Privacy Policy
MigraTech Pty Ltd — ABN 45 596 350 923
Effective date: 22 October 2026 · Version 1.1
This Privacy Policy describes how MigraTech Pty Ltd collects, uses, stores, discloses, and protects personal information in connection with the MigraTech platform, public tools, client portal, and related services (collectively, the “Services”). This policy applies to all users of the Services, including registered migration agents (“Agents”), their clients (“Clients”), and individuals who use our public tools (“Users”).
MigraTech is committed to protecting personal information in accordance with the Privacy Act 1988 (Cth) (“Privacy Act”) and the Australian Privacy Principles (“APPs”).
1. Information We Collect
1.1 Information You Provide Directly
We collect personal information that you provide to us, including:
(a) Agent Account Information:
- Full name, email address, phone number, and business address
- MARA registration number and practice details
- Billing information (processed and stored by Stripe; we do not store full payment card details)
- Team member details (names and email addresses of Authorised Users)
- Practice preferences, settings, and configuration
(b) Client and Case Information (provided by Agents):
- Full name, date of birth, nationality, and contact details
- Passport details, visa history, and immigration status
- Employment history, qualifications, skills assessments, and English test results
- Health and character declaration information
- Family member details (for included applicants)
- Documents uploaded to the Platform, including identity documents, qualifications, employment references, and financial records
- Case notes, correspondence, and internal assessments created by Agents
(c) User Information (public tools and migrant accounts):
- Full name, email address, and phone number
- Nationality, date of birth, occupation, and qualifications
- English language test scores
- Work experience details
- Visa interests and migration preferences
- Profile information provided through onboarding questionnaires
(d) Inquiry Information:
Information submitted through the agent matching or inquiry functionality, including contact details, visa interests, and supporting details.
1.2 Information Collected Automatically
When you access the Services, we automatically collect:
- Device and Browser Information: IP address, browser type and version, operating system, device type, and screen resolution
- Usage Data: Pages visited, features used, time spent on pages, click patterns, search queries, and navigation paths
- Log Data: Server logs, error reports, and performance metrics
- Cookies and Similar Technologies: See section 8 below
1.3 Information from Third Parties
We may receive personal information from:
- Stripe: Payment confirmation, subscription status, and billing events (we do not receive or store full card numbers)
- Supabase Auth: Authentication tokens and session data
1.4 Sensitive Information
Some information collected through the Services may constitute sensitive information under the Privacy Act, including information about racial or ethnic origin (nationality, country of birth), health (medical examination results referenced in case data), and criminal record (character requirements referenced in case data).
Where Agents input sensitive Client information into the Platform, the Agent is responsible for obtaining consent from the Client for the collection and handling of that sensitive information in accordance with APP 3. Where Users voluntarily provide sensitive information through the public tools, consent is implied by the voluntary provision of that information.
2. How We Use Personal Information
2.1 Primary Purposes
We use personal information for the following purposes:
- providing, operating, and maintaining the Services;
- processing subscriptions, billing, and payments;
- enabling AI Features, including pathway analysis, RFI prediction, document intelligence, and lead scoring;
- facilitating agent-client matching and inquiry handling;
- providing the Client Portal and case status functionality;
- sending transactional communications, including account notifications, billing receipts, deadline alerts, and system notifications;
- providing customer support and responding to inquiries;
- authenticating users and maintaining account security;
- complying with legal obligations; and
- enforcing our Terms of Service.
2.2 Secondary Purposes
With appropriate safeguards, we also use personal information (in de-identified, aggregated form where possible) for:
- improving and developing the Services, including training and improving AI models;
- generating aggregated industry benchmarks and analytics;
- monitoring Platform performance, diagnosing technical issues, and preventing fraud;
- conducting product research and user experience analysis; and
- sending product updates and marketing communications (with your consent, and with the ability to opt out at any time).
2.3 AI Model Training
We may use de-identified, aggregated case outcome data to train and improve our AI models. This data is stripped of all personal identifiers before use. We do not use identifiable personal information to train AI models without explicit consent.
