Privacy Policy

FundFlow Group Pty Ltd ABN 36 694 667 386 Version: 2.2 Last Updated: 23 September 2026

---

1. Introduction

FundFlow Group Pty Ltd ("FundFlow", "we", "us", or "our") operates the FundFlow mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the App.

FundFlow is a personal finance application that helps you organize your spending through customizable category trees and multi-currency support. We connect to your bank accounts through a regulated third-party provider to retrieve your financial data. We use artificial intelligence to help with onboarding and to generate spending summaries and insights. Transaction categorization uses your choices, rules, and bank-provided information, not AI category suggestions.

Where we operate. The App is offered to users in the United States, Canada, and Australia. Which bank provider serves you depends on the country of the bank you connect:

Where your information is held. FundFlow Group Pty Ltd is an Australian company. We run separate application systems on Amazon Web Services for Australia in Sydney, Australia (ap-southeast-2) and for North America in Northern Virginia, United States (us-east-1). Australian bank data belongs in the Australian system. We operate one authentication service on AWS in Sydney for all users. Some supporting providers process information in other countries. Sections 5, 9, and 10 explain these locations and the limits on Australian financial-data processing.

By using FundFlow, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use the App.

---

2. Information We Collect

2.1 Account Information

When you create a FundFlow account, we collect:

• Email address
• Password (securely hashed; we never store plaintext passwords), or the identity information you authorize when you sign in with Google or Apple (email, name, and a provider account identifier)
• Name
• Date of birth. We use your age to personalize the service. Where an AI feature needs it, we send your age in years, not your date of birth
• Your country, and the region settings we derive from it (language, spelling, date and number format, and default currency)
• Base currency and timezone preferences

2.2 Onboarding Profile

During onboarding you may answer a short questionnaire so we can tailor the experience. We store:

• Why you're using FundFlow (a single-select answer, e.g. "I'm spending more than I'd like")
• How your income arrives (e.g. steady, casual, mixed, freelance)
• Your own estimate of how much you spend in a normal week, which you type in during setup. We keep it so we can show you, when your First Look opens, how close it was
• Your notification permission choice

These are self-reported. The questionnaire itself uses fixed choices, and we ask for no free-text financial disclosure anywhere in setup. The weekly estimate is a number you type on its own screen.

2.3 Financial Data

When you connect a bank account, we receive and store:

• Account names, types, and masked account numbers (the last four digits)
• Account balances and balance history
• Transaction details including amounts, dates, descriptions (including the raw transaction descriptor from your bank), merchant names, categories, and, where your bank supplies them, the merchant's address and coordinates
• Bank connection metadata (connection status, the country of the connection, and last sync time)

We also store information you create in the App: your category tree, vendor rules, categorization choices, notes you write on a transaction, and detected recurring-payment patterns.

Consent records for Australian open-banking connections. We store the identifier of the consent you gave and the date it ends. The rest of the consent detail, including which accounts it covers, what data it covers, and when your bank was last read, is read live from Fiskil each time you open the connection screen and is not stored by us. We also store an identifier that Fiskil uses to recognize you as the same person across your connections.

Important: Your bank login credentials are never stored on or transmitted through FundFlow's servers. All credential handling occurs with your bank or within the provider's secure environment. For a Plaid connection we store an access token that lets us retrieve your data, and it is encrypted before it is written to the database, on top of the encryption the database itself applies (see Section 7). For an Australian connection we hold no bank credential of any kind. We store the consent identifier, which is not a credential: on its own it grants nobody access to your bank.

2.4 Subscription Data

FundFlow is a paid app. Payments are processed by Apple through in-app purchase. FundFlow never receives or stores your card or payment-method details. We store your subscription and trial status and a subscription-provider customer identifier so we can give you access to paid features (see Section 6).

2.5 AI-Generated Data

We store the insights and summaries that our AI features generate about your finances, including your First Look and Weekly Review documents, together with the financial summary used to produce them. Onboarding can also generate an example category structure. We do not generate AI suggestions to categorize your transactions or vendors. See Section 5 for how AI is used.

