Privacy Policy

1. The short version

• We only collect what we need to check who you are, decide on a loan, run the loan and meet the law.
• We read your bank transactions through a safe, read-only connection. We never see your banking password.
• We never sell your information.
• You can ask to see your information, and ask us to fix it. It is free to ask.
• If you are unhappy with how we handled your information, you can complain to us, and then to AFCA or the OAIC.

2. Who this policy covers

Anyone who uses our website, asks us a question, applies for or has a loan, talks to us, makes a complaint, or acts for someone who does. We may also give you a separate notice about credit reporting when we collect credit information.

3. What we collect

• Who you are and how to reach you: name, date of birth, home address, email, mobile number and identity document details.
• Your application: the amount, length and purpose of the loan, your household, the people who depend on you and any changes you expect.
• Your money: income, government payments, living costs, debts, repayment history, bank balances and bank transactions.
• Credit information: applications, credit you already have, repayment history, defaults, serious credit infringements, credit scores and credit reports, when the law allows us to get them.
• Information that helps us take care: answers about hardship, fraud, pressure from someone else and gambling. Some of this is sensitive information. We only collect it with your consent or when the law allows.
• Online information: your device, browser, internet address, cookies, security events and how you use our website.
• Our conversations: calls, emails, messages, complaints, consent records and documents you give us.

4. Where we get it

Mostly from you. With your permission, or where the law allows, we also get information from identity check services, bank data providers, credit reporting bodies, other lenders, Services Australia, fraud prevention services, people who act for you, public registers and our service providers. If you give us information about someone else, you must have their permission, and you should tell them about this policy.

5. Why we use it

• to check who you are, stop fraud and keep accounts safe;
• to work out whether you can borrow, whether the loan suits what you need, whether you are in the group the loan is designed for, and whether the loan would be unsuitable for you;
• to get and check bank transactions, credit reports and other evidence;
• to set up, run, change and collect the loan, including hardship help and complaints;
• to send you documents and messages, and keep records of notices, consents and contracts;
• to improve our service, check our work and train our staff;
• to meet our legal, reporting, audit and law enforcement duties; and
• to send you marketing, but only if you agreed. You can say no at any time and still get messages about your loan.

6. Automatic checks

We use software to help us. It checks your identity and evidence, reads your bank transactions, works out your income and expenses, checks your application against our lending policy, looks for fraud and flags anything a person needs to look at closely. The software does not approve or decline an application. A person makes every lending decision. We can tell you what the software found. If information is missing, does not match, or needs judgement, a person reviews it carefully. You can ask us about a decision or make a complaint at any time. Your legal rights are not affected.

7. Your bank data

With your permission, our approved provider reads your bank balances and transactions through a read-only connection. It cannot move money, and we never see or keep your online banking password. We use the data to check your income, living costs, debts, repayments, gambling and whether the loan is affordable. We may ask you to connect every account your income is paid into.

8. Credit reporting

We may get credit reports from, and give credit information to, the credit reporting bodies we deal with. We name them here, with their contact details, before we first ask one for a credit report. Creditcrest Technologies runs our credit enquiries and reports for us, under our own agreements with those bodies. It does not keep your credit information: the reports and the record of each enquiry are kept in our systems.

Credit reporting bodies may include what we tell them in reports they give other lenders. Where the law allows, we may report your repayment history, defaults or serious credit infringements. You can ask a credit reporting body not to use your information to pre-screen you for direct marketing, and not to use or share it if you think you have been, or may be, a victim of fraud. You can ask us or them to see or fix your credit information, and you can complain about it.

9. Who we share it with

We use Creditcrest Technologies Pty Ltd (ABN 80 702 318 778), an Australian software company, to run our online application, assess applications, manage loans and keep the records the law requires. Creditcrest handles your information only to provide those services to us and on our instructions, and your records are kept in our own systems. Creditcrest uses these suppliers, which may process your information: Cloudflare (hosting and network services), Didit (identity document, selfie and liveness checks, and screening against sanctions and politically exposed person lists), Resend (emails), Twilio (text messages), Zepto Payments (paying your loan and collecting repayments under a PayTo agreement you approve), and our bank data providers, Fiskil and illion, which read your bank transactions with your consent. Fiskil is accredited under the Consumer Data Right.

We also share information only when we need to and the law allows with: our identity, bank data, cloud, messaging, e-signing, payment, direct debit, analytics, fraud, collection, legal, audit and customer service providers; credit reporting bodies and other lenders; government agencies, courts, regulators and police; anyone who buys or funds our loans; and anyone you ask us to deal with for you. We never sell your information.

10. Overseas

Some of our technology or support providers may handle information outside Australia. The countries likely to receive it are: the United States (Cloudflare, which hosts our systems on a global network; Resend, which sends our emails; and Twilio, which sends our text messages) and Spain (Didit, which checks identity documents). Before we share information overseas, we take the steps the law requires to protect it: we take reasonable steps to make sure these providers handle your information consistently with the Australian Privacy Principles, through our agreement with Creditcrest and Creditcrest’s agreements with them.

11. Keeping it safe, and for how long

We protect your information with access controls, encryption when it travels, monitoring, checks on our providers, staff training and safe disposal. No online system is completely risk-free. We keep loan and application records for 7 years after the loan ends or the decision is made, because credit and anti-money laundering laws require it. Raw bank transaction data is kept for 365 days. When we no longer need information, we delete it or remove anything that identifies you, unless the law says we must keep it.

12. See or fix your information

You can ask to see the personal and credit information we hold about you, and ask us to fix anything that is wrong. We will check who you are first. We will answer within 30 days. If we say no, we will tell you why in writing and how to complain. Asking is free. If the law allows, we may charge a reasonable cost to give you access, and we will tell you first.

13. Cookies

Our website uses cookies that it needs to work and stay secure, and may use some cookies to count visits. You can turn off cookies it does not need in your browser. If you turn off the ones it needs, parts of the application may not work.

14. Complaints and data breaches

To make a privacy or credit reporting complaint, contact our Privacy Officer through our Support page, by post at Suite 17, 89-97 Jones Street, Ultimo NSW 2007, Australia. We will tell you we have it within 1 business day and give you our answer within 30 days. If you are not happy with our answer, you can go to the Australian Financial Complaints Authority (AFCA) for credit and credit reporting matters, or the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

If information about you is lost or seen by the wrong people in a way that is likely to cause you serious harm, we will tell you and the OAIC, as the law requires.

15. Changes to this policy

We may update this policy when our practices, providers or the law change. The current version and its date are always on this page. If a change affects something you agreed to, we will tell you where the law requires.