Privacy Policy

We handle personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs). Where we receive data through the Consumer Data Right (CDR), we also comply with the privacy safeguards in Part IVD of the Competition and Consumer Act 2010 (Cth) and the Competition and Consumer (Consumer Data Right) Rules 2020 (Cth) (CDR Rules). Consumer Data Right and our separate CDR Policy explain how we handle CDR data.

Pocket Adviser does not hold an Australian financial services licence (AFSL). We provide personal financial advice to retail clients in reliance on ASIC's enhanced regulatory sandbox exemption under the Corporations (FinTech Sandbox Australian Financial Services Licence Exemption) Regulations 2020 (Cth). The exemption lets us test our advice service for a limited period, subject to conditions including limits on the value of each client's investments, professional indemnity insurance and AFCA membership. Some of our obligations to collect and keep information come from the Corporations Act 2001 (Cth), and we explain these where they apply.

Pocket Adviser is designed for people aged 18 and over. We do not knowingly collect personal information from anyone under 18.

By using Pocket Adviser you acknowledge that your personal information will be handled as described in this policy. Where the law requires your consent (for example, for CDR data or sensitive information), we will ask for it separately.

We only collect information that is reasonably necessary for the services you choose to use. Much of it is optional, but if you do not provide it, some features (including personal advice) may not be available.

We are legally required to collect information about your objectives, financial situation and needs before giving personal advice: section 961B of the Corporations Act 2001 (Cth) requires us to identify those matters and to make reasonable inquiries to obtain complete and accurate information.

We use Sentry for error tracking and Better Stack for logging and uptime monitoring.

Sensitive information. We do not ask for sensitive information (such as health information, religious beliefs or racial or ethnic origin). You may choose to tell us about something sensitive — for example, a health condition that affects your income or goals, or in the AI chat. If you do, we will only use it for the purpose you provided it and with your consent, which you give by providing it. Please do not share sensitive information you do not want us to hold.

Government identifiers. We do not collect tax file numbers or government identifiers unless required for identity verification.

Before Pocket Adviser is generally available, you can join our waitlist on our website. We collect your email address and, if you choose to give it, your name.

We use this information only to tell you when Pocket Adviser becomes available. We do not use it for marketing, combine it with any other information, or disclose it to anyone other than the service providers that store it and send our emails (Supabase and Resend).

You can leave the waitlist at any time using the unsubscribe link in our email or by contacting us. We delete your waitlist details 30 days after we send the availability notice, or sooner if you ask. If you go on to create an account, the information in your account is handled as described in the rest of this policy.

We collect most personal information directly from you, when you create an account, complete a fact-find, enter data, upload documents, use the AI chat or contact us.

We collect some information from third parties, but only with your authorisation:

• Your bank or other data holder, through our Open Banking provider Fiskil, when you consent to share CDR data (Consumer Data Right).
• Your broker or investment platform, through SnapTrade, when you connect a brokerage account (Brokerage connections).

We collect technical information automatically when you use the app, using cookies and similar technologies (Marketing, anonymity and cookies).

If we receive personal information we did not ask for, we will decide within a reasonable time whether we could have collected it lawfully. If not, we will destroy or de-identify it where lawful and reasonable to do so.

We use personal information to:

1. Create and administer your account, verify that you are 18 or over, and keep your account secure.
2. Provide the features you choose: budgeting, bookkeeping, investment tracking and the AI chat.
3. Provide personal financial advice, including meeting our best interests duty and related obligations under Part 7.7A of the Corporations Act 2001 (Cth), and preparing your SOA or ROA.
4. Keep records of the advice we give, as required by law (Retention and deletion).
5. Monitor and review the quality of our advice, including independent review of a sample of advice outputs by an external reviewer engaged under a confidentiality agreement.
6. Test, maintain and improve our services and algorithms, using only de-identified or aggregated data. We do not use identifiable personal information to train, tune or test our advice algorithm.
7. Respond to questions, complaints and disputes, including with the Australian Financial Complaints Authority (AFCA).
8. Send you service messages, and marketing where you have not opted out (Marketing, anonymity and cookies).
9. Detect and prevent fraud, misuse and security incidents.
10. Comply with our legal and regulatory obligations, including requests from ASIC, the OAIC, the ACCC or other authorities.

We do not sell your personal information. We do not use CDR data for any purpose other than the one you consented to (Consumer Data Right).