2.6 Usage and Analytics Data

We collect information about how you use the App:

• Features accessed and actions taken
• App performance data
• Device type and operating system
• Session duration and frequency of use
• Push notification token: if you enable notifications, we register and store your device's push notification token (delivered via Expo) so we can send the notifications you have opted into.

2.7 Technical Data

We automatically collect (in production and staging builds only):

• Error reports and crash data
• App version and configuration
• General device information
• Your IP address. Every request your device makes to our servers carries one. We use it to rate limit abusive traffic, and it can appear in our server logs, which are deleted after 30 days. We do not use it to build a profile of you
• A launch-time check. Each time the App starts, before you sign in, it asks our servers for its configuration and tells us its build number. We log the build number so we know how many people are still on an old version. No account is involved and none exists at that point

2.8 Information We Do NOT Collect

• Device contacts, photos, or files
• Location from your device. The App asks for no location permission and reads no location from your phone. Where a transaction shows a city, an address, or map coordinates, those describe the merchant, and they came from your bank's own record of the transaction. Our analytics provider does work out an approximate location from your device's IP address when it receives an event, the way any web service can. We do not use it to locate you and we never join it to your financial data.
• Biometric data (Face ID/Touch ID is processed entirely on your device; biometric data is never transmitted to FundFlow)
• Social media profiles

---

3. How We Collect Information

3.1 Directly From You

• When you register, sign in, or update your profile or preferences
• When you answer onboarding questions
• When you contact us for support

3.2 From Your Bank, Through a Regulated Provider

When you connect a bank account, we receive your financial data through one of two providers, chosen by the country of the bank:

• Plaid for banks in the United States and Canada. Plaid is a regulated financial-data aggregator. Your bank credentials are handled exclusively by Plaid and are never accessible to FundFlow. Plaid's handling of your data is governed by Plaid's own privacy policy: https://plaid.com/legal/.
• Fiskil for banks in Australia. Fiskil is accredited under Australia's Consumer Data Right. You give your consent on Fiskil's own screens and you sign in at your own bank, so neither Fiskil nor FundFlow ever sees your bank password. Fiskil's privacy and CDR policies are at https://www.fiskil.com/legal/cdr-policy. Sections 4.2 and 14.3 set out what this means for your rights.

3.3 From Our AI Providers' Processing

To support onboarding and generate insights, we send the relevant portions of your financial data to AI providers for processing and receive the results. See Section 5.

3.4 Automatically

• Product analytics via PostHog
• Error and crash reports via Sentry (production/staging only)
• Subscription status via our payment and subscription providers (Apple, RevenueCat)

---

4. Bank Connections

4.1 United States and Canada: Plaid

FundFlow uses Plaid, a licensed, regulated bank aggregator, to connect to your financial institutions. When you link an account:

1. You are redirected to Plaid's secure interface
2. You enter your bank credentials directly with Plaid
3. Plaid establishes a secure connection with your bank
4. We receive only your financial data, never your login credentials

Plaid holds SOC 2 Type 2 and ISO 27001 certifications. Privacy Policy: https://plaid.com/legal/.

4.2 Australia: the Consumer Data Right

In Australia, bank data reaches us under the Consumer Data Right (CDR), Australia's open-banking regime.

