Privacy Policy

This Privacy Policy applies to all personal information collected by WILIER LABS PTY LTD (ABN 57 681 703 328), trading as COVE MONEY (we, us or our) via the Cove Money mobile application and the website located at covemoney.com.au (together, the Service).

The Personal Information we collect depends on how you use the Service. This may include:

• Account information such as your email address, name, and authentication identifiers used to sign you in
• Financial data accessed through the Consumer Data Right (CDR) framework through Fiskil Pty Ltd under our CDR Representative arrangement, including account balances and transaction history
• AI interaction data, such as prompts, responses, and limited transaction-related context used to power AI features, including automatically categorising your transactions and the AI financial companion
• Service communication data, such as your email address and delivery metadata for account and product emails we send you
• Device and usage information collected automatically when you use the app

The Privacy Act 1988 (Cth) (Privacy Act) defines types of information, including Personal Information and Sensitive Information.

Personal Information means information or an opinion about an identified individual or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether it is recorded in a material form or not.

Sensitive Information is defined in the Privacy Act as including information or opinion about such things as an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, membership of a professional body, criminal record or health information. Sensitive Information will be used by us only: (a) for the primary purpose for which it was obtained; (b) for a secondary purpose that is directly related to the primary purpose; and (c) with your consent or where required or authorised by law.

We collect Personal Information when you create an account, sign in, use the Service, or provide it to us in any other way.

Financial data is collected through Australia's Consumer Data Right (CDR) framework through Fiskil Pty Ltd under our CDR Representative arrangement. Cove Money is not an Accredited Data Recipient. Fiskil Pty Ltd is the Accredited Data Recipient that collects and discloses CDR Data on behalf of Cove Money with your explicit consent. Cove Money receives this data on a read-only basis.

We also use a small number of trusted service providers to support the Service, listed in section 6. Application data and financial data are hosted in Australia, as described in section 7.

Where reasonable and practicable, we collect your Personal Information from you only. If we receive information from a third party, we will take steps to make you aware.

We collect Personal Information to:

• Provide the Cove Money Service, including account aggregation, spending insights, and the AI financial companion
• Improve and personalise your experience
• Communicate with you about your account and Service updates

We do not sell, share, or disclose your Personal Information or financial data to third parties for advertising, marketing, or any purpose unrelated to the operation of the Service.

We do not use third-party advertising cookies or third-party visitor tracking tools on the website. Public pages may load technical resources such as fonts, scripts, or other static assets from third-party infrastructure, which can result in those providers receiving technical request information such as your IP address, browser details, and request timing.

We may collect basic technical logs and first-party, privacy-preserving website telemetry needed to operate, secure, and improve the Service. This may include anonymous public page paths, referrer domain, UTM campaign details, device class, browser family, and request timing. We do not use this to identify you personally, do not store full IP addresses in this telemetry, and do not capture session replays, mouse movements, form inputs, or financial data.

We rely on a small number of third-party providers to operate the Service securely and reliably. Our key providers currently include:

• Fiskil Pty Ltd for Consumer Data Right bank connections and consented financial data access under our CDR Representative arrangement
• Amazon Web Services (Amazon SES) for transactional email delivery from the AWS Asia Pacific (Sydney) Region (ap-southeast-2)
• Amazon Web Services (Amazon Bedrock) to run AI-powered features. AI models (such as Anthropic's Claude) are hosted and operated by AWS within Australian regions; AWS does not store your prompts or responses after processing, or use them to train models

These providers may use their own service providers and subprocessors to help deliver their services. We take reasonable steps to work with reputable providers and to review their privacy and security commitments.

Your data is hosted in Australia. All application data and financial data we store to operate the Service are stored and processed in Australia. AI-powered features are also processed in Australia, and transactional email is sent from Australian infrastructure.

Transactional email is sent using Amazon SES from the AWS Sydney region. Email delivery involves limited Personal Information such as your name, email address, and delivery metadata.

AI requests are processed using Amazon Bedrock within Australian AWS regions, in our own AWS environment. Your prompts, transaction context, and AI responses are not stored after processing or used to train AI models. Cove also sends transaction details such as the description, amount, and merchant to automatically categorise your transactions. AI requests may include limited transaction-related context, categories, balances, app-generated summaries, and prompts you submit where needed to generate the requested insight or explanation. We aim to minimise the information sent for AI processing and avoid sending direct identifiers such as your name, email address, account numbers, or identity documents.

We use reasonable technical and organisational measures to protect your Personal Information from unauthorised access, misuse, modification, or disclosure. Cove Money does not receive or store your bank login credentials. Bank connections are handled through Fiskil under the CDR framework using secure tokens and consent-based access.

We retain Personal Information only for as long as reasonably necessary to operate the Service and meet our legal, regulatory, security, fraud-prevention, dispute resolution, and record-keeping obligations. When we no longer require your Personal Information, we will take reasonable steps to destroy, anonymise or de-identify it, subject to those obligations.

Cove Money operates as a CDR Representative of Fiskil Pty Ltd (ACCC Accreditation Number ADRBNK000246). Fiskil is the accredited data recipient and collects and discloses CDR Data on behalf of Cove Money.

Financial data accessed through Australia's Consumer Data Right framework through Fiskil under our CDR Representative arrangement is governed by the CDR rules set by the ACCC. You have the right to:

• View exactly which data you have consented to share
• Withdraw your consent at any time - directly in the app or through your bank
• Request deletion of your bank connection data, which will be actioned promptly, subject to any legal, regulatory, security, fraud-prevention, dispute resolution, or record-keeping requirements that apply

We practise minimal data collection - we only request the data necessary to provide the features of the Service.

The Australian Privacy Principles permit you to obtain access to the Personal Information we hold about you (Australian Privacy Principle 12) and allow you to correct inaccurate Personal Information subject to certain exceptions (Australian Privacy Principle 13).

To request access or correction, please contact us at [email protected].

If you have a complaint concerning the manner in which we maintain the privacy of your Personal Information, please contact us using the details below. All complaints will be considered and we may seek further information from you to clarify your concerns. If we agree that your complaint is well founded, we will take appropriate steps to rectify the problem. If you remain dissatisfied with the outcome, you may refer the matter to the Office of the Australian Information Commissioner.

We do not host your application data or financial data overseas. Application data, financial data, and AI processing are hosted and processed within Australia as part of normal Service operation, and transactional email is sent from Australian infrastructure. Delivering email to you necessarily involves your own email provider, which may be located outside Australia.

Some limited Personal Information may still be disclosed to, stored by, or processed by trusted third-party providers outside Australia where this is reasonably necessary to operate the Service, for example where their support, security, billing, operational systems, or subprocessors are located outside Australia.

Where any overseas processing occurs, we take reasonable steps to work with reputable service providers and to ensure your information is handled with appropriate safeguards. By using the Service, you acknowledge that some supporting service providers may process limited Personal Information outside Australia.

If you have any queries, or if you seek access to your Personal Information, or if you have a complaint about our privacy practices, you can contact us at:

[email protected]

WILIER LABS PTY LTD (ABN 57 681 703 328)
Trading as COVE MONEY
Australia