Privacy Policy

Clova is in development. Our website, research and educational tools are available now; the app and connected banking are not yet available. This policy explains current information handling and the planned approach for future app services.

Clova is operated by M.C FERWERDA & J SAMOROWSKI trading as CLOVA GROUP, ABN 75 984 938 875. In this policy, “we”, “us” and “our” refer to that business. Personal information is information or an opinion that identifies you or could reasonably identify you.

Information we collect and why

Service	Information	Purpose
Website and marketing	Page visits, interactions, referral details, device information and analytics identifiers	Understand how people find Clova and improve the website
Registration and updates	Contact and profile details, such as an email address, name, phone number or age bracket	Register your interest, manage access invitations and send relevant updates
Research and feedback	Responses about money habits, needs, preferences and experiences, with optional contact details and profile links	Understand people's needs, inform product development and support research follow-up
App account	Account details, sign-in information and sessions	Identify your account, provide access and protect it
Budgets and goals	Information you enter and financial information you choose to connect	Provide the budgeting and money-management features you request
App diagnostics	Filtered feature-use, onboarding, error and reliability events	Improve the app and investigate technical problems
Support and complaints	Contact details, messages and relevant case records	Respond to enquiries, resolve complaints and handle privacy requests

We generally collect information directly from you or through your use of a service. For a future connected-banking service, the planned approach is for Fiskil to collect authorised banking information with your consent and share it with Clova. Clova does not currently collect CDR banking information.

You can browse our public material without giving us your name, although website analytics and hosting services may still process technical information. We need an email address to manage a waitlist place and account details to provide an account. Without required information, we may be unable to provide the relevant service.

Registration, research and feedback

You can register your interest in Clova, request updates or take part in optional research and feedback through our website. These activities may include waitlists, surveys and questionnaires. We use contact and profile details to manage registrations and communications. Responses about your money habits, needs, preferences and experiences help us improve Clova. Each form identifies the information requested and whether it is required or optional. Research participation is not required to keep a waitlist place.

Our website research and feedback forms do not request CDR banking data, banking passwords, account numbers or transaction histories. Please do not include these details in free-text responses.

A private research link can connect your response to details you have already provided. Public share links do not reveal another participant's private answers. We may send a confirmation or thank-you email when you provide an email address. Taking part in research does not subscribe you to marketing.

Registration communications include relevant product and access updates. If you provide an optional phone number for an access notification, we use it for that purpose. You can unsubscribe from marketing emails through the email link or contact us. Unsubscribing stops those messages; it does not itself delete your research response or account.

Website analytics and browser storage

We use PostHog for website analytics and heatmaps where enabled. Events include page interactions, referral information, broad device details and the channel selected when sharing a link. They do not tell us the recipient or whether a message arrived. Session recording is disabled. The marketing website does not provide a Clova analytics opt-out setting.

We filter private research routes and routes containing access credentials. We do not deliberately send contact details, research responses, typed form content, financial information or private access links to website analytics.

An analytics identifier may be linked to a registration profile. We treat it as personal information even if it does not contain a name or email. At signup, an IP address may be used to estimate your country, region and city. The registration record does not store the raw address, although hosting and security providers may process it separately.

Cookies and similar browser storage support analytics and private research access. A private link and secure cookie can recognise or resume a response for up to 90 days. We store only a hash of the access credential on the server. Keep private links secure, as someone with a valid link may be able to access its saved response.

Some registration and research forms also use browser storage to remember an email address or an unfinished response. These copies remain until cleared or, for research drafts, removed after successful submission. Clearing site data removes browser copies, not information already submitted. Browser privacy settings can limit storage, but may affect some features.

Connected banking and app analytics

The Consumer Data Right (CDR) lets you choose to share eligible banking information for a specific service. Clova plans to support this through Fiskil, subject to the required arrangements being in place before launch. A separate consent process identifies the information requested, its purpose, the recipients and the sharing period. Accepting our terms or this policy does not provide CDR consent.

Connected information can support spending categorisation, budgets, upcoming bills and savings progress. Information derived from banking data, such as an insight linked to you, can also be protected CDR data.