• Fiskil is the accredited data recipient. It holds the accreditation from the Australian Competition and Consumer Commission, and it is the party your bank shares your data with.
• Our role for Australian CDR connections is Fiskil's CDR representative. We receive CDR data only through Fiskil under a CDR representative arrangement. Australian CDR connections require that arrangement and FundFlow's entry on the public CDR Register. We must adopt and comply with Fiskil's CDR policy for that data.
• You give your consent to FundFlow, on screens Fiskil presents for us. Your bank login is entered at your own bank, so neither Fiskil nor FundFlow sees it. Fiskil's consent service provides receipts when you give, change, or end consent, and reminders of ongoing consents after 90 days without giving, changing, or reviewing a consent. Contact support@fundflow.dev if you do not receive a receipt or need help reviewing a consent.
• Fiskil's CDR policy applies alongside ours. You can read it at https://www.fiskil.com/legal/cdr-policy. This policy describes FundFlow's systems and does not reduce your CDR rights or override Fiskil's CDR policy. Our general privacy-policy terms do not independently authorize additional use, disclosure, or retention of CDR data.
• What we ask for. Your account names and details, your balances, and your transactions. We do not ask for your name and contact details from your bank, your saved payees, or your direct debits and scheduled payments. The connection screen lists exactly what your live consent covers, read from Fiskil, and that list is the authority. If it shows more than the three things named here, tell us at support@fundflow.dev.
• What Fiskil is told about you. To set your connection up, we give Fiskil your email address and your name. That is the only personal information we send it besides the connection itself.
• How long the consent lasts. Twelve months, unless you end it sooner. We warn you 30 days and again 7 days before it ends, and you can renew it from the connection screen.
• We cannot move money. The CDR gives read access only. FundFlow cannot make a payment, move funds, or change anything at your bank.
• Deletion, not de-identification. When collected CDR data is no longer needed, our policy is to delete it. We do not de-identify it and keep it. Section 4.3 says exactly what that means in practice.

4.3 Viewing and ending an open-banking consent

Open the connection in the App to see the consent behind it: when you gave it, when it ends, which accounts it covers, what data it covers, and when your bank was last read. That screen reads live from Fiskil, and it is where you manage the consent. The same screen has an End consent action, which takes effect straight away.

Before a consent ends the App shows a warning from 30 days out, on the connections list and on the connection itself, and it stays there until you renew. If you have notifications turned on we also send up to two pushes, 30 days and 7 days out, unless your trial or subscription is not active, whether it ended or you never started one, in which case the in-app warning is the only one you get. No warning names an amount.

Our policy is to stop using and delete CDR data when its consent expires or is withdrawn. You do not need to delete your FundFlow account. We do not de-identify that data to keep using it. When our system processes the consent-ending event, it deletes the following from the active application database:

• every transaction and account that came from that connection, and the transaction splits attached to them;
• the insights and summaries we generated for you, across your whole account, including your Weekly Review and First Look documents and stored recurring-payment patterns. We delete these across your whole account rather than only for the ended connection because they can contain data from it. If you have another active connection, later processing can generate new insights from its permitted data;
• any vendor left with no transaction of yours, and the vendor rules attached to it;
• the parsing templates we hold for you, the name corrections you made that we turned into rules, and any preview extraction rows, across your whole account. These are how we read your bank's transaction text into fields such as the merchant, the suburb and the payment method, and they are built from your own transactions, so they go when those transactions go.

We keep one record of the connection itself, showing the bank, the country, the identifier of the consent that ended and the date it ended, so the App can tell you what happened and offer to reconnect. Reconnecting creates a new consent and pulls your history again. If every consent you hold has been ended for 30 days, or you delete your FundFlow account, we also delete the identifier Fiskil holds for you.

Ending consent does not instantly erase every existing copy on an offline device or in a backup. Sections 7.3 and 8.3 describe those copies separately. They do not authorize continued use of the ended consent's data for insights or other App features. Any legally required records are limited as described in Section 8.6.

4.4 Disconnecting a Plaid connection

You can disconnect any Plaid connection at any time through the App. When you do, we revoke the connection with Plaid, stop syncing, and delete the accounts and transactions that came from it. Insights we already generated may still mention that data until your next sync rebuilds them; deleting your account (Section 8.3) removes everything.

---

5. How We Use Your Information, Including Artificial Intelligence

5.1 Provide and Improve the Service

We use your information to display your accounts and transactions, sync your financial data, categorize your spending, generate insights and reviews, and improve the App.