If you connect a bank account, we receive your CDR data through Fiskil. Fiskil Pty Ltd is an accredited data recipient, and Pocket Adviser is a CDR representative of Fiskil. This section summarises how we handle CDR data. Our CDR Policy sets out the detail required by the CDR Rules and prevails if there is any inconsistency.

Consent. We only collect and use CDR data with your express consent. Before you connect, we tell you what data we will collect, what we will use it for, and how long your consent lasts (no more than 12 months). You can withdraw consent at any time in the Pocket Adviser app or in Fiskil's consent dashboard, or through your bank's dashboard.

What we collect. Depending on what you consent to, this may include account names and types, balances, and transaction details (dates, amounts, descriptions and merchant details).

How we use it. Only to provide the budgeting, cash-flow and financial-situation features you asked for, and — if you choose — to pre-fill your financial situation for personal advice. We do not sell CDR data, use it for marketing, or disclose it to anyone other than Fiskil and the service providers that help us deliver the service you consented to.

We do not keep a copy of raw CDR data. We retrieve CDR data from Fiskil each time you use the relevant feature. We do not cache or store the raw data; our servers process it in memory to display it to you and to calculate the insights described below.

Data we derive. We calculate and store some information from your CDR data in our database in Sydney, such as transaction categories, budgets and spending summaries. This derived data is also CDR data. We hold it only while your consent is active and delete it when your consent ends.

When consent ends. When your consent is withdrawn or expires, we stop collecting your CDR data and delete any CDR data we hold (including derived data and cached copies) in accordance with the CDR Rules, unless an Australian law requires us to keep it. We do not de-identify CDR data as an alternative to deletion. You can ask us to confirm deletion.

CDR data and advice records. If you use CDR data to inform personal advice, the snapshot of your financial situation stored in your advice record (Retention and deletion) may include information derived from CDR data. We keep that record because the Corporations Act 2001 (Cth) requires it.

CDR complaints. You can complain about our handling of CDR data using the process in Complaints and contact and our CDR Policy. If you are not satisfied, you can contact AFCA or the Office of the Australian Information Commissioner (OAIC).

If you connect a brokerage or investment account, we use SnapTrade (SnapTrade Inc., based in Canada) to retrieve your holdings and account information. You log in to your broker through SnapTrade; we never see or store your broker password. SnapTrade's own privacy policy applies to its handling of your information.

We use holdings data to show your portfolio and, if you ask for advice, to understand your existing investments. We retrieve holdings data from SnapTrade each time you use the relevant feature and do not store it, except where it forms part of an advice record (Retention and deletion). You can disconnect a brokerage account at any time in the app, and we will stop retrieving data from it.

The in-app chat assistant uses large language models supplied by third parties, accessed through OpenRouter. We keep your chat history in your account so you can refer back to it, until you delete it or close your account.

When you use the chat, your messages and your first name (to personalise responses) are sent to the model provider to generate a response. We have zero data retention arrangements with OpenRouter. Zero data retention is enforced both in our OpenRouter account configuration and in every request we send, so requests are routed only to model providers that do not retain or store prompts or responses and do not use them to train their models.

The AI chat explains information and our advice in plain English. It does not generate personal advice: personal advice comes only from our advice process and is documented in your SOA or ROA. Do not share information in the chat that you would not want us to hold.

Our personal advice is generated by computer programs. Our proprietary algorithm uses the information you give us about your objectives, financial situation and needs, together with market assumptions and simulations, to recommend an investment strategy (for example, an allocation across ETFs and cash).

The kinds of personal information the algorithm uses are: your goals and timeframes, age, income and expenses, assets, debts, existing investments, dependants and risk attitude. Where you connect your bank or broker, it may also use information derived from that data.

These recommendations could significantly affect your financial interests. Our advice process is designed to meet the best interests duty, and outputs are subject to automated checks and periodic independent human review. You can ask us questions about how a recommendation was reached, correct the information it relied on, or ask for further advice at any time.

The AI chat (AI chat) does not make these decisions.

We disclose personal information only for the purposes in Why we collect, hold and use it, or as the law allows or requires. We may disclose it to:

• Service providers who host, store or process data for us, bound by contract to protect it and use it only to provide services to us (listed in Overseas disclosure and storage).
• Fiskil and SnapTrade, to maintain the connections you authorise.
• Our independent advice reviewer(s), for quality assurance, under a confidentiality agreement.
• Professional advisers such as lawyers, auditors and compliance consultants.
• Regulators and dispute bodies, including ASIC, the OAIC, the ACCC and AFCA, where required or authorised by law.
• A buyer or successor if our business is sold or restructured, subject to confidentiality obligations. CDR data will only be transferred as permitted by the CDR Rules.
• Anyone else you authorise.