2.4 Automated and Computer-Assisted Decisions
Some parts of the Services use computer programs, including artificial intelligence, to make decisions or to do a substantial part of making them. The table below sets out each one, the personal information it uses, and whether a person is involved. This is published in accordance with Australian Privacy Principle 1.7.
| Decision | What the program does | Personal information used | Human involvement |
|---|---|---|---|
| Whether your enquiry can be sent to an agent | Scores how complete and viable your profile is and returns a tier. Where the result is 'blocked', the button that sends your enquiry to a migration agent is disabled until the missing information is supplied. | Name; Nationality; Occupation; Highest qualification; English test type and scores; Work experience; Preferred state; Passport expiry; Skills assessment status; Estimated points | None at the point the enquiry is blocked — that is decided by the program alone. What the enquiry is missing, and how to supply it, is shown to you. An agent decides separately whether to respond. |
| Visa pathway analysis | Generates an assessment of which visa pathways appear open to a person and what weakens each one. An agent reads it alongside their own analysis before advising. | Nationality; Age; Occupation; English test type and scores | A registered migration agent reviews the analysis and gives the advice. The program does not advise anyone directly, and only a registered agent may. |
| Document authenticity checks | Examines an uploaded document's file structure and metadata for signs of alteration, and rates each finding from 'pass' to 'critical'. A critical finding prompts an agent to query the document before it is relied on. | Uploaded documents, including passports, police clearances, English test certificates, qualifications and employment references; Document metadata such as author, software and modification dates | An agent reviews every finding and decides what to do. Nothing is rejected automatically. |
| Skills assessment outlook | Assesses how an occupation and work history are likely to be received by the relevant assessing authority, to inform how an application is prepared. | Occupation; Highest qualification; Work experience | An agent interprets the output and prepares the application. |
| Request-for-information prediction | Estimates whether the Department is likely to ask for more information about an application, and what about, so it can be addressed in advance. | Case details, including the visa applied for, occupation and documents held | An agent decides what, if anything, to add to the application. |
| Agent registration verification | Checks a migration agent's registration number against the public OMARA register and determines whether a 'verified' indicator is shown on their public listing. | Agent name; Migration agent registration number (MARN) | Results are reviewed by an administrator. Where the register cannot be reached the result is recorded as unchecked, never as not found. |
Taken together, the kinds of personal information used in these decisions are: Age; Agent name; Case details, including the visa applied for, occupation and documents held; Document metadata such as author, software and modification dates; English test type and scores; Estimated points; Highest qualification; Migration agent registration number (MARN); Name; Nationality; Occupation; Passport expiry; Preferred state; Skills assessment status; Uploaded documents, including passports, police clearances, English test certificates, qualifications and employment references; Work experience.
Where this processing happens outside Australia
Some of the analysis above is carried out by providers outside Australia: Anthropic (United States); n8n (region not yet confirmed; requested from the provider in writing). This is in addition to the overseas disclosures described in section 4.
Features that inform you but decide nothing
The following produce information for you rather than decisions about you. We list them so the distinction is clear, and because their results can become inputs to the decisions above.
- Profile completeness: Counts which parts of your profile you have filled in and shows the proportion complete. Arithmetic on which fields are populated, decided nothing by itself. Disclosed because it is visible to agents reviewing enquiries, and so informs whether they contact you.
- Points calculator and pathway checker: Calculates an indicative points score and lists visa subclasses that match your answers, against the published criteria. The output is produced for you, about your own circumstances, and decides nothing about you. Disclosed because the results are saved to your profile and become inputs to the enquiry assessment above.
What these tools are not
Our document checks examine a file’s structure and metadata for signs of alteration. They do not contact the issuing authority and are not confirmation that a document is genuine. None of these tools provides migration advice: only a registered migration agent may do that, and the analysis above is produced for an agent to consider, not to replace their judgement.
If you want to question a decision
You may ask us how a decision about you was reached, ask us to correct the information it relied on, or ask for it to be reconsidered by a person. Contact us at admin@migratech.com.au and see section 7 for your rights in full.