5.2 How We Use AI

FundFlow uses Anthropic's Claude models through Amazon Bedrock, not Anthropic's direct API. The AI features are:

• Onboarding: generating an example category structure
• First Look and Weekly Review: producing plain-language summaries and insights about your spending

We do not use AI to suggest categories for individual transactions or vendors. Automatic recurring-payment suggestions are currently disabled. Existing recurring-payment records and the information you manage yourself can still appear in the App and in financial summaries.

To do this, we send only the information needed to produce the result. Depending on the feature that may include: merchant and vendor names, transaction amounts, currencies and dates, the raw transaction descriptor your bank supplied, the merchant's city where your bank provides it, your own category names, your prior categorization choices, the spending category your bank's provider assigned to a transaction, how many transactions you have with a merchant, the recurring payments we have detected, your income including the amounts and the names your bank gives their sources, your onboarding answers, the review preferences you have set or that we have learned from what you hide, and your country, timezone, base currency, and your age in years.

We do not include your profile name, email address, date of birth, bank account numbers, bank credentials, or access tokens as fields in AI requests. Where a summary needs to address you by name, we use a placeholder and put your name back into the finished text afterwards. However, bank-supplied transaction descriptions and other financial text can themselves contain names or identifying details. This processing is not a claim that all personal information has been removed or that the data is anonymous.

AI processing follows the account's financial-data region.

Australian bank data is assigned to the Australian system. Its Bedrock processing, including the fallback model, stays in Australia. We do not use OpenAI for that data. North American accounts use Bedrock in the United States; onboarding can fall back to OpenAI in the United States if the primary model is unavailable. First Look and Weekly Review do not use the OpenAI fallback.

We use geography-restricted Bedrock inference profiles, not global inference profiles. We keep Bedrock request-content logging disabled. AWS operates the Bedrock service. Using Claude through Bedrock does not mean we send these requests to Anthropic's direct API.

Our AI providers process this data to return a result to us; under our commercial API agreements with them, your data is not used to train their models. Some of the AI-generated results, and the financial summary used to create them, are stored in your FundFlow account so the features work and so you can revisit past insights.

5.3 We Do Not Make Automated Decisions About You

We do not use AI, or any other automated process, to make a decision that produces a legal effect for you or that similarly significantly affects you. AI in FundFlow helps with onboarding and writes summaries of your own spending. You can change the category structure and ignore an insight. AI is not used to approve or deny credit, to set a price, or to decide anything about your access to the service.

5.4 Communicate With You

• Send service-related notifications
• Deliver push notifications you have enabled (for example, your Weekly Review, or a warning that a bank consent is about to end)
• Respond to support requests
• Send marketing communications (only with your opt-in consent)

5.5 Ensure Security and Compliance

• Detect and prevent fraud
• Maintain the security of our systems
• Comply with legal obligations

5.6 Analytics and Research

• Understand how users interact with the App
• Identify areas for improvement
• Conduct aggregated, de-identified analysis

These general analytics purposes do not extend a CDR consent or authorize us to retain CDR data after that consent ends.

---

6. Subscriptions and Payments

FundFlow is offered on a paid subscription basis, typically following a free trial. Billing is handled entirely through Apple's in-app purchase system, subject to your agreement with Apple. FundFlow does not collect, receive, or store your payment card or banking details for subscriptions.

To manage entitlements, we use:

• RevenueCat: subscription/entitlement management. We provide RevenueCat with your FundFlow account identifier; RevenueCat receives your purchase and subscription status from Apple.

We store your trial and subscription status and a subscription-provider customer identifier in your FundFlow account so we can grant access to paid features.

