Privacy Policy

Last updated: 30 June 2026

Who we are

Extraordinary Money Pty Ltd (ABN 67 691 548 124) operates xmo.au. We’re building a new kind of money product for Australians.

This policy explains how we handle your personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

What we collect

Right now, we collect very little:

• Email address and signup preferences — when you join our waitlist, including any optional preference you set (for example, whether you’d like to hear about open roles at XMO)
• IP address — recorded with your signup for spam and abuse prevention
• Server logs — our hosting infrastructure automatically records IP addresses, browser type, and pages visited for all visitors. These logs are used for security monitoring and service performance, and are retained for 30 days
• Security cookies — used to protect forms from automated abuse. We don’t use advertising cookies or cross-site tracking.
• Aggregate analytics — anonymous counts of page views and signup conversions. No cookies, no cross-site tracking, no personal information.
• Consumer Data Right data — if you connect a bank account in XMO, account details, balances, transactions, saved payees, scheduled payments, direct debits, and bank-held contact details you choose to share through the Consumer Data Right (CDR).

Why we collect it

We collect your email address so we can let you know when XMO launches and share occasional product updates. Your IP address and server logs are used for security, abuse prevention, and monitoring the performance and reliability of our services.

How we store it

Your data is stored in an encrypted database hosted in Sydney, Australia. We use encryption in transit and at rest, and access is restricted to authorised XMO team members and logged.

Consumer Data Right

XMO is a CDR Representative of Fiskil Pty Ltd. Fiskil is our CDR Principal and an Accredited Data Recipient registered with the ACCC. Fiskil manages the secure bank connection and consent process for us. You can read Fiskil’s CDR Policy at fiskil.com/legal/cdr-policy .

We use CDR data only for the purpose shown when you give consent: helping XMO show your connected accounts and transactions, categorise spending, and provide money insights in the app. We don’t use CDR data for direct marketing, sell it, or share it with third parties for their own purposes.

You can withdraw CDR consent at any time through the XMO app or by emailing hello@xmo.au. When consent ends, we stop collecting new data and delete redundant CDR data for that bank connection as soon as practicable. If Australian law requires us to keep a limited record, we keep only what is required.

For CDR access, correction, deletion, or complaint requests, contact hello@xmo.au. We’ll respond within 30 days. If you’re not satisfied, you can complain to the OAIC, or raise the issue with Fiskil through its CDR Policy.

Third parties

We do not sell, rent, or share your personal information for marketing purposes.

We use service providers to operate xmo.au:

• Hosting — our database and application run on encrypted infrastructure in Sydney, Australia
• Error and performance monitoring — used to diagnose failures and keep the site reliable; may receive request data such as IP address and browser type
• Transactional email — will be used to send launch notifications and product updates when XMO launches
• Aggregate analytics — anonymous visit counts only; no cookies or personal identifiers

These providers process data only on our behalf under contractual privacy and security commitments. We do not share your data with any other third parties unless required by Australian law.

Some of these providers are based overseas (primarily the United States). Under Australian privacy law, we remain responsible for your personal information even when it’s processed overseas.

How long we keep it

We retain your email address until you ask us to delete it or unsubscribe.

Server logs are retained for 30 days and then automatically deleted.

Data breaches

If we become aware of a data breach that is likely to cause serious harm, we’ll:

• Tell you as soon as practicable — what happened, what data was involved, and what you can do
• Notify the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme

Email communications

In accordance with the Spam Act 2003 (Cth):

• Every email we send will clearly identify Extraordinary Money as the sender
• Every email will include a way to unsubscribe
• We will honour unsubscribe requests promptly

You can also opt out at any time by emailing hello@xmo.au.

Your rights

You can ask us to:

• Access your personal information — we’ll tell you what we hold
• Correct any information that’s wrong
• Delete your information entirely

Email hello@xmo.au and we’ll respond within 30 days.

Changes to this policy

As XMO grows, this policy will evolve. When we make changes, we’ll update this page and note the date.

Complaints

If you’re not happy with how we’ve handled your information:

1. Contact us at hello@xmo.au — we’ll investigate and respond within 30 days
2. If you’re not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner

Contact

hello@xmo.au
Extraordinary Money Pty Ltd
ABN 67 691 548 124