CDR data policy

1. About this page #

This page explains how Kaibr handles bank data that you share with us through the Consumer Data Right (CDR). Kaibr is a CDR representative of Fiskil Pty Ltd. As a CDR representative, Kaibr has adopted, and complies with, Fiskil's CDR Policy for all CDR data we receive and all data we derive from it.

Fiskil's CDR Policy is the CDR policy that applies to your CDR data: https://www.fiskil.com/legal/cdr-policy. This page summarises how it applies to Kaibr. If this page and Fiskil's CDR Policy differ, Fiskil's CDR Policy applies.

Our Privacy Policy explains how we handle other personal information.

2. Fiskil, our CDR representative principal #

Kaibr is not an accredited data recipient. Kaibr Technologies Pty Ltd (ACN 704 097 870, ABN 66 704 097 870) is a CDR representative of Fiskil Pty Ltd (ABN 89 646 260 728), an accredited data recipient (accreditation number ADRBNK000246). When you connect a bank account, Fiskil collects your CDR data from your bank at our request and discloses it to us so we can provide the Kaibr Service. Fiskil is responsible under the CDR Rules for making sure we handle your CDR data properly.

3. The CDR data we ask for #

With your consent, we ask for these classes of banking data:

• Account details: account name, type and number details needed to identify the account [exact data clusters TBC against the consent flow];
• Balances: current and available balances; and
• Transaction details: dates, amounts, descriptions and merchant details of transactions.

We do not ask for direct debit or scheduled payment data. We also hold data we derive from your CDR data, such as cleaned-up merchant names, spending categories, summaries and insights. We treat this derived data as CDR data.

4. How we use your CDR data #

We use your CDR data only to provide the Kaibr Service you asked for: the AI Money Agent's insights, briefs, alerts, nudges and budgeting tools. We do not sell your CDR data, we do not use it for direct marketing, and we do not use it to train AI models.

5. Read-only access #

Our access to your bank data is read-only. We can see the account information you agree to share. We cannot make payments, move money or change your accounts with this access.

6. Your consent #

We collect and use your CDR data only with your express consent. Before you connect, we show you the data we ask for and why, how long your consent lasts (no more than 12 months), the providers that may access your data, and how to withdraw. You confirm sharing with your bank, and you receive a CDR receipt. You can withdraw your consent at any time in the Kaibr app, through your bank's data sharing dashboard, or by contacting us or Fiskil.

7. Outsourced service providers and overseas disclosure #

These outsourced service providers may access your CDR data:

• Fiskil Pty Ltd: provides the open banking platform we use (Australia).
• Amazon Web Services: hosts the Kaibr Service and runs our AI model through Amazon Bedrock, in the Sydney and Melbourne regions only [AWS contracting entity TBC] [Fiskil approval of AWS as an outsourced service provider: confirm before publication].

Overseas disclosure: we do not disclose CDR data, or data derived from it, to anyone outside Australia.

Apple, PokitPal and our other service providers do not receive your CDR data.

8. Accessing and correcting your CDR data #

You can ask us for a copy of the CDR data we hold about you, and you can ask us or Fiskil to correct it. We will respond as set out in Fiskil's CDR Policy. There is no charge.

9. Deletion and de-identification #

When your consent is withdrawn or expires, Fiskil stops collecting your data and we stop using it. In line with Fiskil's CDR Policy, CDR data that is no longer needed, including data derived from it, is deleted, not de-identified. We keep only the records the CDR Rules or other laws require, such as records of your consents. You can also choose, before or after your consent ends, to have your redundant data deleted, as set out in Fiskil's CDR Policy.

10. Complaints #

1. Contact us first. Tell us in the app (Help, then Make a complaint) or using the details below. We acknowledge your complaint by the end of the next business day and give you a final response within 30 calendar days. We tell Fiskil about every CDR complaint and work with Fiskil to resolve it.
2. Fiskil. You can also contact Fiskil's Complaints Officer at any time at complaints@fiskil.com.au.
3. OAIC. You can complain to the Office of the Australian Information Commissioner: www.oaic.gov.au, 1300 363 992.
4. AFCA. If your CDR complaint is not resolved, you can take it to the Australian Financial Complaints Authority under Fiskil's AFCA membership: www.afca.org.au, 1800 931 678.

[AFCA, for Kaibr's own membership: show only once membership is confirmed.]

11. Contact us #

• In the app: Help, then Make a complaint
• Email: support@kaibr.ai
• Post: [postal address TBC]
• Kaibr Technologies Pty Ltd (ACN 704 097 870, ABN 66 704 097 870)