1. About this policy
Moneyhero Australia Pty Ltd (“Moneyhero”, “we”, “us” or “our”) operates the Moneyhero comparison platform at moneyhero.com.au and any associated applications (together, the “Service”).
We are committed to protecting your personal information and handling it in accordance with the Privacy Act 1988 (Cth) (the Privacy Act) and the thirteen Australian Privacy Principles (APPs) contained in Schedule 1 of that Act. This Privacy Policy explains what personal information we collect, why we collect it, how we use and disclose it, and what rights you have.
By using the Service you consent to the practices described in this policy. If you do not agree, please do not use the Service.
2. What personal information we collect
The personal information we may collect depends on how you interact with us:
Contact & account information
- Name and email address (when you create an account or enquire)
- Password (stored as a one-way hash — we never see it in plain text)
- Phone number (if you choose to provide it)
Comparison & profile data
- Postcode or full address (to match you to available providers and plans)
- Energy usage (kWh/MJ), tariff type, current provider and plan
- Household composition (number of occupants, property type, rental/owned)
- Internet usage patterns, preferred speed tier, current provider
- Insurance preferences: cover type, vehicle details, health tier, sum insured
- Home loan details (principal, rate, remaining term) for calculator tools
- Life stage information (e.g. single, couple, family) where relevant to comparison
Bill & document data
- Scanned or photographed bills you voluntarily upload via our bill-upload feature
- Extracted data (NMI/MIRN identifiers, usage figures, distributor region, tariff codes)
Technical & device data
- IP address and approximate location derived from it
- Browser type, version, and operating system
- Pages visited, links clicked, time on page, and funnel steps completed
- Referring URL and search query where applicable
- Session identifiers and cookies (see Section 8)
We do not intentionally collect sensitive information (e.g. health status, racial or ethnic origin, religious beliefs, criminal record) unless you voluntarily include it in uploaded documents or free-text fields. If you do, we treat it with the additional protections required by the Privacy Act.
3. How we collect your information
- Directly from you — when you register an account, complete a comparison form, upload a bill, subscribe to our newsletter, or contact our support team.
- Automatically — through cookies, server logs, and analytics tools as you browse the Service (see Section 8).
- From third parties — we may receive updated contact details or plan data from energy retailers, insurance providers, and other third parties where you have consented to that sharing.
Where it is lawful and practicable to do so, you may use parts of our Service without identifying yourself (for example, browsing guides or using our calculators without an account).
4. Why we collect your information
We collect and use personal information for the following primary purposes:
- To provide, operate, and personalise the comparison Service
- To match you with relevant plans, providers, and offers in your area
- To process a bill upload and extract comparison-relevant data
- To create and manage your account and send account-related communications
- To facilitate a switch or referral to a provider you select (which may involve passing your details to that provider — see Section 5)
- To respond to your enquiries or complaints
- To send you marketing communications where you have opted in (see Section 7)
- To improve the Service through analytics, A/B testing, and user research
- To detect, investigate, and prevent fraud, abuse, or security incidents
- To comply with our legal and regulatory obligations
5. Disclosure of your information
We may disclose your personal information to:
- Providers you choose — when you click “Switch”, “Get a quote”, or an equivalent call to action, we pass the details you have entered (or that we have pre-filled from your account or bill) to the selected energy, internet, or insurance provider so they can complete your application. You will be informed before the hand-off occurs.
- Technology service providers — companies that help us run the Service, including our hosting provider (Netlify), our database and authentication platform (Supabase), and our analytics provider (PostHog). These parties are engaged as processors and may only use your data on our instructions.
- Professional advisers — lawyers, accountants, insurers, and auditors under duties of confidentiality.
- Law enforcement & regulators — where required by law, court order, or to protect our rights and the safety of others.
- Business acquirers — if we sell or transfer all or part of our business, personal information held may be transferred as a business asset. We will notify you before such a transfer occurs.
We do not sell your personal information to third parties for their own marketing purposes.
6. Overseas disclosure (APP 8)
Some of our technology service providers store or process personal information outside Australia. In particular:
- Supabase — our database and authentication infrastructure is hosted on AWS in the Asia-Pacific (Sydney) region (
ap-southeast-2). Supabase Inc. is a US-incorporated company and may access data from the US under its standard data-processing terms, which incorporate Standard Contractual Clauses. - PostHog — our analytics provider processes behavioural and session data on servers in the United States (PostHog, Inc.). PostHog participates in the EU–US Data Privacy Framework and applies equivalent protections.