3. How We Disclose Personal Information
3.1 Service Providers
We disclose personal information to third-party service providers who assist us in operating the Services:
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase | Database, authentication and document storage | Everything a practice stores: client names, dates of birth, passport and visa details, case records, uploaded documents, and agent account credentials | Sydney, Australia (AWS ap-southeast-2) |
| Vercel | Application hosting, and page performance measurement | Request metadata including IP address, and anything transiting the application in normal use | United States, with edge delivery worldwide |
| Stripe | Subscription billing | Practice billing contact and payment details. Card numbers go to Stripe directly and are never held by us. | United States |
| Resend | Transactional email | Recipient addresses and the content of messages we send: onboarding, deadline digests, payment notices, support replies | United States |
| Anthropic | AI analysis of visa pathways, skills assessments and requests for information | Case details submitted for analysis, which can include occupation, qualifications, English results and visa history | United States |
| PostHog | Product analytics | Usage events, page views and device metadata | United States |
| Sentry | Error monitoring | Error reports, which can incidentally include request context at the moment something failed | United States |
| Calendar synchronisation, where an agent connects it | Case deadline titles and dates written to the agent's own calendar | United States | |
| Microsoft | Outlook calendar synchronisation, where an agent connects it | Case deadline titles and dates written to the agent's own calendar | United States |
| Xero | Accounting, where an agent connects it | Invoice records including client name and amounts | New Zealand and Australia |
| n8n | Workflow automation behind several of the public migrant tools | Profile details submitted to a tool, such as occupation, qualifications and English results | n8n Cloud; region being confirmed — ask us and we will tell you |
All service providers are contractually bound to use personal information only for the purposes of providing their services to us and to implement appropriate security measures.
We will provide at least 14 days’ notice before engaging a new subprocessor that processes personal information. The full register, including capabilities that are built but not yet switched on, is at Subprocessors.
3.2 Migration Agents
If you submit an inquiry through the agent matching functionality or use the public tools with a referral, your profile information and inquiry details will be shared with one or more registered Migration Agents for the purpose of facilitating a consultation. You will be informed before any such sharing occurs.
3.3 Legal Requirements
We may disclose personal information where required or authorised by: (a) Australian law, including the Privacy Act, the Migration Act, or any court order or subpoena; (b) a law enforcement agency or government authority exercising a lawful function; or (c) the need to prevent a serious threat to the life, health, or safety of any individual or the public.
3.4 Business Transfers
In the event of a merger, acquisition, reorganisation, or sale of all or substantially all of our assets, personal information may be transferred to the successor entity, subject to the commitments in this Privacy Policy.
3.5 No Sale of Personal Information
We do not sell personal information to third parties.
3.6 Connected Accounts
Where you choose to connect a third-party account, MigraTech accesses only the data needed for the specific feature you have enabled. Connecting an account is always optional, and the Services function without it.
| Account | Permission Requested | What We Do With It |
|---|---|---|
| Google Calendar | View and edit events on your calendars (calendar.events) | Create, update, and remove calendar entries for the case deadlines and appointments you schedule in MigraTech. We do not read unrelated events for any other purpose. |
| Microsoft Outlook | Read and write your calendars (Calendars.ReadWrite) | The same calendar synchronisation described above, for practices using Microsoft 365. |
| Xero | Invoices, contacts, and organisation settings (read-only) | Create invoices in your Xero organisation from the fees you record in MigraTech, and match them to the correct contact and revenue account. |
Data obtained from a connected account is used solely to provide the feature you enabled. We do not use it for advertising, do not sell or transfer it, do not allow humans to read it except where you have explicitly asked us to, where it is necessary for security or to comply with the law, and do not use it to train AI models.
MigraTech’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Access tokens are stored encrypted and are used only to make requests on your behalf. You can disconnect an account at any time from Settings → Integrations, which deletes the stored tokens. You may also revoke access directly through your Google account permissions, your Microsoft account, or your Xero connected apps settings.
4. Overseas Disclosure
Our primary database, which holds client records and uploaded documents, is hosted in Sydney, Australia. Until 19 October 2026 it was hosted in Singapore; records created before that date were migrated to Australia and are no longer held offshore.
Some personal information is still stored and processed outside Australia. Service providers listed in our subprocessor register operate in the United States, and one in New Zealand and Australia. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient complies with the APPs or is subject to a law or binding scheme that provides comparable protections, in accordance with APP 8.
By using the Services, you acknowledge and consent to the transfer of your personal information to overseas locations for the purposes described in this policy.