---

7. Data Security

We implement industry-standard security measures to protect your data:

7.1 Encryption

• All data transmitted between your device and our servers uses TLS/HTTPS encryption
• Our database is encrypted at rest by Amazon Web Services
• Bank connection access tokens are separately encrypted before they are stored, using authenticated AES-256-GCM encryption
• Passwords are securely hashed (never stored in plaintext)

7.2 Access Controls

• Row-Level Security (RLS) in the database means a request carrying your identity reaches only your own accounts, transactions, categories, vendors and insights. There is no exception: no part of the App shows your data to another user
• Access to the production database is restricted to FundFlow's own personnel and used only to operate and support the service

7.3 Storage on Your Device

• Your session tokens are stored in platform-native secure storage (iOS Keychain, Android Keystore)
• To make the App load faster, it keeps a local cache of viewed information, including recent transactions and balances, in the App's private storage. When restoring the cache, the App rejects a saved cache older than 24 hours. Signing out clears the cache. Your device's disk encryption and app isolation protect this storage; FundFlow does not separately encrypt it
• Deleting server data or ending consent does not instantly erase an existing device cache. Cached information changes when the App refreshes it or clears the cache. An offline device can retain a copy until it reconnects, refreshes, or you sign out
• Your bank credentials are never on your device in any form that FundFlow can read, because they are never given to FundFlow

7.4 Infrastructure Security

• Our application systems run on AWS in Sydney and Northern Virginia. We operate authentication in Sydney. Databases use private networks without direct public-internet access
• Regular security updates and patches are applied
• We conduct periodic security reviews

7.5 What Our Logs Carry

Our server logs are written so that they do not carry your email address, your balances, or the body of a request, and we refer to you by an internal identifier that means nothing outside our database. Our error-monitoring reports are scrubbed of email addresses before they leave our servers.

Two things the logs do carry, and we would rather say so than imply otherwise: the full web address of each request, including anything you typed into a search box, and the text you search for in your transaction list, which is often a merchant name. Both are deleted with the rest of the log after 30 days.

---

8. Data Retention and Deletion

8.1 Active Accounts

We retain account information as needed to provide the service while your account is active. Keeping an account open does not extend permission to use or retain its CDR data. The consent-based rules in Sections 4.3 and 8.2 apply separately.

8.2 When an Open-Banking Consent Ends

Section 4.3 describes deletion from the active application database when an Australian consent expires or is withdrawn. There is no account-retention grace period for continued use of that data. You can keep your FundFlow account without keeping the ended connection's data for ongoing use. Device caches, backups, and legally required records have the separate limits described in Sections 7.3, 8.3, and 8.6.

8.3 Account Deletion

You can delete your account through the App or by contacting us. What happens, in order:

1. Straight away: we stop syncing and disconnect every bank connection.
2. For the next 7 days: the account-deletion request is cancellable. Sign in during that week and the App asks whether you want to keep your account. This grace period does not override a bank consent that has separately expired or been withdrawn.
3. After 7 days: the scheduled deletion process revokes provider access, requests deletion of your Fiskil identifier, and deletes your active account data, including transactions, categories, insights, and AI-generated content. It also deletes your sign-in record from the authentication service we operate on AWS in Sydney. The process runs on a schedule, so completion is not guaranteed at the exact seven-day mark.
4. We then tell our subscription and analytics providers to delete what they hold against your account identifier. Some providers retain data for a limited period under their own retention schedules.
5. Backups and recovery copies: automated production database backups use a rolling 14-day retention period. Deleted data can remain in those backups until they expire. Manual recovery snapshots and migration exports are separate copies; the 14-day automated-backup setting does not delete them. They can retain a copy until they are separately deleted. They are not active App data and do not authorize continued use of CDR data for App features after consent ends.

Anonymous exit record. When you ask to delete your account, we keep one anonymous exit record that is not deleted with your account. It holds only your answers to the optional leaving questions, as fixed codes; your region; a rough account age; your plan state; your bank-connection provider (Plaid or Fiskil) and a rough count of banks; the App build; and the week of the request. It holds no name, email address, account identifier, bank name, typed text, or exact date. Australian records stay in Sydney, and others stay in Northern Virginia. We use these records only to understand why people leave, and we do not report on small groups.

