Privacy policy

Last updated 30 July 2026

Who we are

Truo is an early-access project run by NTWRK Pty Ltd (ABN 59 619 107 336) of 1/101 Moray Street, South Melbourne VIC 3205. When this policy says "we", that is who it means. You can reach us at hello@truo.com.au.

This policy covers two things: the truo.com.au website with its early-access waitlist, and the Truo product, which connects your bank accounts and serves your transactions to the AI assistant you choose. Truo is in early access: a small number of test households are connected and there are no paying customers yet. The bank-data sections below describe exactly how Truo handles your data from the moment you connect, and this is the policy you are shown at the point you give consent.

The waitlist: what we collect

When you join the waitlist:

• your email address
• optional answers, if you give them: which AI assistant you use, your main bank, and whether the indicative price would work for you
• which part of the page you signed up from

For security and consent records:

• a one-way, salted hash of your IP address, used to limit abuse of the signup form. Our waitlist records only ever hold this hash, never the address itself
• your browser's user-agent string
• the time you signed up and the time you confirmed, which Australian spam law requires us to be able to show

For understanding interest in Truo, we use PostHog analytics on this site. It records page visits and events (like clicks on the "connect" button), heatmaps, and session replays of how visitors move around the page. Anything you type is masked and never recorded. If you sign up, the signup event notes where on the page you joined from, which assistant you chose and your answer to the price question, but never your email address. PostHog uses a cookie or local-storage entry to tell visitors apart. We use this to understand how the site is used as a whole, not to identify you.

What we never collect

Your internet banking password: the Consumer Data Right does not work that way, and nothing ever logs in as you. Your card details: those go to Stripe, our payment provider, never to us. And your details are never bought from, or sold to, anyone.

Why we collect it

• to run the waitlist: sending your confirmation email, your welcome email, and the invitation when early access opens
• to understand demand in aggregate, so we build the right thing
• to keep the signup form safe from bots and abuse
• to keep the consent records the Spam Act 2003 (Cth) expects us to keep

How we email

We use double opt-in: you get one confirmation email, and we only add you to the list if you click it. Every email we send carries a one-click unsubscribe. If an email to you bounces permanently, or you mark one as spam, we stop emailing you automatically. We do not buy, sell, rent or swap email lists.

When you connect a bank

Truo collects the data you consent to share: your accounts, balances and transactions, in full. That means the actual rows, with their dates, amounts, descriptions, merchant names and references, not summaries of them. The product's job is to let you and your AI assistant work with your own records at full detail, and it stores what that requires. Alongside the bank data, Truo holds your login email and your subscription status.

How your data reaches us, and the law that holds it

You share your data under the Consumer Data Right, Australia's open banking framework. Your bank discloses it to openfeed, an accredited data recipient (ADR000204), and openfeed discloses it onward to Truo with your consent. Truo itself is not an accredited data recipient. Once your data is with us it is no longer covered by the CDR's privacy safeguards; it is held under the Privacy Act, the Australian Privacy Principles and this policy. Bank data over CDR rails, held under the Privacy Act. We would rather describe that exactly than borrow a word like accredited that does not apply to us.

What we do with it

• store it, encrypted, in Australia, once you connect
• serve it to the AI assistant you connect, when you ask that assistant a question
• build the exports you request: Excel and CSV
• build your statements: a household chart of accounts, income and spending, and a balance sheet from the accounts you have connected

That is the whole list. We do not sell your data, we do not use it for advertising, we do not use it to train models, and we do not give it to anyone to train theirs. Truo makes money one way: the subscription.

Your AI assistant

Truo serves your data to the assistant you connect: Claude or ChatGPT. When you ask a question, the assistant reads the rows it needs through Truo and answers in your chat. Nothing moves unless you ask; Truo cannot push data to your assistant on its own. What the assistant's maker does with your conversations, including whether they are used for training, is governed by your agreement with that provider, not by this policy, and their data settings are worth checking.

How long we keep your bank data

For as long as you are a Truo customer. When you stop, we delete it.

There is no fixed number of years, and that is deliberate. The Australian Privacy Principles do not set a retention period. They ask a different question: do we still need this data for the reason you gave it to us? While you are using Truo, the answer is yes, because answering your questions about your own money is the entire product. When you leave, the answer is no, and holding your bank records after that would be us keeping them for no reason.

So your history is not on a clock. It builds up for as long as you keep using Truo, and that is the point of the product: in a few years, what you paid three winters ago is exactly the kind of question Truo will answer. How far back we can reach on the day you connect is up to your bank, and in our own testing it was about two years. Everything from that day onwards we keep, for as long as you are with us.

