Consumer Data Right Policy

Scope

Flow Wealth provides a household financial intelligence service that can access your personal banking information securely through Open Banking. The rules for Open Banking are set out in the Consumer Data Right (CDR), which gives Australians greater choice and control over how their data is used and disclosed.

To access customer banking data, a person must be identifiable or reasonably identifiable. The data requested from the bank accounts you nominate must relate to you and be appropriate for your use. This can include banking data from a joint account when you are an account holder.

Flow Wealth Pty Ltd (ABN 62 699 173 085, ACN 699 173 085) acts as a CDR Representative. Flow Wealth is not an accredited data recipient (ADR). CDR data is received under a representative arrangement with our accredited Open Banking partner, Wych, in accordance with the CDR Rules.

Collection of your personal banking data

Flow Wealth adopts a data minimisation approach and only collects information that is necessary to provide the service.

There are no fees for accessing your personal banking data through Open Banking. Flow Wealth does not request voluntary product or consumer data that a data holder is not obliged to supply under the CDR Rules.

With your consent, banking data is used to maintain an accurate household financial picture, compute Financial Health overviews, and generate educational decision-support content. Flow Wealth does not initiate payments, move money, or execute transactions on your behalf.

When you connect an account, you are redirected to our accredited Open Banking partner’s consent flow. You authenticate directly with your bank. Flow Wealth never receives or stores your banking login credentials.

A consent receipt is provided when you grant consent. You can review active connections, consent scope, and last sync information from Profile → Connected data in the Flow Wealth application. You can amend or withdraw consent from that screen or by contacting us.

Classes of CDR data

The following classes of CDR data may be accessed while your consent is active. We retain only the minimum fields required after normalisation — not every attribute listed below is stored in full.

• Account information — account name, type, balance, and other account metadata made available under your consent (such as interest rates, fees, or terms where supplied by the data holder).
• Transaction details — incoming and outgoing transactions, amounts, dates, and descriptions, including counterparty information where included in the CDR payload (for example name, BSB, or account identifiers).
• Direct debits and scheduled payments — where included in the consent scope and supplied by the data holder, to help you understand regular commitments.
• Payees — names and details of saved payees where supplied under consent.
• Connection metadata — Open Banking connection identifiers, consent status, and sync timestamps (not banking passwords or one-time codes).

Purposes of CDR data

Account information and transaction details are used to support your household with financial visibility — including cash flow, liquidity, debt, wealth, and stability insights, Financial Health scores, and educational focus areas.

Outputs are informational and educational. They are not personal financial advice and do not instruct you to buy, sell, or transfer financial products.

CDR data may be combined with information you enter manually (such as during check-in) to improve completeness when you choose to provide it.

Disclosure

Flow Wealth does not sell your personal information or CDR data.

Flow Wealth does not disclose or use your personal banking data for commercial data-brokerage purposes.

Flow Wealth does not disclose your CDR data to third parties for their independent direct marketing.

CDR data is disclosed only to subprocessors that help us operate the service under contractual controls, as described under Outsourced service providers. We do not disclose CDR data to non-accredited parties for their own unrelated use.

Outsourced service providers

Flow Wealth uses trusted providers to deliver Open Banking and the platform. The following may process or host CDR data on our behalf:

• Wych (Australia) — accredited data recipient; consent management, bank relay, and read-only CDR API delivery to Flow Wealth.
• Supabase Inc. (Australia — Sydney region) — authentication and encrypted database hosting for CDR-derived financial data.
• Vercel Inc. (Australia — Sydney region) — application hosting; transient processing only, no CDR database.

AI processing of banking data

Financial analysis, scoring, and household intelligence run inside Flow Wealth before any optional natural-language presentation.

When AI narration is enabled (for example in Ask Flow), only pre-computed explanation objects and structured summaries are sent to our AI provider. Raw CDR transaction feeds, account numbers, and banking credentials are never sent to AI services.

AI narrates stored reasoning; it does not generate recommendations from raw banking data. You can use core Flow Wealth features without AI narration where the product provides a non-AI path.

Telemetry providers (PostHog EU and Sentry) are configured so that CDR payloads and financial values are not transmitted for analytics or error reporting.

Consent management

You initiate every Open Banking connection. Consent is granted through the accredited Open Banking partner’s CDR consent interface after you authenticate with your data holder.