We may retain de-identified, aggregated information that is not CDR data, and records that applicable law requires us to retain. This does not create a general exception to the CDR deletion policy. See Section 8.6.

8.4 Logs and Error Reports

Our server logs are kept for 30 days and then deleted automatically. Error and crash reports are kept by our error-monitoring provider under its own retention schedule. Neither is used to build a profile of you.

8.5 Inactive Accounts

We may delete accounts that have been inactive for an extended period after providing notice.

8.6 Legal and Financial-Records Requirements

We may retain limited records where applicable law requires it, including consent, complaint, or financial records where a retention requirement applies. We limit those records to the required purpose and period. General business purposes, an active FundFlow account, or acceptance of this privacy policy do not independently authorize continued retention or use of CDR data after consent ends.

---

9. Data Sharing and Disclosure

9.1 Service Providers (Sub-Processors)

We share data with service providers who help us operate the App. The table shows where each one processes the data it receives.

Two more things reach a third party and are worth naming even though they carry no account of yours. Merchant logos shown next to your transactions are images fetched by your phone from the address your bank's provider supplied, so that provider sees your device's IP address. Exchange rates come from Frankfurter, a public European rates service, which receives only a currency pair and a date and nothing about you.

9.2 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to comply with legal obligations, protect our rights or property, prevent fraud or illegal activity, or protect the safety of users or the public.

9.3 Business Transfers

If FundFlow is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

9.4 What We Do NOT Do

• We do NOT sell your personal information
• We do NOT share your personal information for cross-context behavioral advertising
• We do NOT share your financial data for advertising purposes
• We do NOT allow third parties to use your data for their own marketing

---

10. International Data Transfers

FundFlow is an Australian company with separate Australian and North American application systems. We also use supporting providers in other countries. This section explains which information crosses a border.

Australian application system, in Sydney. This system holds the application records for Australian accounts, including accounts, balances, transactions, categories, vendors, insights, subscription status, notification settings, and consent records. An account with Australian bank data belongs in this system rather than the North American system. Its application database, regional backups, and server logs are held in Australia.

North American application system, in Northern Virginia. This system holds the application records for North American accounts, including their United States and Canadian bank data. Its application database, regional backups, and server logs are held in the United States. Australian bank data is not assigned to this system.

Authentication for every user, in Sydney. FundFlow operates its own authentication service on AWS using self-hosted GoTrue. Email addresses, names, password hashes or sign-in provider identifiers, and sign-in sessions are held in Sydney, including for North American users. We use Amazon Simple Email Service in Sydney for authentication email delivery. Hosted Supabase and Railway are not providers in this post-migration setup.

Supporting services in the United States. PostHog, RevenueCat, Expo, Vercel, Apple, Google, and Plaid receive the information described in Section 9.1. OpenAI receives onboarding requests only for North American accounts when the fallback is used. These providers' roles do not mean that every provider receives all of your financial data.

Held in Germany. Error and crash reports, through Sentry.

AI processing is regional. Australian-system accounts use Bedrock in Sydney and Melbourne, including their fallback model. North American-system accounts use Bedrock in the United States, with an OpenAI onboarding fallback in the United States. First Look and Weekly Review stay on Bedrock. Section 5.2 describes the data sent and the processing limits.

Server logs have a 30-day retention period. Section 8 explains account deletion, the 14-day automated-backup cycle, and the separate treatment of recovery copies and legally required records.

Where information is transferred across borders we take reasonable steps to ensure the recipient handles it consistently with this policy, including through the terms we accept with each provider and the technical limits described in Sections 5 and 7. We remain accountable to you for what a provider does with information we give it. The regional sections in Section 14 explain the rights this gives you where you live.

---

11. Children's Privacy

FundFlow is a financial application intended for adults. You must be at least 18 years old (or the age of majority in your jurisdiction) to use the App. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect personal information from children under 13 within the meaning of the U.S. Children's Online Privacy Protection Act (COPPA).