When you delete your Truo account, your stored bank data goes unreachable straight away and is permanently deleted within seven days. All of it: transactions, balances, accounts, activity. We do not keep a de-identified copy instead. The only things that stay are the limited records the law requires us to keep, such as tax and billing records.

Two things are worth separating, because they are easy to confuse. Cancelling your subscription is not the same as deleting your data. Cancelling stops the billing and leaves your history where it is, so you can come back to it. If you want it gone, delete your account.

Withdrawing your consent at openfeed is not the same either. It stops new data reaching us. It does not, on its own, remove what we already hold: openfeed and Truo are two separate arrangements, deliberately, and neither can direct the other. If you withdraw there and want your Truo data gone too, delete your Truo account, or email us and we will do it.

Security, stated honestly

The sensitive detail in your bank data, descriptions, merchant names and reference numbers, is encrypted at rest, and every account has a unique key. Amounts, dates and categories stay in plain, searchable form, because your assistant needs to add them up to answer you. Those keys are themselves encrypted under a master key, held in a separate service to the one holding your data. The practical effect: a stolen copy of our database does not hand over your transaction descriptions or merchant names, and one compromised key does not open anyone else's data.

Every read we make to answer you, run an export, or run a sync is recorded: what was read, by which part of the service, and when. That log covers the ways Truo's product reads your data on your behalf. It does not, and cannot, cover a direct database query or a backup restore carried out by whoever operates the underlying infrastructure.

And the limit, stated plainly. Truo's own service can decrypt your data, because it has to: when you ask your assistant a question, or an export or scheduled sync runs, Truo reads your transactions on your behalf. So this encryption protects you against theft of stored data. It does not protect you against a compromise of Truo's own running service. Some products in this position say "end-to-end encrypted" anyway. We do not, because for a product that answers questions on your behalf it would not be true.

Who handles data on our behalf

• openfeed is the accredited data recipient your bank data travels through, with your consent.
• Supabase holds your stored bank data, in a database based in Sydney, Australia.
• Cloudflare hosts this site, our waitlist database and the Turnstile bot check, and runs the servers that read and write your data on your behalf. Your bank data itself is not stored on Cloudflare.
• Stripe processes payments when you subscribe. Your card details go to Stripe, never to us.
• Amazon Web Services sends our email from its Sydney region, and holds the master key that protects your account's encryption key, also in Sydney.
• PostHog provides analytics for this website only and is hosted in the United States. Your bank data never touches it.
• Anthropic (Claude) and OpenAI (ChatGPT), both United States based, receive your banking data when you ask them a question through Truo. This is the product working as intended: you choose the assistant, you ask the question, and Truo serves the rows it needs to answer. Nothing is sent unless you ask. What each provider then does with your conversation, including whether it is used to train their models, is governed by your agreement and your settings with them, not by this policy. On their consumer plans, training is commonly on by default and can be turned off in their settings. It is worth checking.
• Your browser also fetches fonts from Google Fonts and logos from the Brandfetch and Simple Icons CDNs, all three United States based. Like any web request, those services see your IP address and browser details when it does.

These providers process data so we can run the service, and only for that. Your bank data is stored only in Australia. It leaves Australia in one circumstance and one only: when you ask your assistant a question, the rows needed to answer it go to Anthropic or OpenAI in the United States. We used to say your bank data never leaves the country. That was wrong, and this is the correction.

We do not sell your data

Truo is a paid subscription. That is the business model. Your details and your data are not for sale, to anyone, at any price.

Your choices

• Ask what we hold about you, or ask us to correct it: hello@truo.com.au. We will answer within 30 days, and there is no charge. If we cannot give you something, or cannot correct it the way you asked, we will tell you why in writing and how to take it further.
• Take your data with you: Excel and CSV export are on every plan.
• Withdraw consent for a bank connection at any time; new data stops flowing.
• Delete your account and your stored bank data goes with it, apart from what the law requires us to keep.
• Unsubscribe from emails anytime using the link in any email.

How long we keep waitlist details

We keep your waitlist details while the waitlist is running. If you unsubscribe, we keep your email on a do-not-contact list so we honour that choice. If you ask us to delete your details entirely, we act on that promptly.

Complaints

If you think we have handled your information badly, tell us first at hello@truo.com.au and we will sort it out. We will acknowledge you within 5 business days and give you our answer within 30 days, in writing, including what we found and what we have done about it. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If this policy changes, we will update this page and the date at the top. If a change is significant and you are on the waitlist or hold an account, we will tell you by email.

Back to truo.com.au