Consumer Data Right policy

Version 1.1, effective 5 November 2026

This policy explains how SuperNice Tax handles bank data you choose to share with us through Australia's Consumer Data Right (CDR). It sits alongside our Privacy Policy and the Software Agreement. If anything in those documents conflicts with this policy for CDR data, this policy applies.

Who we are

SuperNice Tax is provided by Super Nice Advice Pty Ltd (ABN 37 623 908 118), a CPA practice and registered tax agent (no. 26087928).

We receive CDR data through Fiskil, an Accredited Data Recipient under the Consumer Data Right (accreditation number ADRBNK000246). Fiskil collects the data from your bank under your consent and makes it available to us so we can provide your bank feed.

What CDR data we collect

Only what the bank feed needs, and only for the accounts you choose:

Account details: account name, a masked account number (we keep the last four digits) and the name of your bank.
Posted transactions: date, the bank's description and the amount.

We do not collect your bank login details (you only ever enter them on your bank's own page), and we do not request identity details, balances, payees, direct debits or scheduled payments. Pending transactions are ignored.

Why we use it

We use CDR data for one purpose: to keep your books up to date in SuperNice Tax. New transactions arrive automatically, usually daily, and are filed under the right bank account, so you can see your position and your accountant can prepare your BAS (for a business) and your tax return.

Business accounts (sole traders, companies, partnerships and trusts): each transaction is given a suggested category by your own bank rules, then by an AI service provider (see below), and you or your accountant review it.
Personal accounts (individuals): your bank feed is never sent to any AI service. Transactions are categorised only by rules you set up yourself, or by you or your accountant by hand, inside SuperNice Tax in Australia.

We never sell CDR data or anything derived from it, and we never use it for marketing, advertising, profiling, credit decisions or any purpose you have not agreed to.

Who can see it

Who	Why	Where
You, and anyone you give access to your ledger	Your own books	Australia
Super Nice Advice accountants you have engaged	To review your books and prepare lodgements. Every access is recorded in an audit log.	Australia
Fiskil (Accredited Data Recipient)	Collects the data from your bank under your consent	Australia
Cloudflare (service provider)	Hosts SuperNice Tax and stores your ledger, encrypted	Oceania region, Australia
Anthropic (service provider)	Business accounts only: suggests a category for each transaction. Receives the description and amount only, never your name or account details, and may not use it to train its models. Never receives data from personal (individual) accounts.	United States

We do not disclose CDR data to anyone else. Our service providers may only use it to provide their service to us.

How we keep it safe

Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).
Your ledger is stored in Australia.
Access is limited to you, the people you invite and your engaged accountants, and staff access is audited.
Our security program is aligned with ISO 27001 and the ACSC Essential Eight.

Your choices

Choose what to share: you pick your bank and accounts each time you connect.
Stop at any time: click Stop the feed on the Bank statements page in SuperNice Tax, or withdraw consent in your bank's app or online banking. Collection stops straight away.
Sharing period: your consent lasts up to 12 months. We will ask you before it ends whether you want to keep the feed running.

Deleting your CDR data

We delete CDR data; we do not de-identify it. When your sharing ends for any reason:

we stop collecting immediately and ask Fiskil to end the arrangement;
within 30 days we delete the bank feed records we hold that are not part of your books, including the identifiers that link your accounts to the feed;
transactions already recorded in your books become part of your accounting and tax records, which tax law generally requires to be kept for five years. We keep them as part of your records for that period, then delete them.

You can ask us to delete your CDR data at any time by emailing [email protected]. We will do so within 30 days, except for any records the law requires us or you to keep, and we will confirm in writing what was deleted.

Accessing or correcting your data

You can see every transaction from your bank feed in SuperNice Tax at any time. If something looks wrong, you can recode it yourself or message your accountant. You can also ask us for a copy of the CDR data we hold about you, or ask us to correct it, by emailing [email protected]. We will respond within 10 business days.

Complaints

To us first: email [email protected] or call 0489 084 490. We will acknowledge your complaint within 2 business days and aim to resolve it within 30 days, telling you the outcome and why.
To the regulator: if you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We will post any update here with a new version number and effective date, and tell you in SuperNice Tax before a change affects how we handle your data.