App analytics uses filtered product-use, error and reliability events. It excludes financial content and events describing access to or viewing of CDR data. Marketing tracking, heatmaps and session recording are excluded from authenticated app surfaces. Account-linked analytics identifiers remain personal information. Necessary security and CDR audit records are separate from product analytics.

We do not use this policy to authorise advertising, general AI model training or cross-customer learning from your CDR data.

Age and eligibility

Our public material and app downloads do not have a blanket adult-only restriction. CDR bank connections have separate eligibility requirements, including being at least 18. Younger users may use features available without a CDR connection. Feature availability is explained when a service is offered.

Our service provider list explains who supports Clova, what each provider does and the information involved. Providers may host services, store records, deliver emails or process technical events. Contact messages pass through our email provider and support mailbox.

Information is shared for the relevant service or where required or authorised by law, subject to applicable privacy protections. A new use requires assessment and any consent the law requires.

Some website, analytics, email and support services involve overseas processing. Australian hosting does not necessarily cover a provider's support access, logs or backups. See the provider location explanation.

Protecting your information

We use access restrictions and safeguards appropriate to the information and service. CDR information is subject to additional security and provider requirements under the CDR framework and Fiskil arrangement. If a breach requires notification, we must notify affected people and the relevant regulator under applicable law.

Keep your sign-in details and private links secure. Do not send banking passwords, card numbers or detailed financial records through the public contact form. Report suspected unauthorised access to support@getclova.com.

Retention and deletion

Retention depends on the purpose of the information and any legal obligation. When information is no longer needed, the applicable privacy requirements govern its deletion or lawful de-identification. De-identification means removing the reasonable ability to identify a person, not simply removing a name.

We retain profile-linked research and feedback responses for ongoing research and possible follow-up. There is no fixed response expiry or automated cleanup process at present. These responses remain personal information while linked to you. A private research credential expiring after 90 days does not delete the response.

You can request deletion of registration details, research and feedback responses or other personal information. We assess the request, explain any necessary retention and confirm the outcome. Our deletion process covers relevant provider copies and backups as well as active records.

CDR information has separate deletion obligations. Our CDR explanation covers consent withdrawal, expiry, your deletion choice and directions from Fiskil.

Deactivation and account deletion

Deactivation provides a temporary recovery period. You can reactivate your account yourself during the first 30 days or contact us for team-assisted recovery during the next 60 days. After 90 days, remaining account information is deleted unless there is a lawful reason to retain it.

An explicit deletion request is separate from deactivation. You can contact us without waiting for the recovery period to end. The 90-day window does not delay CDR deletion. Reactivation cannot restore banking information that must be deleted; reconnecting may require fresh consent.

Necessary non-CDR records and previously lawfully de-identified information may remain for their permitted purposes. Account closure does not authorise us to create a training dataset from your CDR data.

Request a copy or correct your information

Email support@getclova.com or use Contact us to request a copy of your personal information, a correction or deletion. Tell us which information or service your request concerns and how we can reply. We may need to verify your identity before releasing or changing records.

You can ask for an accessible format. We respond within a reasonable period and explain the outcome. There is no fee to make an access request or request a correction. If providing access would involve a lawful charge, we explain it before proceeding. Corrections are free.

If we cannot identify a research or feedback response or fulfil a request, we explain the reason and available complaint options. Where a correction is refused, you can ask us to associate a statement of your concern with the information. CDR access and correction requests follow Fiskil's CDR Policy.

Privacy complaints

Contact support@getclova.com with what happened, the outcome you would like and your preferred reply details. No special form or wording is required. We acknowledge the complaint, investigate and explain the outcome or next steps. If more time is needed, we explain the delay and available escalation options.

If you are dissatisfied, you can contact the Office of the Australian Information Commissioner. CDR complaints can also be directed to Fiskil through our CDR complaints guidance.

This policy and your rights

This policy is informed by the Australian Privacy Principles. CDR information has additional protections under the CDR framework and the applicable Fiskil arrangement. Neither policy wording nor a terms update replaces a consent requirement.

We update this policy when our information handling changes. Material changes receive notice or fresh consent where required. The date above identifies this version. You can request a copy of the policy or help understanding it through our support channel.

Read our Terms of Service, service provider list and CDR explanation for related information.