Privacy Policy

This policy is issued by Wildcardapp Pty Ltd (ACN 688 712 585, ABN 24 688 712 585) of 13, 484 Graham Street, Port Melbourne VIC 3207. It covers the WildCard mobile app and our website at wildcardapp.com.

For privacy questions, requests or complaints, email support@wildcardapp.com.

We handle personal information in line with the Australian Privacy Principles. Information we receive through the Consumer Data Right is also handled under the CDR rules and privacy safeguards.

Information you give us

• Your name, mobile number and email address when you sign up, and your marketing preferences.
• Security details you set, such as a passcode.
• Subscriptions and details you add or edit yourself.
• Messages you send us, for example for support or to make a complaint.
• If you join our waitlist, your email address and your marketing preferences.

Information from your bank, if you connect an account (CDR data)

• Account and transaction data from the accounts you choose to connect, collected through Fiskil (see section 3).
• Information we work out from that data to provide WildCard.

Information collected automatically

• Technical information about your device, how it connects to us and how you use the app, such as device type, app version, IP address and crash reports.
• A notification token, if you allow notifications, so we can send them to your phone.
• On our website, information collected through cookies and similar technologies (see section 7).

Sensitive information

We don't set out to collect sensitive information, and we designed our subscription detection around digital subscriptions. But transaction data can sometimes reveal sensitive things about a person, for example a subscription to a health or religious service. We treat all transaction data with care for that reason.

• We are a CDR representative of Fiskil Pty Ltd, an unrestricted accredited data recipient (accreditation number ADRBNK000246), under a CDR representative arrangement between Fiskil Pty Ltd and Wildcardapp Pty Ltd.
• We use a platform provided by Fiskil to manage bank connections, consents and the data we receive.
• With your consent, Fiskil collects your banking data from your bank and discloses it on our behalf, for one purpose: to provide WildCard's subscription tracking, reminders and insights.
• Your CDR data, and everything we work out from it, is handled under Fiskil's CDR Policy, which we adopt: fiskil.com/legal/cdr-policy.
• You're in control. You choose which accounts to connect. Your consent lasts 12 months. You can withdraw your consent at any time in the app.
• Read-only. The connection lets us read account and transaction data. It can't be used to move money.
• Deletion. When your consent expires or you withdraw it, your CDR data and everything we worked out from it is deleted under the CDR rules and Fiskil's deletion process. Subscriptions you added yourself can stay.
• We never sell your CDR data, never share it for anyone else's marketing, and never use it for marketing ourselves.

• To provide the service: including finding likely subscriptions and sending you reminders and alerts about them.
• To contact you: messages about your account, your bank connections and your subscriptions, and, only if you've agreed, product news and marketing (see section 7).
• To keep WildCard safe and working, and to improve it: security, fixing problems, understanding how people use the app, and preventing misuse.
• To meet our legal obligations: including CDR record-keeping and deletion, handling complaints, and notifying data breaches.

We use your mobile number to send you sign-in codes and for account security. We don't send marketing by text message.

We don't sell personal information, and we don't give it to anyone else for their own marketing.

• Fiskil Pty Ltd, our CDR principal (see section 3).
• Service providers who help us run WildCard, such as providers of cloud hosting, sign-in and text messages, push notifications, email, app analytics and error monitoring, and our office and support systems. They may only use your information to provide services to us. The app's data is hosted in Australia; section 6 explains the providers that handle some information overseas.
• Our professional advisers and insurers, such as lawyers, where we need advice, for example about a complaint, a legal claim or a data breach.
• Government authorities and regulators, where the law requires it.

Some of our service providers, including those that deliver push notifications, store or process personal information outside Australia, including in the United States and the European Union.

When we send personal information overseas, we take reasonable steps to make sure it's handled in line with the Australian Privacy Principles. CDR data is subject to stricter rules.

• Service messages and reminders are part of the product: reminders and alerts about your subscriptions, bank connection updates, and security or account notices. They're factual and contain no promotional content. You can turn off most notifications in WildCard, and all push notifications in your phone's settings.
• Marketing messages, by email or push notification, are only sent if you've agreed to receive them. Each one has a way to opt out, which is free and doesn't require you to log in. Opting out of marketing never affects your reminders or service messages.
• We don't use your bank data to choose who gets marketing or to trigger it.
• Cookies. Our website uses cookies and similar technologies so that it works properly, to understand how visitors use it, and to measure how well our advertising works. You can block or delete cookies in your browser settings.

Protecting your information is central to how we build WildCard. Our steps include:

• Bank connections through the Consumer Data Right. You approve each connection with your bank. We never see or store your bank login details.
• Read-only access. The connection lets us read your data. No one can use it to move money.
• Data hosted in Australia. The app's data is stored in Australia. Section 6 explains the providers that handle some information overseas.
• Encryption. Your information is encrypted when it travels between your phone and our systems.
• Account protection. Signing in needs a one-time code sent to your mobile, and the app is protected by a passcode you set.
• Limited access. Only the people and systems that need your information to run WildCard can access it.

No one can guarantee perfect security, and we don't claim to. If a data breach is likely to cause you serious harm, we'll tell you.

• CDR data and everything we work out from it: only while your consent is active. It's deleted when your consent expires or you withdraw it.
• Your account details and subscriptions you added yourself: while your account is open. When you delete your account, we delete them promptly.
• Support and complaint messages: up to 2 years after the matter is closed.
• Waitlist details: until you unsubscribe or ask us to remove you. If you unsubscribe, we keep your email address only so that we don't email you again.
• Records the law requires us to keep, such as some records about your consents and complaints under the CDR rules: for as long as the law requires, which for some CDR records is up to 6 years. These are records about your consents and requests, not your transaction data.

Deleted information, including CDR data, may remain in our secure backups until those backups expire, which takes no more than 14 days. While it's there, we don't access or use it. If we ever need to restore from a backup, we delete that information again before the restored system is used.

Deleting your account. You can delete your account at any time in the account area of the app. When you do, we end your bank connections and delete your bank data straight away. We delete your other personal information promptly, except for the records described above that we must keep.

You can ask for a copy of the personal information we hold about you, ask us to correct it, or complain about how we've handled it. Email support@wildcardapp.com. We'll acknowledge a complaint within one business day and give you an outcome within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992.

For complaints about bank data collected through the Consumer Data Right, you can also contact Fiskil at complaints@fiskil.com.au, and then the Australian Financial Complaints Authority: afca.org.au, 1800 931 678 (Fiskil's membership number is 83521).

WildCard is for people aged 18 and over. We don't knowingly collect personal information from children.

We analyse transaction data automatically to suggest likely subscriptions and estimate renewal dates. Nothing is added to your subscriptions until you confirm it, and you can dismiss any suggestion.

The version number and date are shown at the top of this page. If we make a material change, we'll tell you in the app or by email before it takes effect.