5. Data Security
5.1 Security Measures
We implement reasonable technical and organisational measures to protect personal information from unauthorised access, modification, disclosure, or destruction, including:
- encryption of data in transit (TLS) and at rest;
- row-level security (RLS) policies in our database to enforce data isolation between Agents;
- JWT-based authentication and role-based access controls;
- signed, time-limited URLs for document access;
- regular security monitoring and error tracking;
- access controls limiting employee and contractor access to personal information on a need-to-know basis; and
- secure password hashing and session management.
5.2 Data Breach Response
In the event of a data breach that is likely to result in serious harm, we will: (a) take immediate steps to contain the breach and mitigate any harm; (b) assess the breach in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act; (c) notify affected individuals and the Office of the Australian Information Commissioner (“OAIC”) as required by law; and (d) maintain a record of the breach and our response.
5.3 No Guarantee
While we take reasonable steps to protect personal information, no method of electronic transmission or storage is completely secure. We cannot guarantee the absolute security of personal information.
6. Data Retention
6.1 Retention Periods
We retain personal information for as long as necessary to fulfil the purposes described in this policy, subject to the following:
- Agent account data: Retained for the duration of the Subscription and for 12 months after termination, unless a longer period is required by law.
- Case and Client data: Retained for the duration of the Agent’s Subscription plus 30 days for data export (after which it may be deleted), unless a longer period is required by law.
- User account data: Retained for as long as the account is active and for 12 months after account closure.
- Public tool usage data: De-identified usage data may be retained indefinitely for analytics and AI model improvement purposes.
- Billing records: Retained for 7 years in accordance with Australian taxation law.
6.2 Deletion
You may request deletion of your personal information at any time (see section 7). We will comply with deletion requests subject to our legal obligations to retain certain records.
7. Your Rights
7.1 Access
You have the right to request access to the personal information we hold about you (APP 12). We will respond to access requests within 30 days. We may charge a reasonable fee to cover the cost of providing access.
7.2 Correction
You have the right to request correction of personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13). You may update most personal information directly through your account settings.
7.3 Complaints
If you believe we have breached the APPs or this Privacy Policy, you may lodge a complaint by contacting us at admin@migratech.com.au. We will investigate all complaints and respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the OAIC at www.oaic.gov.au.
7.4 Opt-Out of Marketing
You may opt out of marketing communications at any time by clicking the “unsubscribe” link in any marketing email or by contacting us. Opting out of marketing communications does not affect transactional communications (such as billing receipts, deadline alerts, and account notifications).
7.5 Account Deletion
You may request deletion of your account and associated personal information by contacting us at admin@migratech.com.au. We will process deletion requests within 30 days, subject to our legal obligations.
8. Cookies and Tracking
8.1 Types of Cookies
(a) Essential Cookies:
Required for the Services to function, including authentication session cookies and CSRF protection tokens. These cannot be disabled.
(b) Analytics Cookies:
Used to understand how users interact with the Services, including PostHog analytics cookies. These collect anonymised usage data.
(c) Preference Cookies:
Used to remember your settings and preferences, such as cookie consent choices.
8.2 Cookie Consent
When you first visit our website, you will be presented with a cookie consent banner. You may choose to accept all cookies, accept only essential cookies, or manage your preferences. You can change your cookie preferences at any time through the cookie settings link in the website footer.
8.3 Third-Party Analytics
We use PostHog for product analytics. PostHog collects anonymised usage data, including pages visited, features used, and interaction patterns.
We use Sentry for error monitoring. Sentry collects error reports and diagnostic data, which may include contextual information about the user’s session at the time of an error.
9. Children
The Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where practicable, by email. The “Effective Date” at the top of this policy indicates when it was last updated. Your continued use of the Services after any changes constitutes acceptance of the updated policy.
11. Contact Us
If you have any questions about this Privacy Policy, wish to exercise any of your rights, or wish to make a complaint, please contact us:
Privacy Officer
MigraTech Pty Ltd
ABN 45 596 350 923
Email: admin@migratech.com.au
Office of the Australian Information Commissioner
Website: www.oaic.gov.au
Phone: 1300 363 992
MigraTech Pty Ltd
ABN 45 596 350 923