- Netlify — our hosting and content delivery network (CDN) has points of presence globally; static assets and serverless functions may be served from the nearest available edge node.
Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that they handle it in a manner consistent with the APPs. By using the Service, you acknowledge that your information may be disclosed to overseas recipients in the countries listed above and you consent to that disclosure.
7. Marketing & direct communications
We may send you email communications about relevant deals, rate changes, guides, and Moneyhero news where you have opted in to receive them — either at account creation or by subscribing via our newsletter form.
You can opt out of marketing emails at any time by clicking the Unsubscribe link in any marketing email or by emailing us at privacy@moneyhero.com.au. Opting out of marketing does not affect transactional emails about your account or comparison activity.
8. Cookies & tracking technologies
We use cookies and similar technologies (pixel tags, local storage) to operate and improve the Service. These fall into three categories:
| Category | Purpose | Can you opt out? |
|---|
| Essential | Session authentication, CSRF protection, remembering form progress | No — required for the Service to function |
| Analytics | PostHog — understanding how users interact with pages and flows, measuring feature effectiveness | Yes — email us or use browser privacy settings |
| Preferences | Remembering your selected state, preferred view, and comparison filters between sessions | Yes — clear via your browser |
You can disable cookies in your browser settings; however, essential cookies are required for the Service to function correctly and disabling them may prevent you from completing a comparison or logging in.
9. Bill upload & document storage
Our optional bill-upload feature allows you to photograph or scan an energy bill so we can pre-fill your comparison. When you upload a bill:
- The file is transferred to our secure servers over an encrypted connection (TLS 1.2+).
- We extract relevant fields (NMI/MIRN, distributor, usage, tariff) and use them to pre-populate your comparison form.
- The original file and extracted data are stored securely and linked to your account (if you are logged in) or to your session (if you are not).
- Bill data is retained for 90 days from upload, after which it is permanently deleted unless you have saved it to your account vault.
- We do not share your raw bill file with third parties. Extracted usage data is shared with the provider you choose to switch to, as described in Section 5.
You may delete your uploaded bills at any time from your account settings.
10. Security of your information
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our measures include:
- TLS encryption for all data in transit
- Encryption at rest for database storage
- Password hashing using industry-standard algorithms (bcrypt via Supabase Auth)
- Role-based access controls limiting staff access to personal data
- Regular security reviews and dependency audits
If you become aware of any security concern or believe your account has been compromised, please contact us immediately at privacy@moneyhero.com.au.
No method of data transmission over the internet is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security.
11. Data retention
We retain personal information only for as long as necessary to fulfil the purposes set out in this policy, or as required by law. Our standard retention periods are:
- Account data — retained for the life of your account and for 7 years after account closure (to comply with financial services and tax record-keeping obligations).
- Comparison & referral records — retained for 7 years from the date of the comparison or referral, as required by applicable record-keeping obligations.
- Uploaded bills — 90 days from upload (or until you delete them, whichever is earlier).
- Analytics data — aggregated or pseudonymised after 12 months; raw session data is retained for up to 12 months.
- Support correspondence — 3 years from resolution.
When data is no longer needed and no legal retention obligation applies, we delete or permanently de-identify it.
12. Accessing & correcting your information
Under the Privacy Act you have the right to request access to the personal information we hold about you and to ask us to correct information that is inaccurate, incomplete, or out of date.
To make an access or correction request, contact our Privacy Officer (see Section 15). We will respond within 30 days. We do not charge a fee for access requests, but may charge a reasonable fee for the costs of providing access if the request is complex.
In limited circumstances we may decline an access or correction request (for example, where access would unreasonably affect the privacy of another person, or where the information relates to legal proceedings). If we decline, we will explain our reasons in writing.
13. Complaints
If you believe we have breached the Privacy Act or the APPs, you may make a complaint to our Privacy Officer. We will acknowledge your complaint within 5 business days and endeavour to resolve it within 30 days.
If you are not satisfied with our response, or if we have not resolved your complaint within 30 days, you may refer the matter to the Office of the Australian Information Commissioner (OAIC):
Office of the Australian Information Commissioner
GPO Box 5218, Sydney NSW 2001
Phone: 1300 363 992
Website: www.oaic.gov.au
14. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page with a revised “Last updated” date and, where appropriate, notify you by email. Continued use of the Service after the change becomes effective constitutes your acceptance of the updated policy.