Consumer Data Right policy
The Consumer Data Right (CDR) lets you share data your bank holds about you with accredited providers. SubSweep, operated by Qadan Analysis Consulting (ABN 20655113670), uses CDR data as a CDR representative of Basiq Pty Ltd, an accredited data recipient (accreditation held by Basiq). This policy explains what we collect, how we use it, and your rights. It sits alongside our privacy policy.
1. What CDR data we collect
When you choose "Connect bank" and give consent on Basiq's consent screen, we receive:
- A list of the accounts you selected and the institution they belong to.
- Transaction history for those accounts: date, description, amount and direction.
We request transaction data only. We do not request balances, personal details, payee lists or direct debit authorisations.
2. Why we collect it
For one purpose: to detect recurring charges in your transactions and show you what they cost, when they were last charged, whether the price changed, and whether a recent charge may be refundable. Where you enable monthly monitoring, we re-check your connected accounts about every 30 days for the same purpose and email you what changed.
3. How we handle and store it
- Transaction data is retrieved from Basiq into server memory, analysed, and discarded. We do not write raw CDR data to disk or to our database.
- We keep only the derived results: merchant names, amounts, frequency and totals for the recurring charges we identified. These are stored against your account.
- Data is encrypted in transit. Our database is hosted with Railway, which may store data outside Australia. Access is restricted to the operators of the service.
4. Who we disclose it to
We do not disclose CDR data to any third party. It is not sold, shared with advertisers, or used to train models. Basiq, as the accredited data recipient, holds your consent record and the connection to your bank; its CDR policy is at basiq.io.
5. Your consent and how to withdraw it
- Consent is given on Basiq's consent screen, where you choose the accounts, the data and the sharing period.
- You can withdraw consent at any time by clicking Disconnect bank in the SubSweep app. This deletes the connection at Basiq and removes any bank data from your session immediately.
- You can also withdraw consent through your bank's own data-sharing dashboard, or by emailing hello@subsweep.com.au.
- Consents expire at the end of the sharing period you chose, after which no further data is collected.
6. Deletion and de-identification
When consent is withdrawn or expires, any CDR data in memory is discarded. Derived analysis results remain in your account so your history is preserved; you can delete them by deleting your account (see the privacy policy) and we will remove them within 10 business days. We do not de-identify CDR data for other uses.
7. Correcting data
CDR data comes directly from your bank and we cannot alter it. If you believe transaction data is inaccurate, contact your bank. If a recurring charge has been misidentified in your results, email us and we will correct the detection.
8. Complaints
Email hello@subsweep.com.au with "CDR complaint" in the subject. We acknowledge complaints within 2 business days and aim to resolve them within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, for matters concerning the accredited data recipient, to Basiq.
9. Contact
Qadan Analysis Consulting · hello@subsweep.com.au