If we become aware that we have collected personal information from someone under 18, we will take steps to delete it promptly. If you believe a minor has provided us with personal information, please contact us at support@fundflow.dev.

---

12. Marketing Communications

We will only send you marketing communications if you have opted in. You can unsubscribe at any time by clicking the unsubscribe link in any marketing email, updating your preferences in the App, or contacting us at support@fundflow.dev. We will continue to send essential service-related communications regardless of your marketing preferences.

---

13. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights. To exercise any of them, contact us at support@fundflow.dev or use the in-app controls. We will not discriminate against you for exercising your rights.

• Access / Know: request a copy of, or information about, the personal data we hold about you
• Correction: request correction of inaccurate or incomplete data
• Deletion: request deletion of your personal data (delete your account in-app or contact us)
• Portability: request your data in a structured, commonly used format. The App has no export button today, so we do this by hand when you ask
• Opt out of sale/sharing: we do not sell or share your personal information for advertising, but you may direct us not to
• Limit use of sensitive personal information: we use sensitive personal information only to provide the service and as described here
• Withdraw consent: for marketing (unsubscribe), bank connections (disconnect or end the consent in-app), or analytics (contact us)

You may also authorize an agent to make a request on your behalf, and we may need to verify your identity before fulfilling a request.

---

14. Region-Specific Disclosures

14.1 United States

We comply with applicable U.S. federal and state privacy laws. Some federal financial-privacy rules, including the Gramm-Leach-Bliley Act (GLBA), may apply to information we hold about you, and we are taking advice on which of them do. Whatever the answer, we maintain administrative, technical and physical safeguards designed to protect your information, and this policy describes them.

Where your data is held. North American account data and its primary AI processing are in the United States. Your sign-in information is held by our authentication service in Sydney, Australia. An account with Australian bank data belongs in the Australian system. Section 10 explains the locations of each service.

California residents (CCPA/CPRA). You have the right to know what personal information we collect and how we use and disclose it, to access and delete your personal information, to correct inaccurate information, to opt out of the "sale" or "sharing" of personal information (we do not sell or share personal information for cross-context behavioral advertising), and to limit the use of sensitive personal information. We do not knowingly sell the personal information of any consumer. You will not receive discriminatory treatment for exercising your rights.

Residents of other U.S. states with comprehensive privacy laws may have similar rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising and sale; contact us to exercise them. If we refuse a request, you may appeal by writing to support@fundflow.dev with "appeal" in the subject line, and we will answer within 60 days. Several state laws also let you complain to your state Attorney General if the appeal is refused.

Data breaches. If your personal information is accessed or disclosed without authorization, we will notify you and any regulator that the law of your state requires us to notify, in the time that law allows.

14.2 Canada (PIPEDA and provincial law)

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws (including Quebec's Law 25). Canadian users have the right to:

• Access the personal information we hold about you
• Challenge the accuracy and completeness of your information and request correction
• Withdraw consent for the collection, use, or disclosure of your information (subject to legal or contractual restrictions)
• Lodge a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/) or your provincial privacy regulator

Your data is held outside Canada. Canadian accounts in the North American system have their application data and primary AI processing in the United States. Your sign-in information is held in Sydney, Australia. An account with Australian bank data belongs in the Australian system. Supporting providers use the locations listed in Section 9.1. While your information is held in another country it may be accessible to that country's authorities under that country's laws. We transfer personal information to service providers for processing under contractual protections, and we remain accountable to you for it.

Data breaches. If a breach of our security safeguards involving your personal information creates a real risk of significant harm to you, we will report it to the Office of the Privacy Commissioner of Canada, notify you, and keep a record of the breach.

14.3 Australia

FundFlow Group Pty Ltd (ABN 36 694 667 386) is an Australian company. Two different sets of rules cover your information, and which one applies depends on where the information came from.