We do not sell or rent personal information, and we do not disclose it to data brokers or advertisers.

Some of our service providers store or process data outside Australia. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs, including through contractual terms. CDR data is only disclosed overseas as permitted by the CDR Rules.

We will update this table if the kinds of providers we use, or where they store or process data, change. You can ask us for a list of our current service providers by contacting us (Complaints and contact).

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Our measures are set out in our Information Security Policy and include:

• encryption of data in transit (TLS) and at rest;
• access controls based on least privilege, with multi-factor authentication for staff access to production systems;
• row-level security so each user can only access their own records; error tracking and logging configured to exclude CDR data and financial details;
• server-side handling of CDR access tokens, which are never exposed to your device;
• logging and monitoring of access to systems holding personal information;
• security requirements in our contracts with service providers; and
• for CDR data, the information security controls required by Schedule 2 of the CDR Rules.

Data breaches. If a data breach is likely to result in serious harm, we will notify affected individuals and the OAIC under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth). We will also notify Fiskil, which may have its own obligations.

Please keep your login details private and notify us immediately via contact@pocketadviser.com.au if you suspect unauthorised access.

We keep personal information only for as long as we need it for the purposes in Why we collect, hold and use it, or as long as the law requires. When we no longer need it, we destroy or de-identify it, as required by APP 11.2. CDR data is deleted as described in Consumer Data Right.

Why we keep advice records. Section 912G of the Corporations Act 2001 (Cth) and regulation 7.7.10AE of the Corporations Regulations 2001 (Cth) require us to keep records of personal advice given to retail clients, including the client's relevant circumstances and the SOA or ROA, for 7 years. During this period, advice records are held separately from your active account data, access is restricted, and we use them only for compliance, complaints, dispute resolution and regulatory purposes.

Payment records. We keep financial records of our business for 7 years under section 286 of the Corporations Act 2001 (Cth) and tax law.

Closing your account. You can delete your account at any time in the Pocket Adviser web application. When you do, we:

1. permanently delete your manual transactions, manual investment holdings, uploaded files and AI chat history;
2. revoke your Fiskil and SnapTrade connections and delete any CDR and brokerage data we hold;
3. delete your profile, goals and financial situation information; and
4. retain your advice records (if any), and the minimum account details needed to identify them, for the legal retention period above.

Deletion from live systems happens within a short period of your request. Copies in backups are overwritten within 7 days. We do not delete inactive accounts automatically; your information is kept until you delete it or close your account, subject to the CDR consent limits in Consumer Data Right.

De-identified data. We may keep de-identified or aggregated data (which does not identify you) to improve our services. We do not create de-identified data from CDR data.

You can see and update most of your information directly in the app. You can also ask us for access to, or correction of, any personal information we hold about you, including your advice records, by contacting our Privacy Officer (Complaints and contact).

We will respond within 30 days. Access is free, although we may charge a reasonable fee for complex requests (never for making the request). If we refuse access or correction, we will tell you why in writing and how to complain. If we do not correct information, you can ask us to attach a statement that you believe it is inaccurate.

For CDR data, you also have rights under Privacy Safeguard 13 and our CDR Policy.

Marketing. We may send you news and offers about Pocket Adviser. Every marketing message includes an unsubscribe link, and you can opt out in your settings at any time. We comply with the Spam Act 2003 (Cth). We never use CDR data for marketing. We will still send essential service messages, such as security alerts and advice documents.

Anonymity. You can browse our website and ask general questions without identifying yourself. We cannot provide an account or personal advice anonymously or under a pseudonym, because we need to know who you are and your circumstances.

Cookies. Our website and app use cookies and similar technologies to keep you signed in, remember preferences, and understand how the service is used. We do not use advertising or cross-site tracking cookies. You can control cookies through your browser, but some features may not work without them.

If you have a question or complaint about privacy, you can contact us via contact@pocketadviser.com.au or use our contact form.

We will acknowledge your complaint within 1 business day and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact:

• Australian Financial Complaints Authority (AFCA) — www.afca.org.au, 1800 931 678, info@afca.org.au. AFCA deals with complaints about financial services, including privacy and CDR complaints. AFCA membership number — application lodged October 2026.
• Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au, 1300 363 992.

We may update this policy from time to time. We will publish the current version in the app and on our website, and tell you about material changes before they take effect. If a change affects how we handle CDR data, we will seek fresh consent where the CDR Rules require.

Last updated: 23 September 2026. Version 1.0.