Consent is limited to read-only data scopes required to deliver Flow Wealth. You can view active connections in the application and withdraw consent at any time.

If you do not connect Open Banking, Flow Wealth can still be used with information you enter manually, subject to product availability.

Consequence of withdrawing consent

When you stop sharing data with Flow Wealth for a connected account, we stop collecting new CDR data for that connection and begin deletion of CDR-derived data we previously received for it, as described under Deleting CDR data.

Without Open Banking data, features that depend on up-to-date balances or transactions may be limited until you reconnect or update information manually.

• Transaction details — if you stop sharing these, we can no longer refresh spending and income patterns from that account.
• Direct debits and scheduled payments — if you stop sharing these, we can no longer identify regular payment commitments from that account.

Deleting CDR data

You can stop sharing data at any time from Profile → Connected data in the Flow Wealth application, through your bank’s data-sharing settings where applicable, or by emailing us.

Subject to legal retention requirements, Flow Wealth deletes or de-identifies CDR-derived banking data — including derived scores and intelligence outputs tied exclusively to that Open Banking connection — when any of the following occur:

• Your consent for access to banking data expires.
• You withdraw consent or disconnect Open Banking before consent expires.
• You delete your Flow Wealth account or use an account action that removes connected data.
• Your data holder or accredited partner notifies us that you are no longer an eligible consumer for that connection.

Accessing and correcting your personal information

CDR-derived information we hold is accessible through the Flow Wealth application while your account is active. If you need CDR data in another format to request correction, contact us and we will provide it where reasonably possible.

To request correction, email us with enough detail for us to assess the issue. We will respond with what we did, any corrective action taken, and how to escalate if you remain unsatisfied.

Events for notifying CDR consumers

Flow Wealth does not make your banking data visible to outside organisations except as described in this policy and our Privacy Policy.

We employ information security practices aligned with our Information Security Policy and CDR obligations.

If a data breach affects CDR data we hold — for example unauthorised access that is likely to result in serious harm — we will notify affected consumers as soon as practicable and in line with applicable law.

We will also inform you when you consent to collect, use, or disclose CDR data; when consent expires; when you amend or withdraw consent; when we access your data under an active consent; and when we action a correction request. Notifications may be in-app, by email, or at the time of the event when you are present.

How to contact us

You can contact Flow Wealth Pty Ltd by email at support@flowwealth.ai. We will respond as soon as practically possible.

Our website is https://flowwealth.ai.

How to make a complaint or request redress

If you believe there has been a breach of the CDR Rules involving Flow Wealth, or you wish to request correction, deletion, or an apology relating to CDR data, email support@flowwealth.ai with:

• Your name and contact details.
• Your preferred contact method (phone, email, or letter).
• The details of your complaint or request.

Complaint handling

We acknowledge CDR complaints within one (1) business day of receipt.

We investigate complaints and aim to provide a written response within thirty (30) calendar days.

If your complaint is not resolved within thirty (30) calendar days, we will write to you with the reasons for delay, when a decision can reasonably be expected, and your external dispute resolution options.

When a complaint is resolved, we provide a final response within forty-five (45) calendar days of receipt, including the outcome and your right to escalate to external dispute resolution.

The Office of the Australian Information Commissioner (OAIC): online at www.oaic.gov.au/privacy, email enquiries@oaic.gov.au, phone 1300 363 992, or mail GPO Box 5218, Sydney NSW 2001.

The Australian Financial Complaints Authority (AFCA): phone 1800 931 678, or mail GPO Box 3, Melbourne VIC 3001, Australia.

CDR representative arrangement

Flow Wealth accesses CDR data as a CDR Representative under a representative arrangement with Wych, our accredited Open Banking partner that manages consent and receives authorised data from data holders.

Flow Wealth offers the Flow Wealth household financial intelligence service under this arrangement. Wych remains responsible for accredited recipient obligations relating to the CDR data it receives; Flow Wealth is responsible for how it handles CDR data once received under consent and this policy.

Availability of this policy

This policy is published at https://flowwealth.ai/legal/cdr-policy and is available within the Flow Wealth application from Settings and connected-data flows where Open Banking is offered.

A copy can be requested by emailing support@flowwealth.ai.