Your bank data is CDR data. Data your bank shares under the Consumer Data Right is governed by the CDR privacy safeguards in Part IVD of the Competition and Consumer Act 2010, not by the Australian Privacy Principles. Fiskil is the accredited data recipient. FundFlow is Fiskil's CDR representative, and under our arrangement with Fiskil we must comply with the safeguards covering anonymity, unsolicited CDR data, how CDR data may be used and disclosed, direct marketing, data quality, security, correction, disclosure overseas, and the handling of government-related identifiers, as if we were the accredited party. We have adopted Fiskil's CDR policy. Read it at https://www.fiskil.com/legal/cdr-policy. Sections 4.2 and 4.3 of this policy describe how consent, expiry and deletion work in the App.

Everything else is personal information. Your email address, your name, your date of birth, what you do in the App and anything you type into it are governed by the Privacy Act 1988. FundFlow Group Pty Ltd is a small business by turnover, and whether the Privacy Act's small business rules make it an "APP entity" is a question we are taking advice on. It does not change how we behave. This policy is written to the Australian Privacy Principles, we handle your personal information to that standard, and we will answer an access, correction or complaint request as though the Principles bound us, whatever the answer turns out to be.

Overseas recipients. Supporting providers can receive personal information outside Australia. These include providers in the United States for product analytics, subscriptions, app builds and push delivery, website hosting, Apple and Google sign-in, and Plaid bank connections, and Germany for error monitoring. Section 9.1 states what each receives. Your Australian CDR application data and your FundFlow sign-in records are held in Sydney. Its AI processing happens through Bedrock in Sydney and Melbourne, including the fallback model. The North American application system and its OpenAI fallback are not used to process Australian CDR bank data.

We do not sell your data and we do not use it for direct marketing. We do not disclose CDR data, or anything derived from it, to a third party for money or any other consideration.

Access, correction and complaints. Ask us for a copy of what we hold, or ask us to correct it, at support@fundflow.dev. If we cannot correct something we will note your statement against it. If you want to complain, write to us first at the same address. If you have not had a reply within 30 days, or you are not satisfied with it, you can complain to Fiskil as the accredited data recipient, or to the Office of the Australian Information Commissioner at https://www.oaic.gov.au/privacy/privacy-complaints or GPO Box 5288, Sydney NSW 2001.

Data breaches. We notify Fiskil as soon as reasonably practicable of a data breach affecting FundFlow, as required by our CDR arrangement. We also notify affected people and the OAIC when the applicable data-breach notification requirements are met, including the serious-harm threshold where it applies.

Our details go on the public CDR Register. Before your first Australian bank connection, FundFlow's name, ABN and business address are entered against Fiskil on the Register of Accredited Persons, which the Accreditation Registrar publishes.

---

15. Cookies and Tracking

15.1 Mobile App

The FundFlow mobile app does not use cookies. We use PostHog for analytics, as described in Sections 2.6 and 9.1. Session replay is turned off, so PostHog does not record your screens.

15.2 Website

If you visit our website, we may use essential cookies for basic functionality and analytics cookies (PostHog) to understand how visitors use our site. You can control cookies through your browser settings. The site has no sign-up or contact form, so it collects no email address.

---

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the "Last Updated" date and the version number at the top of this policy
• We will tell you in the App, and by email where we hold a working address for you and the law requires it
• We may ask you to accept the new version before you continue

We encourage you to review this policy periodically.

---

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Email: support@fundflow.dev

Mailing Address: FundFlow Group Pty Ltd ABN 36 694 667 386 Australia

Complaints. Contact us first, at the address above, and we will answer you. If you are not satisfied with our answer, you can take it further:

• Australia: the Office of the Australian Information Commissioner, https://www.oaic.gov.au/privacy/privacy-complaints
• Canada: the Office of the Privacy Commissioner of Canada, https://www.priv.gc.ca/, or your provincial regulator
• United States: your state Attorney General, or the Federal Trade Commission, https://www.ftc.gov/

---

This Privacy Policy takes effect on the date it is published at https://fundflow.dev/privacy-policy.