Privacy Policy

PricePup, FinFox and FuelFalcon use one shared account. Creating an account through one App makes it available in the others. We use account identifiers, email or sign-in-provider details, authentication records, subscription entitlements, security events and global account settings across the Services so that the shared account can operate.

Product activity remains subject to the product-specific practices below. A request to delete the shared account may affect access to every App. Where available, controls that remove only app-specific activity will be clearly labelled.

2.1 Information you provide

We may collect your email address, name if supplied, sign-in provider, account and communication settings, support messages, feedback, correction requests and information entered into a requested feature. If paid features are offered, we may receive billing status, plan and transaction references from a payment provider. [CONFIRM WHETHER FULL PAYMENT-CARD DETAILS ARE EVER STORED.]

2.2 Information collected automatically

Our systems and service providers may collect IP address, device and browser information, timestamps, referring pages, screens viewed, clicks, feature use, session identifiers, diagnostics, API or MCP request logs, rate-limit events and security events.

2.3 Other sources

We may receive account details from a sign-in provider, billing information from a payment provider, and product, retailer, financial-provider or station data from public and third-party sources. We collect only information reasonably necessary for our functions and activities.

PricePup may handle searches, saved products, alerts, retailer or store preferences, postcodes, support messages and affiliate-link interactions. Pharmacy searches, saved items or alerts could reveal health information.

FinFox may handle searches, filters, saved financial products, comparison activity, provider-link interactions and preferences. If a feature collects income, expenses, assets, debts, goals or other financial circumstances, a specific collection notice must explain that collection before it occurs.

FuelFalcon may handle postcodes, suburbs, fuel preferences, selected stations, station interactions and approximate or precise device coordinates. Precise location is used only with device permission and for the purpose explained when requested.

MCP and API features may log account, tool, region, request, response, usage, diagnostic and security metadata needed to provide and protect those features.

We use personal information to:

• create, authenticate and secure the shared account;
• provide plan entitlements and requested app, API and MCP features;
• remember settings, saved items, alerts and relevant preferences;
• return relevant retailer, financial-product or station results;
• process billing status and send essential transaction messages;
• respond to support, feedback and data-correction requests;
• operate, test, troubleshoot, analyse and improve the Services and data quality;
• detect misuse, fraud and security incidents;
• send marketing only where permitted and with an opt-out; and
• meet legal obligations and enforce our terms.

We do not use personal information for a materially different purpose merely because it appears in another App. A new use may require an updated collection notice or consent.

Shared account, subscription, security and global-preference information is used across the Services. App-specific activity is used across Apps only where the use is described in this Policy and the relevant collection notice, is reasonably expected and lawful, or you have consented where consent is required.

We will not use PricePup pharmacy activity or other information that reveals health information to personalise FinFox results, advertising or another App unless a specific feature clearly explains the use and obtains express consent where required. You should avoid including diagnoses, prescription details or other sensitive information in free-text support messages unless necessary.

We do not currently make solely automated decisions using personal information that significantly affect a person's legal rights or interests. If that changes, we will explain the information and decisions involved before the practice begins.

We may disclose personal information to providers that support hosting, databases, authentication, email, analytics, monitoring, customer support and payments. Access is limited to what is reasonably needed and subject to appropriate contractual, privacy and security protections.

At your direction, information may be sent to a retailer, financial-product provider, station operator, map, sign-in provider, payment provider or integration. Its own privacy terms then apply.

We may also disclose information where required or authorised by law, to respond to lawful process, prevent fraud or serious threats, protect legal rights, obtain professional advice, or manage a dispute. Information may be disclosed during a genuine merger, financing, restructure or sale subject to confidentiality and continued protection. We do not sell personal information to data brokers.

Some providers may store or access personal information outside Australia. Likely countries include [INSERT CURRENT COUNTRIES, INCLUDING PROVIDER SUPPORT-ACCESS LOCATIONS WHERE PRACTICABLE]. Provider infrastructure and locations can change.

Before an overseas disclosure, we take reasonable steps required by the Australian Privacy Principles to ensure the recipient handles the information appropriately unless a lawful exception applies. Contact [PRIVACY EMAIL] for the current provider-category and country list.

Cookies, local storage and session storage may support sign-in, security, routing, preferences and measurement. Service providers may generate operational logs, diagnostics and usage metrics. [IDENTIFY ALL ANALYTICS, ADVERTISING AND SESSION-REPLAY TOOLS BEFORE PUBLICATION.] Browser or device controls can restrict these technologies, although some features may stop working.

We may send product news or offers only where permitted. You can opt out using the message's unsubscribe link or by contacting us. Opting out of marketing does not stop essential account, security, service or transaction messages. Sponsored and affiliate content is identified separately from privacy choices.

We retain personal information only for as long as reasonably needed to provide the Services, maintain security and audit records, meet tax or legal obligations, resolve disputes and enforce agreements. Retention depends on the information, account status, legal requirements and risk. When information is no longer needed, we take reasonable steps to delete or de-identify it. Residual copies may remain temporarily in protected backups.

We use reasonable safeguards appropriate to the information and risk, including access controls, encryption in transit, monitoring and secure infrastructure practices. No system is completely secure. We investigate suspected breaches and, where required, notify affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

You may ask to access or correct personal information we hold about you and may request shared-account deletion or available app-specific controls. Email [PRIVACY EMAIL] and describe your request. We may verify your identity before acting. We do not ordinarily charge a fee, but may charge reasonable access costs where law permits.

We aim to respond to access, correction and privacy complaints within 30 days. If we refuse a request, we will explain why and the available complaint options unless law prevents us. Some information may need to be retained despite deletion for legal, security, fraud-prevention or dispute purposes.

You can also manage marketing preferences and device location permissions through the relevant message, account, browser or operating-system controls.

The Services are not designed for children to use independently. A person under 18 should use them only with a parent or guardian's permission and supervision. Contact [PRIVACY EMAIL] if you believe we collected a child's information without appropriate permission.

The Services link to retailers, providers, station operators, maps, identity providers and other third parties. We do not control their privacy practices. Review their notices before providing information.

We may update this Policy to reflect changes in the Services, providers or law. We will update the effective date and give reasonable notice of a material change. Where appropriate, we will seek consent before a new use or disclosure rather than relying only on an updated Policy.

For privacy questions, requests or complaints, contact:

Privacy contact: [PRIVACY EMAIL]

Please describe the issue and provide enough information for us to investigate. We will acknowledge the complaint, investigate it fairly and aim to respond within 30 days. If more time is needed, we will explain why and provide an expected response date.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au. You may also have rights to contact another privacy regulator where you live.