from you: when you register, use the Service, provide consent for data sharing, or contact us.
• Via open banking (CDR): with your explicit consent, from your accredited data holder (e.g., your bank) through secure APIs.
• From third parties: such as credit reporting bodies (with your consent), service providers, or publicly available sources.
• Automatically: through cookies and analytics tools (see Section 9).

3. Why we use your information

We use and disclose your personal information only for the primary purpose for which it was collected, for related secondary purposes you would reasonably expect, with your consent, or as required or permitted by law. Primary purposes include:

• Providing and improving the Service, including budgeting tools, financial insights and AI coaching;
• Managing your account and responding to your enquiries;
• Using CDR data to deliver personalised financial management features; and
• Meeting our legal, regulatory and security obligations.

We will not use CDR data for direct marketing unless you expressly consent, and we will not sell your data.

4. AI tools and automated processing

The Service includes AI-powered features that let you ask questions about your finances and receive coaching and insights (“AI Tools”). To provide these features we process information about your finances and the questions you ask.

• De-identified by design: information is de-identified before it is processed by our AI Tools, so the data handled by these tools contains no information that identifies you personally.
• Confidential and not used for training: we contractually require our AI-processing providers to keep data confidential, use it only to provide the feature, and not use your personal information to train their own models.
• Guidance, not personal advice: AI Tools provide general information and coaching to help you understand your finances. They do not provide personal financial, tax or legal advice, and outputs may contain errors — you remain responsible for your financial decisions. No output from the Wealthra product should be interpreted as general or specific financial advice in any way.
• No significant automated decisions: we do not use AI Tools to make decisions that produce legal or similarly significant effects on you without human involvement. If this changes, we will update this Policy to describe the personal information used and the kinds of decisions made, consistent with the automated decision-making transparency requirements commencing 10 December 2026.
• Your control: you can choose not to use AI Tools and can contact us with any questions about how they work.

5. Consent under the CDR (open banking)

If you choose to share CDR data:

• We will seek your explicit, informed, voluntary and time-limited consent;
• The consent process will clearly state what data is shared, how it will be used, who will access it, and the duration (up to 12 months);
• You can view, amend or withdraw your consents at any time via our CDR dashboard; and
• Withdrawal stops further collection and use, although we may retain data where required by law.

CDR data is handled in accordance with the CDR Rules and the CDR privacy safeguards. For more detail, see our CDR Consent Policy.

6. How we share your information

We never sell your personal information, and we never disclose it to third parties for their own marketing. We share your information only as set out below, and we require recipients to protect it, use it only for the purposes we specify, and keep it confidential.

We may also disclose information to professional advisers and to a successor entity in the event of a business sale or restructure, subject to confidentiality and this Policy.

7. Overseas storage and disclosure

We store personal information on secure servers located in Singapore. Some of our service providers (including our analytics provider) may also store or process limited data in other countries. Before disclosing your personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles.

CDR data is handled in accordance with the CDR Rules, including the rules that apply to the use of overseas service providers.

8. Storage, security and our privacy commitment

Protecting your financial information is central to how Wealthra is built.

• Encryption: all personal and financial data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Access controls: role-based access, multi-factor authentication for staff, firewalls, logging, regular security audits and staff training.
• We never sell your data, and we never share it for third-party marketing.
• Data breaches: if a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in line with the Notifiable Data Breaches scheme.

While we take reasonable steps to protect your information, no method of transmission or storage is completely secure; we cannot guarantee absolute security but are committed to industry-standard protection.

9. Cookies and analytics

We use cookies and similar technologies for authentication, security, preferences and analytics. We use Google Analytics to understand how the Service is used and to improve it. Google Analytics sets cookies and may transfer usage data (such as a de-identified device identifier and IP address) to Google's servers overseas; its handling of that data is governed by Google's own privacy terms.

You can manage or disable cookies through your browser settings, and you can opt out of Google Analytics using Google's browser opt-out add-on. Disabling some cookies may affect functionality.

10. Direct marketing

We may send you service communications and, where permitted, marketing about Wealthra features. You can opt out of marketing at any time using the unsubscribe link or by contacting us. We will not use CDR data for direct marketing unless you expressly consent.

11. Anonymity and pseudonymity

Where it is lawful and practicable, you may deal with us anonymously or using a pseudonym — for example, for general enquiries. However, to provide the core Service, particularly identity verification and open-banking (CDR) features, we need to be able to identify you.

12. Children

The Service is intended for individuals aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

13. Users outside Australia

Wealthra is designed for Australian residents and is governed by Australian law. If you access the Service from outside Australia, you do so on your own initiative and are responsible for compliance with local laws. If you are located in the European Union or United Kingdom and we knowingly provide the Service to you, additional rights may apply under the GDPR or UK GDPR (including rights of access, rectification, erasure, portability and objection, and the requirement for a lawful basis); contact us to exercise them.

14. Access, correction and complaints

You have the right to access and correct the personal information we hold about you. Our Privacy Officer handles privacy enquiries and complaints.

• Email: privacy@wealthra.io
• Post: Level 10, 95 North Quay, Brisbane QLD 4000

We will acknowledge requests promptly and respond within 30 days. If you believe we have breached your privacy or the CDR Rules, please contact us first. If you are not satisfied, you can complain to:

• OAIC: oaic.gov.au or 1300 363 992
• ACCC (CDR matters): accc.gov.au

15. Retention

We keep your information only for as long as necessary for the purposes described in this Policy, or as required by law (for example, seven years for certain financial records). When information is no longer required, we securely delete or de-identify it.

16. Changes to this Policy

We may update this Policy to reflect changes in our practices or the law. Changes will be posted on our website with an updated effective date. Continued use of the Service after changes take effect constitutes acceptance.

Contact us

For questions or requests, contact our Privacy Officer at privacy@wealthra.io, or for CDR-specific enquiries use the CDR dashboard in the app.